Privacy Policy

Introduction

This privacy policy covers the Lucky Pick Chrome extension and the Lucky Pick web application. Both are built so that the comments you collect are never sent to us, and this page explains exactly what each one touches.

Data Collection

We do NOT collect or keep any personal data, except in the two cases described at the end of this section. Outside those two cases, this includes but is not limited to:

• Instagram or YouTube usernames and profile information
• Comment data or text content
• Passwords or authentication credentials
• Browsing history or activity
• Personal information of any kind

The two exceptions:

• Profile pictures: winners' profile pictures are loaded through our server, and our web host keeps a cached copy of each picture for up to a day.
• Share links: if you make a share link, the winners' usernames and entry counts are part of its address, so they reach our web host whenever someone opens it.

How the Extension Works

The Lucky Pick extension:

• Only runs against a post or video you have open, and only when you start a collection from luckypick.win
• Reads comments using your own logged-in session, on your own connection — it never asks for, sees, or stores your password
• Holds the collected comments in local extension storage on your device, and sends them only to the luckypick.win tab you have open, over a direct connection between the extension and that tab
• Does NOT send any data to us or to any external server

How the Web App Works

The Lucky Pick web application:

• Processes all giveaway data client-side in your browser
• Does NOT store comment data or giveaway results on any server
• Receives comments directly from the extension in your browser; they are never uploaded
• Saves a CSV of the collected comments when you ask for one; your browser writes the file straight to your device
• Shows winners' profile pictures, after a draw, by loading them through our server. That request carries the picture's address. Our host caches each picture for up to a day so it loads quickly next time. Shared results pages show no profile pictures, so opening a share link loads none
• Does NOT require an account, a login, or any connection to your Instagram or Google account. The site itself has no login of any kind

Share Links and Draw Records

If you create a share link, the winners' usernames and entry counts are encoded in that link, along with the giveaway's totals, the colour theme, the draw's seed and the comments' fingerprint (a hash, from which no comment can be read back); anyone with the link can see them. The link is made in your browser, but because the data is part of the address, it reaches our web host whenever someone opens the link, as any web address does.

A draw record contains every collected comment — including comments that didn't count as entries and comments from excluded users — with each commenter's username and account ID, what they wrote, when, and the comment's ID. It also holds the entry list built from those comments, the post's address and its owner's username and account ID, the rules (including any manual entries and the usernames you excluded), the seed, the winners and any alternates, and a fingerprint of the comments. It is downloaded to your device and goes nowhere else: you decide whether to publish it. The verifier reads a draw record in your browser and uploads nothing.

Permissions Explained

Chrome Extension Permissions:

• scripting: Runs the comment request inside the Instagram or YouTube tab you already have open, so it uses your session rather than ours.
• storage / unlimitedStorage: Saves progress on your device after every batch, so a long collection survives being interrupted. Large giveaways can exceed the default storage limit, which is why the unlimited variant is requested.
• alarms: Wakes the extension back up to resume a collection if the browser has paused it.
• notifications: Tells you when a collection finishes or stops, so you do not have to watch it.
• host permissions (instagram.com, youtube.com): Limits the extension to those two sites. It cannot read any other site.
• externally connectable (luckypick.win): Lets this site — and only this site — ask the extension to start a collection and receive the results.

The extension no longer requests activeTab, and it has no side panel. It has no content script on Instagram or YouTube either; its only content script runs on luckypick.win, where it tells this site the extension is installed. Everything it collects stays on your device.

Third-Party Access

We do NOT share, sell, or transmit any data to third parties. All giveaway processing happens locally on your device.

The only request our server makes to anyone else is for a winner's profile picture, which it fetches from the Instagram or YouTube image server that issued the picture's address. The preview image a share link shows in chats and social posts is drawn on our server using only a font built into it, so the winners' names are never sent to a font or emoji service. Characters that font can't draw appear in the preview as a dot.

Children's Privacy

Our extension and web app do not knowingly collect information from children under 13. The tools are designed for content creators and social media managers.

Data Security

Apart from the two exceptions under Data Collection, we don't collect or keep any giveaway data, so there is none to be compromised. Collected comments live in your browser's local extension storage until you clear them, and you maintain full control over any exported CSV files.

Open Source

This project is open source. You can review the code to verify our privacy practices at any time.

Changes to This Policy

If we make changes to this privacy policy, we will update the "Last Updated" date at the top of this page.

Contact

If you have questions about this privacy policy, please contact us through our GitHub repository or at the contact information provided on our website.