Privacy Policy
Last updated: August 23, 2026
1. Who we are
MyDrawDay (mydrawday.com) is operated from Barcelona, Spain. For any privacy question, contact us at hello@mydrawday.com. We are the "data controller" for the limited data described below.
2. Data we collect
Analytics (on by default; stops if you click "Decline"). We use Google Analytics 4 to understand which features people actually use — for example, which lottery gets checked most, whether the syndicate splitter gets used, which language is selected. This is aggregate, behavioral data (page views, button clicks, session duration, general device/browser type, approximate country-level location derived from IP). We do not ask for or collect your name, email, phone number, or exact location. This runs on every visit by default — the banner shown on your first visit is a real choice, not a gate: clicking "Decline" turns it off immediately and clears the associated cookies, but if you close the banner without choosing, or simply don't interact with it, analytics keeps running until you do decline.
Advertising pixel (loads on every visit, not gated by the cookie banner — see note below). While we're running paid promotion for MyDrawDay, we use the Meta Pixel (Facebook/Instagram) to measure whether people who see an ad go on to visit or use the site. It records that a page was viewed, general device/browser information, and — depending on your browser and Meta account state — may be linked to a Facebook/Instagram account you're logged into, via cookies Meta sets. We use it for advertising measurement only; we don't use it to build audiences from your syndicate group data or account details, since it has no access to those. Unlike our analytics, this currently loads immediately on every page visit, before you've made a cookie-banner choice — we know that's inconsistent with the consent-first approach used everywhere else in this policy, it's a known gap we're tracking, and we'd rather say so plainly than let the earlier wording of this policy stand uncorrected.
Locally on your device only (never sent to our servers). MyDrawDay stores a few small preferences directly in your browser's local storage, so the app remembers your choices between visits:
- Whether you accepted or declined the analytics cookie banner
- Whether you've dismissed the "Add to Home Screen" tip on iPhone
- Your selected language
These stay on your device. We never see or receive them.
Only if you sign in to save a syndicate group (optional, beta). This one feature is opt-in — you'll only encounter it if you tap "Sign in with Google" on the Syndicate tab, and nothing else in MyDrawDay ever asks you to. If you do, we use Google Sign-In to authenticate you, and we store the following in our database (Google Firebase) so your group is there next time you visit: your Google account's name, email address, and profile photo URL; and whatever you type into a saved group yourself — the group's name, the lottery, line count and hypothetical jackpot you entered, and the names you give each member (these can be first names, nicknames, or initials — please don't enter anyone's full legal name or other sensitive detail you wouldn't want stored). We do not collect payment details, and this feature does not currently involve any payment. No other part of MyDrawDay requires this sign-in.
Not built yet: a paid subscription. If that launches, this policy will be updated again before it ships, and you'll be asked for consent again where required.
3. Cookies and similar technologies
Google Analytics 4's cookies are set by default on your first visit, and removed if you click "Decline" on the banner shown that visit (we also send Google an explicit signal to stop when you do). The Meta advertising pixel described above works the same way but has no "Decline" path yet — see Section 7 for how to limit it in the meantime. You can change your mind about analytics at any time: clicking "Decline" from that first-visit banner is the direct way, or clear your browser's site data for mydrawday.com to reset everything, including the banner itself.
4. Legal basis for processing (GDPR)
Where GDPR applies, our legal basis for the analytics described above is our legitimate interest (Article 6(1)(f)) in understanding how the site is used, balanced against a real, always-available opt-out. We want to be direct about this: analytics runs by default rather than waiting for your prior consent, which is a deliberate change from how this policy read before — we made that call to get usable traffic data, since a strict opt-in banner meant most visits generated no data at all. We know this is a different (and more debatable) legal footing than the clean "consent, collected first" model we still use for the sign-in feature below, and we're not pretending otherwise. For the optional sign-in feature, our legal basis is consent (Article 6(1)(a)) — you actively choose to tap "Sign in with Google," and nothing is stored about you before you do. For the Meta advertising pixel, we likewise rely on legitimate interest (Article 6(1)(f)) in measuring paid promotion while we're running it, and it has no opt-out mechanism of our own yet (see Section 7). You may decline analytics or withdraw the sign-in feature's consent at any time, as described above and in Section 7.
5. Who we share data with
We use Google Analytics 4, provided by Google Ireland Limited / Google LLC, as a data processor for analytics, and Meta Platforms Ireland Limited / Meta Platforms, Inc. (the Meta Pixel) for advertising measurement while we run paid promotion. If you use the optional sign-in feature, we also use Google Firebase (Authentication and Firestore database), also provided by Google, to sign you in and store your saved syndicate groups. Data may be processed on servers outside the EU/EEA (including the United States); both Google and Meta participate in the EU-U.S. Data Privacy Framework and/or rely on Standard Contractual Clauses for these transfers. We do not sell your data. Beyond the Meta Pixel's advertising-measurement purpose described above, we do not share data with anyone for advertising or marketing purposes.
6. How long we keep data
Analytics data is retained according to our Google Analytics 4 property settings (Google's default retention window is 2 months for user-level data unless configured otherwise; event-level aggregate reporting may be retained longer for trend analysis). Meta Pixel data is retained according to Meta's own advertising data policies, which we don't control; we'll remove the pixel entirely once we're no longer running paid promotion. If you sign in to save a syndicate group, that group's data is kept until you delete the group yourself in the app, or until you ask us to delete your account (Section 7) — whichever comes first. We don't hold any separate copy of this data ourselves; it lives only in our Firebase database.
7. Your rights
If GDPR applies to you, you have the right to:
- Know what data is processed about you
- Turn off analytics at any time — click "Decline" on the banner (it clears the analytics cookies too), or clear your browser's site data for mydrawday.com to reset everything
- Limit the Meta Pixel specifically — since it isn't yet gated by our own banner, use your browser's tracking protection, an ad blocker, or Meta's own Ad Preferences controls if you have a Meta account
- Delete any syndicate group yourself, at any time, from the Syndicate tab
- Object to processing, or request access, correction, or full deletion of your account and any data associated with it, by emailing hello@mydrawday.com — we don't yet have a self-service "delete my account" button, so until we do, this is a manual request we'll action promptly
- Lodge a complaint with your national data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD), aepd.es
8. Children's privacy
MyDrawDay is not directed at, or intended for use by, children. Lottery participation requires the legal minimum age in the relevant country (typically 18), and MyDrawDay is intended for the same audience. We do not knowingly collect data from children.
9. Security
We rely on Google Analytics 4's, Google Firebase's, and Meta's own security practices for the data described above, and standard HTTPS encryption for all traffic to mydrawday.com. Access to your saved syndicate data is restricted to your own signed-in Google account via database security rules — we don't build any admin tool to browse it, and we only look at it directly if you contact us for support.
10. Changes to this policy
If what MyDrawDay collects changes — most likely when user accounts or paid subscriptions are introduced — this policy will be updated and the "Last updated" date above will change. Material changes affecting your rights will be flagged in-app.
11. Contact
Questions about this policy or your data: hello@mydrawday.com