This policy explains what data we process when you use SocialPicker, why, who we share it with and what you can do about it. It applies to two kinds of people: those who use the Service (organize giveaways) and those who take part in a giveaway (commented on a post and don't necessarily know SocialPicker). If you are a participant, section 4 is for you.
1. Who is responsible
The data controller is Morac Group LLC, owner of SocialPicker (socialpicker.app). Contact details for privacy matters are published in the Service.
2. What data we process if you use the Service
2.1. Identifying your device
- What: a random identifier and a key, stored in a cookie (
sr_web_device) in your browser and in our database. Also an approximate country (from the network), browser language and technical data of your browser or app (version, operating system, device model). - Why: to recognize your device so we can show you your giveaways and orders, sign your requests to the server and prevent abuse.
- Legal basis: performance of the contract (providing the Service) and legitimate interest (security).
- How long: the cookie lasts 180 days. The device record in our database currently has no automatic deletion period; it is kept as long as the Service exists. You can request its deletion (section 9).
2.2. Your giveaways
- What: the post URL, public data of that post (owner's username, profile picture and identifier, title, thumbnail, number of comments), the giveaway settings (winners, alternates, filters), the loaded comments (see section 4) and the result (winners, alternates, seed, hash and algorithm).
- Why: to run the giveaway, show you the result, generate the video, allow the result to be checked, and resolve claims.
- Legal basis: performance of the contract.
- How long: loaded comments are automatically deleted after 30 days. The giveaway settings and result currently have no automatic deletion period; they are kept as long as the giveaway exists in the Service, so we can display it and handle claims. You can request their deletion (section 9).
2.3. Payments
- What: if you buy a plan, Stripe transmits to us your email, country, currency, payment method (card, Pix, OXXO, Link…), amounts (the one shown in your currency and the one settled in USD) and transaction identifiers. We do not receive or store your card number or your bank credentials; Stripe handles that.
- Why: to charge, enable the paid giveaway, manage refunds and disputes, comply with accounting and tax obligations, and prevent fraud.
- Legal basis: performance of the contract and legal obligation (accounting and tax).
- How long: for as long as the applicable accounting and tax obligations require. Stripe also keeps its own records according to its policy.
2.4. Product analytics
- What: usage events (which steps of the wizard you saw, whether a giveaway was created, whether the result was shared), with an anonymous identifier generated by the analytics tool in your browser, your country, language and, where applicable, the giveaway identifier and plan type. It does not include your email, your name or participants' names.
- Why: to understand where people get stuck and improve the product.
- Legal basis: legitimate interest. We do not enable analytics if you are in the European Union, the European Economic Area or the United Kingdom, or if your browser sends the "Do Not Track" signal.
- How long: events stay in the analytics tool and contain no data that identifies you.
2.5. Technical and security data
- What: server logs (date, path, errors, device identifier), request signatures and per-device usage counters. The country is obtained from the network at the moment and we do not store your IP address in our database; it may appear transiently in infrastructure logs.
- Why: to make the Service work, detect abuse, limit excessive use and diagnose errors.
- Legal basis: legitimate interest (security and continuity).
- How long: technical logs are kept for as long as our infrastructure providers keep them.
2.6. What stays in your browser
We store in your browser (localStorage or sessionStorage), without sending it to our servers: the name you gave each giveaway, which giveaways you hid, which notices you have seen, the data of the wheel, the raffle and the secret santa, the post preview and the detected country. You can delete it from your browser settings.
2.7. Support
If you write to us, we process your email and the content of your message to reply. Legal basis: legitimate interest. Retention: as long as necessary to handle your request.
3. What data we do NOT process
- We do not create accounts or ask for passwords, name, phone or social accounts.
- We do not access your Instagram, TikTok or Facebook account or your private messages. We only read public comments of the post whose URL you load.
- We do not store card data.
- We do not sell personal data or use it for third-party advertising.
- We do not make automated decisions with legal effects on you. The pick of winners is random and you configure it; filters apply criteria you choose.
4. If you took part in a giveaway
4.1. Where your data comes from. We did not obtain it from you. When an organizer loads a post, we obtain that post's public comments through data providers. From each comment we process: your username, your public name, your public profile picture, the comment text, its date, the mentions and hashtags it includes, and whether your account is verified. We never access private data of your account.
4.2. Why. So the organizer can apply their rules (for example, "one entry per person" or "mention two friends") and pick winners at random; to show them the result; and, in paid giveaways, to generate a video of the result in which participants' names and photos may appear.
4.3. Legal basis. The organizer's legitimate interest in running their giveaway and ours in providing the service, on data you made public when commenting.
4.4. How long. Loaded comments are automatically deleted from our servers after 30 days. If you came out as a winner or alternate, your username and comment stay in the giveaway result as long as that giveaway exists in the Service; it currently has no automatic deletion period. The video, if generated, remains available to the organizer. In both cases you can request deletion (4.5).
4.5. What you can do. You can ask us for access to what we hold about you, to rectify it or to delete it, by writing through the Service's contact channel with the post link and your username. We handle it manually and reply within 72 hours. If your request concerns the result of a giveaway already held, we may keep the minimum necessary so the organizer can prove the result against claims, and we explain what we keep and why. You can also complain to the giveaway organizer, who decided to run it with that post.
4.6. If you are under 18. The Service is for people over 18, but we cannot know the age of whoever comments on a post. If you are a minor, or responsible for a minor who appeared in a giveaway, write to us and we delete their data with priority.
5. Who we share data with
We share data only with the providers we need to deliver the Service, for the purposes of this policy:
| Provider | Purpose | What it receives | Where |
|---|---|---|---|
| Stripe | Process payments, refunds and disputes | Email, country, payment method, amounts | United States / Ireland |
| Railway | Host servers and database | All Service data | United States |
| Cloudflare | Content delivery, security and approximate country | Web traffic, transient IP address | Global |
| Social network data providers | Obtain the post's public comments | Post URL, owner's username | [COUNTRIES] |
| Video generation service | Generate the result video in paid giveaways | Participants' usernames, names and photos, result | [COUNTRY] |
| Mixpanel | Product analytics | Anonymous events, country, language | United States |
We may also share data when the law requires it (court or authority order), to defend our rights, or in the event of a sale or merger of the company (with notice to you).
If the organizer downloads or shares the result, they decide with whom. That is no longer under our control.
6. International transfers
Your data may be processed in countries other than yours, in particular the United States, where our servers and several of our providers are located. You can ask us for more information through the Service's contact channel.
7. Cookies and local storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
sr_web_device | Essential | Recognize your device and sign your requests | 180 days |
NEXT_LOCALE | Essential | Remember your language | 365 days |
Mixpanel (mp_*, in localStorage) | Analytics | Measure product usage | Until you delete it |
sr_* (localStorage / sessionStorage) | Functional, local | Giveaway names, local games, seen notices, preview | Until you delete it |
Essential cookies cannot be disabled without the Service ceasing to work. You can delete or block the others from your browser. We do not show a cookie banner: analytics turns itself off in the regions listed in 2.4 and when your browser sends "Do Not Track".
8. Security
We apply reasonable technical and organizational measures: encrypted connections (HTTPS), session cookies inaccessible from scripts (httpOnly), device keys encrypted in the database, signed requests to prevent impersonation, usage limits against abuse, internal panel access restricted to authorized staff with individual credentials, and automatic deletion of loaded comments. No system is infallible: if an incident affecting your data occurs, we notify the authority and the affected people when the law requires it, within the applicable deadlines.
9. Your rights
Depending on the law that applies to you, you have the right to:
- Access the data we hold about you.
- Rectify it if it is inaccurate.
- Delete it, unless we must keep it due to a legal obligation or to defend claims.
- Object to processing based on legitimate interest, or withdraw your consent where you gave it.
- Restrict processing while a request is being resolved.
- Portability: receive a machine-readable copy of the data you gave us.
- Not be subject to automated decisions with legal effects. We do not make such decisions.
- Complain to the data protection authority of your country.
To exercise them, write to us through the Service's contact channel. Requests are handled manually. To locate your data we need, if you are a user, the giveaway or order identifier (shown in the Service and in the Stripe receipt); if you are a participant, the post link and your username. We reply within 72 hours; if resolving the request takes longer, we tell you in that reply.
10. Minors
The Service is aimed at people over 18. We do not knowingly collect data from minors as users. For minors who appear as participants, see 4.6.
11. Changes to this policy
We may update this policy. We publish the new version with its effective date on this page. We recommend checking it from time to time.
12. Contact
Privacy, rights and support: through the contact channel published in the Service. We reply within 72 hours.
This policy is available in several languages. If there are differences, the [Spanish] version prevails.