Last updated [DATE] · effective [DATE]
The short version: we collect your email so you can sign in and get receipts, the state you say you enter from, and which giveaways you have ticked off. That is the entire list. We do not ask for your name, your phone number, your address or your date of birth — you type those into the sponsor's own form, never into ours. We do not sell anything we hold, we do not share it for advertising, we never see your card number, and you can download or delete all of it yourself from inside the site.
| What | Where it comes from | Why it exists |
|---|---|---|
| Email address | You, at sign-up | It is your login — we mail you a sign-in link instead of making you invent a password. Also receipts and service notices. |
| The state you enter from | You, by picking it on the map or the State box | Sweepstakes carve states out constantly. Without this the board cannot tell you what you are actually eligible for. Optional; leave it blank and the board speaks for the whole country. |
| Which giveaways you ticked off, and when | You, by using the checklist | So the board knows what to leave out of tomorrow's run, and when a daily entry unlocks again. |
| Subscription status, billing period end, Stripe customer reference, card brand and last four digits | Stripe, after you pay | To know whether to unlock the board, and to show you your own plan. We never receive your full card number, expiry or security code. |
| Basic server logs — IP address, browser user-agent, page requested, timestamp | Automatically, by our host | Security, abuse prevention and debugging. Not used to build a profile of you. |
| Waitlist email | You, if you signed up before launch | To tell you when it opened. Nothing else. |
We use what we collect only to: run your account and sign you in; unlock the board you paid for; take payment and send receipts; save you retyping your entry details; remember what you have entered; answer you when you write to us; keep the service secure and working; and meet our legal and tax obligations.
That is the complete list. We do not use your information to advertise to you, to profile you, to make automated decisions about you, or to train any machine-learning model.
We are a one-person operation and we do not have staff reading your data. We do rely on four service providers, each of which handles only what it needs to and is contractually bound to process it on our instructions and not for its own purposes:
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database and authentication | Your email, your state, your ticks, your subscription status |
| Netlify | Hosting and serverless functions | Server logs; data in transit |
| Stripe | Payments and the billing portal | Your email, your card data (which we never see), your billing address and transaction history. Stripe uses it as a processor for us and, for fraud prevention and its own legal compliance, as a controller under its own privacy policy. |
| [EMAIL SENDER — name the provider that sends your sign-in links and receipts, e.g. Supabase's built-in mailer, Resend, or Postmark] | Delivering sign-in links and service email | Your email address and the message |
Analytics: [NAME YOUR ANALYTICS TOOL AND WHAT IT COLLECTS, OR WRITE "we use none".]
Beyond those, we disclose personal information only: when you tell us to; when we are legally required to, by a valid subpoena, court order or law — and we will tell you unless we are forbidden to; when it is genuinely necessary to investigate fraud, abuse, or a threat to someone's safety or to the security of the service; and if the business is ever sold or merged, in which case the buyer takes on this policy and we will email you before your information moves.
No system is perfectly secure, and we will not pretend otherwise. Protect access to your email inbox, since that is what signs you in.
You do not have to ask us for most of this — it is built into the site. Sign in and open your account panel:
You may also write to us at support@sweepwatcher.com to exercise any right below. We will verify you by asking you to reply from the email address on the account, and we will not charge you or degrade your service for asking. We respond within 45 days, and if we genuinely need longer we will tell you within those 45 days and take no more than 45 more. An authorised agent may act for you if you give them written permission and we can verify it.
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights below. This section is our notice at collection as well.
| Category | Do we collect it? | Disclosed to whom, for a business purpose |
|---|---|---|
| Identifiers — email address, account ID, IP address | Yes | Supabase, Netlify, Stripe, our email sender |
| Identifiers — your name or postal address | No. Stripe collects a billing address to take payment and for tax; we do not receive it as part of your account. | — |
| Customer records — phone number, street address, date of birth | No | — |
| Commercial information — subscription and transaction records | Yes | Stripe, Supabase |
| Internet activity — server logs of requests to our own site | Yes | Netlify |
| Geolocation | Only the state you type in. No precise location, ever. | Supabase |
| Inferences drawn to build a profile about you | No | — |
| Sensitive personal information | No | — |
| Biometric, audio, visual, employment, education, genetic data | No | — |
We honour the Global Privacy Control signal where a browser sends one, even though we have no sale or sharing to stop.
Shine the Light (California Civil Code §1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes.
If you live in a state with a comprehensive consumer privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky or Rhode Island — you have substantially the same rights described above: to confirm whether we process your data and access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling with legal effects. We do none of those last three.
Nevada residents: Nevada law lets you tell a website not to sell your covered information. We do not sell it, but if you would like your instruction recorded anyway, email us and we will log it.
Washington and Nevada health-data laws: we collect no consumer health data of any kind.
We set the minimum a login can work with, and nothing for advertising:
Analytics cookies: [DESCRIBE WHAT YOU ACTUALLY SET, OR WRITE "none". If you ever add an ad pixel or a third-party analytics tag, you must disclose it here and at the point of collection, and in most states you must then offer an opt-out.]
We honour Global Privacy Control and Do Not Track signals.
This service is for adults. You must be 18 or older to hold an account, because every promotion we list requires it. We do not knowingly collect personal information from anyone under 18, and we have no content directed at children. If you believe a child has given us information, write to support@sweepwatcher.com and we will delete the account and its data promptly.
We are in the United States, our providers process data in the United States, and the service is offered to US residents only. It is not directed at people in the European Economic Area, the United Kingdom, Switzerland, Canada or elsewhere, and we do not offer it to them. If you use it from outside the US, you understand your information will be handled in the US under US law.
If personal information is exposed in a way that triggers a notification duty, we will tell affected people by email without unreasonable delay, and notify regulators where the law requires it. The notice will say what happened, what was involved, and what we are doing about it.
We may update this policy. The date at the top says when it last changed. If a change materially reduces your privacy or expands how we use your information, we will email you at the address on your account at least [NUMBER — we suggest 30] days before it takes effect, and where the law requires your consent we will ask for it rather than assume it. We will not apply a material change retroactively to information already collected without telling you.
Questions, requests, or complaints about privacy:
[LEGAL ENTITY NAME OR YOUR FULL LEGAL NAME]
[BUSINESS ADDRESS]
support@sweepwatcher.com
If you are not satisfied with our answer, you can complain to your state attorney general, and California residents can contact the California Privacy Protection Agency.