Privacy
Last updated 5 September 2026
What we collect, why we have it, how long we keep it and how to get rid of it. Written against what the code actually stores, not a template.
To be filled inData controller: [TODO: legal name of the operator], [TODO: registered address]. ICO registration number: [TODO: ICO registration number].The short version
We hold your email address and the details of the product you entered. We use the address to tell you what happened to your entry and to send Friday’s winners. You can stop the winners email in one click and still hear about your own entry. There is no analytics on this site, no advertising, no tracking, no profiling, and nothing is sold or shared with anyone beyond the suppliers listed below.
What we collect, and why
| What | Why | Lawful basis | Kept |
|---|---|---|---|
| Your email address, plus the product name, URL, one line, X handle and icon you submitted | To run the draw you asked to be in, and to tell you what happened to your entry | Contract — you asked to enter, and we cannot do it without these | Until you ask us to remove it |
| Whether your entry was approved or rejected, and the reason given | So the decision can be explained to you and is not made twice | Contract | Until you ask us to remove it |
| The link to your post on X, when you claim a share ticket | So a person can check the post is real before issuing a second ticket | Contract | Until you ask us to remove it |
| Tickets, draw results and the record of any win | So a settled draw stays checkable by anyone. These name your product, not you | Legitimate interests — a draw nobody can verify is not worth running | Indefinitely, as published history |
| Your IP address, when you submit an entry, look up a link or claim a share | Rate limiting, so the forms cannot be flooded | Legitimate interests — keeping the site usable and stopping abuse | Deleted once it is more than 24 hours old |
| A record that we sent you the winners email, and any error the provider returned | So a send that fails part way can resume without writing to you twice | Legitimate interests — sending each email exactly once | Indefinitely |
| Your email address on the unsubscribe list, if you unsubscribe | So we do not email you again | Legal obligation — we have to remember that you said no | Indefinitely, because forgetting it would start the emails again |
We do not ask for your name, your address, your date of birth or anything about you personally. There is no account and no password. We never see payment details because there is nothing to pay.
What is public
Once your entry is approved, its product name, URL, one line, X handle, icon and entry number appear on the board and on the page of any draw it is in. Your email address is never shown anywhere on the site and is never given to another entrant.
Fetching your page
When you submit a URL our server requests that page once to check it loads and to read its title, description and icon. That request comes from our server, so the site you entered sees our server, not you. We store the icon’s address and load it from their site when the board is drawn.
There are two kinds, and they are treated differently.
- About your own entry. Confirmation that we received it, and whether it was approved or rejected. This is part of running the draw for you, and you cannot unsubscribe from it — without it you would never learn what happened.
- Friday’s winners. Goes to everyone whose entry has ever been approved, because the list is the prize. Every one of these carries a one-click unsubscribe link, and your mail app’s own unsubscribe button works too.
The lawful basis for the winners email is legitimate interests: you entered a draw whose entire purpose is that winners get sent to the list, and being on it is the thing that makes entering worth anything. You can object at any time, in one click, and we will act on it immediately.
Unsubscribing stops the winners email only. You will still be told what happens to your own entry, and your entry stays in the draw. If you would rather have neither, ask us to delete the entry.
Who else handles it
Four suppliers. Each is a processor acting on our instructions, and none of them may use your data for their own purposes.
| Supplier | What they do | Where |
|---|---|---|
| Vercel | Hosts the site and runs the code. Sees requests, including IP addresses, in its logs | London (lhr1) |
| Neon | The database — everything in the table above lives here | London (AWS eu-west-2) |
| Resend | Sends the email. Handles your address and the message itself | A United States company; mail leaves via AWS in Ireland (eu-west-1) |
| cron-job.org | Calls a URL on our site on a schedule, to settle the draw on Friday. It is given no personal data at all | Germany |
The database and the code both run in London. Resend is based in the United States, so sending email means your address and the contents of that email are handled by a US company — an international transfer under UK GDPR. If you would rather that did not happen, the answer is to not enter, because we cannot tell you the outcome of your entry without emailing you.
Cookies
None, if you are just visiting. No cookies are set on the public pages, there is no analytics, no tag manager, no advertising or social pixel, and no third-party script of any kind. Nothing is stored in your browser and nothing follows you to another site. That is why there is no cookie banner: there is nothing to consent to.
The single exception applies to the operator, not to visitors. Logging in to the admin area sets one cookie, admin_session, which lasts twelve hours and exists only to keep that person logged in.
Automated decisions
Picking winners is automated and random, and it makes no judgement about you. Approving or rejecting an entry is done by a person, not a machine. Nothing here profiles you, scores you, or makes a decision with a legal or similarly significant effect.
Your rights
Under UK GDPR you can ask us to:
- Show you what we hold about you, and where it came from
- Correct anything that is wrong
- Delete your entry and your email address
- Stop using it for something, or restrict what we do with it
- Object to the winners email — the unsubscribe link does this instantly, but you can also just ask
- Hand it over in a portable form
Email draws@stubbers.app. We will reply within one month, and it is normally the same week. There is nothing to pay and you do not need to give a reason.
One honest limit on deletion. We can remove your entry, your address and everything connected to them. If your product has already won a draw, that draw’s published result names it, and removing it would break the record that lets anyone check the draw was fair. Tell us and we will work out what can be taken down without making a past draw unverifiable. Deletion is done by hand — there is no button for it — which is why it takes an email rather than a click.
Complaining
If we have not sorted something out, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you told us first, at draws@stubbers.app, so we can fix it.
Changes
If this policy changes, the date at the top changes with it. If the change is significant — a new supplier, or a new use of your address — we will email the list rather than quietly edit the page.
Contact
draws@stubbers.app. The rules of the draw itself are in the terms.