What happens on your device
When you add names and press “Draw names”, your browser does all the work. The shuffle runs on your device, the assignments are made on your device, and every reveal link is built on your device. The pages you load from us are static files — the same files for everyone, with none of your information in them.
Nothing you type is transmitted. Not the names, not the exclusions, not the event details. There is no “save” happening quietly in the background, because there is nowhere to save to.
What we don’t have
Most privacy pages list what a company collects and how carefully it guards it. Ours is shorter, because the honest answer is: we don’t have anything.
- No database. There’s nowhere your names could be stored, leaked from, or subpoenaed out of.
- No accounts. Nothing to sign up for, so nothing to know you by.
- No emails collected. We never ask for an address — yours or anyone else’s.
- No cookies. Neither the site nor the analytics that counts page views sets one, so there’s no banner to click away.
Don’t take our word for it
This claim is checkable in about a minute, and we’d love you to check it. Open your browser’s devtools (press F12 or right-click and choose “Inspect”), switch to the Network tab, then add some names and run a draw. Watch the request list while you do it: nothing goes out. Your names, the exclusions, the event details and every generated link stay in the tab you’re looking at.
You will see one request that isn’t for a file of ours, and we’d rather point it out than let you find it and wonder: a small script from Cloudflare that counts page views. It loads once per page and reports the address of the page — for a reveal link that’s /reveal, with everything after the # left off, which is precisely where the result lives. It sets no cookies, it can’t read what you type, and it doesn’t follow you between sites.
We also ship a Content-Security-Policy header that instructs your browser to refuse requests to any server except ours and that one counter. The no-third-parties rule isn’t just a promise we keep — it’s one your own browser enforces.
That’s the whole reason this site can make promises other tools can’t — the privacy isn’t a policy, it’s the architecture.
How reveal links carry their own data
Each reveal link contains its own result — the giver, the receiver, and any event details — packed into the part of the address after the # symbol, called the fragment. Browsers never send fragments in HTTP requests. So when someone opens their link, our host serves the same static reveal page it serves everyone, and the browser reads the result out of the fragment locally. Even we never see who drew whom.
That’s also why nothing expires: there’s no record of the draw anywhere except in the links themselves.
The honest bits
A few things we’d rather say plainly than let you assume otherwise:
- The links are obfuscated, not encrypted. The payload is lightly scrambled so it doesn’t read as plain text in a decoder, but anyone who has a link can open it. The security model is simple: send each link only to its person.
- The organizer’s device generated every link. An organizer who wants to peek at the results, can. If you’re organizing and want a surprise too, ask someone else to run the draw — or trust yourself not to click.
- Old links can’t be revoked. With no server, there’s nothing that could invalidate a link after a re-draw. The tool warns you before every re-draw so nobody ends up holding a stale result.
Where we stand on analytics
We run Cloudflare Web Analytics, and nothing else. It’s cookie-less, it doesn’t follow anyone between sites, and it builds no profile of you. What it records is which page was loaded and roughly where in the world from — never the contents of a page, and never the part of a reveal link after the #. It exists so we can tell whether anyone is finding the site in December.
We will never add Google Analytics or anything like it. That would break the promise this whole page makes, and the promise is the product.
Ready to draw?
Head to the Secret Santa generator for the festive version, or draw names from a hat online for raffles, chores, and pairings.