Giviways Privacy Policy

This Privacy Policy explains how Giviways collects, uses, shares, and protects personal information when you use our website, app, creator tools, giveaway features, analytics, billing flow, and related services.

By using Giviways, you agree that we may process information as described in this policy and as necessary to provide the service, comply with law, protect the platform, and run giveaways accurately.

If you do not agree with this policy, please do not use the Service.

For privacy purposes, the controller or business responsible for your information is Giviways.

Contact us about privacy at Legal@giviways.com or through our contact form.

For legal notices, contact us using the details above; a mailing address will be added here once available.

Account information. When you create an account, we may collect your email address, password hash handled by our authentication provider, display name, username, profile image, date of birth or age-related information where needed, and other profile settings you choose to add. You may update your declared country in your profile; to prevent abuse of region-restricted giveaways, country changes are subject to a cooldown period and a maximum number of changes per year.

Giveaway and entry information. We collect giveaway entries, referrals, entry usage, participation history, winner confirmations, prize claim status, and other activity needed to run or audit giveaways.

Location and region-eligibility signals. To support region-restricted giveaways, we associate entries and giveaway page views with a country or region, derived from your account's declared country or your request's approximate location. Creators may see this data in an aggregated, de-identified form (for example, entries grouped by country) through analytics features; we do not display an individual entrant's precise location to creators.

Creator, eligibility, and connected-platform information. If you apply as a creator or connect a platform, we may collect platform account identifiers, profile names, profile URLs, public account statistics where permitted, eligibility or review results, review notes, and related creator status data.

Billing and plan information. If you use paid creator plans, we may collect checkout metadata, billing records, payment status, invoices or receipts, plan selections, and transaction identifiers from the payment provider.

Support and communications. If you contact support or request deletion, we may collect the messages you send, related account details, and records of our response.

Security and abuse-prevention information. We use login history, rate-limit signals, request metadata, and similar information to detect fraud, abuse, or account misuse.

Analytics and product usage. We collect anonymous page analytics through Vercel Analytics and a limited first-party product analytics stream for key funnel events such as signup, onboarding, creator application, giveaway publishing, entries, billing outcomes, and winner actions.

Cookies and similar technologies. We use essential cookies and similar local storage or session storage to keep you signed in, support OAuth flows, protect the service, and store anonymous analytics session identifiers.

If you connect YouTube, Twitch, Discord, or another supported service, we may receive and store information that the provider makes available through its API or permissions you grant, such as account identifiers, display names, login names, profile images, public URLs, public account statistics where permitted, and signals needed for creator onboarding, eligibility checks, account connection, fraud prevention, or other platform features you request.

We store OAuth access tokens and refresh tokens only in an encrypted backend-only vault that browser clients cannot read, write, or otherwise access, and we keep browser-readable social snapshots separate from those credentials.

We do not put OAuth access tokens, refresh tokens, authorization codes, or OAuth state values into analytics events, and browser-visible social snapshots contain only safe display and status fields needed for the product surface that uses them. For creators on eligible plans, we may also store periodic historical snapshots of public follower or subscriber counts over time, used to power creator-facing growth analytics.

Connected-service data is used to operate features you request, support account connection, creator onboarding, eligibility checks, fraud prevention, and platform-related features that are permitted by the applicable provider. It is not used for ad targeting or fingerprinting, and it is only exposed to the product surface that needs it.

If you choose to connect a YouTube or Google account, Giviways may use YouTube API Services to support the specific YouTube-related features you request, such as account connection, creator onboarding, eligibility checks, or other permitted platform functionality.

Giviways' use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements, where applicable.

Giviways does not use YouTube API data for advertising, retargeting, selling personal information, or unrelated profiling.

You can disconnect your connected YouTube or Google account inside Giviways where that option is available. You can also revoke Giviways' access through your Google account security permissions page. Revoking access may limit or disable YouTube-related features.

After disconnection, revocation, or account deletion, we delete or de-identify YouTube authorized data where required, subject to legal, security, fraud-prevention, dispute, and audit requirements.

We use information to create and manage accounts, sign you in, send confirmation or support emails, run giveaways, administer entries, manage referrals and entry allowances, review creator applications, process payments, support permitted campaign features, and communicate about your account or transactions.

We use analytics and logs to understand product usage, measure funnel performance, detect fraud or abuse, troubleshoot issues, and improve the Service.

We do not use your information for ad-tech tracking, cross-site profiling, or fingerprinting.

If you opt in to weekly updates or other promotional emails, we use your email address to send those messages and to manage your subscription status.

Weekly newsletter emails may include giveaway updates, platform news, and promotions. You can unsubscribe at any time from the email footer or from your account settings.

When you opt in or withdraw consent, we may store a consent record that includes the email address or user account, timestamp, source page, consent text and version, and limited request metadata such as IP address or user agent when available.

We use Vercel Analytics for anonymous page-level traffic reporting.

We also store a small set of first-party product analytics events in Supabase in a table called analytics_events. That table is protected by row-level security and is intended to store only privacy-filtered event names and limited metadata.

Creators on eligible plans can generate downloadable analytics reports about their own giveaways. These reports contain aggregated statistics only (for example, entry counts by country or by day of week, or the share of entrants who joined multiple giveaways) — they do not include individual entrant usernames, and country-level breakdowns with very few participants are grouped into a broader category to avoid identifying individuals.

Our product analytics do not store raw IP addresses, user agent strings, emails, usernames, OAuth tokens, authorization codes, session objects, or provider profile URLs.

We do not use product analytics for advertising, retargeting, audience building, or selling personal data.

We keep security and operational logs to protect the Service, monitor rate limits, investigate abuse, and troubleshoot errors. These logs may include request metadata, hashed or limited network information, login history, error messages, and action outcomes.

We may also record token-vault access, refresh, unlink, revoke, and backfill events for security and audit purposes. Those audit records never include token values or decrypted credentials.

We try to keep these logs minimal and avoid storing more data than is needed for security and support. We do not use them for ad-tech or fingerprinting.

We share information with service providers that help us run the Service, such as authentication, hosting, database, analytics, email, and payment providers.

We may share information with connected platforms when you choose to connect them, and with winners, creators, or other users as needed to operate giveaways, support permitted platform features, administer entries, prevent fraud, or deliver prizes.

We may disclose information if required by law, to respond to lawful requests, to protect users or the Service, to prevent fraud or abuse, or in connection with a business transaction such as a merger, acquisition, or sale.

We do not sell personal information.

Giviways is a global service, and your information may be processed in countries where we, our affiliates, or our service providers operate.

By using the Service, you understand that your information may be transferred to and processed in countries outside your own.

We take reasonable steps to protect personal information consistent with this Privacy Policy, but local laws and protections may differ depending on where processing occurs.

We keep personal information only as long as needed for the purposes described in this policy, unless a longer retention period is required by law or for dispute resolution, fraud prevention, audit, accounting, security, or similar operational needs.

Deletion does not always remove every record right away. Account and profile data may remain in backups or operational records for a period of time, and some records may be retained where the law or our operational needs require it.

Analytics events are designed to be short-lived raw records, and we may aggregate or prune them over time for reporting and maintenance.

You may request full account deletion through the deletion flow in the product. Disconnecting a connected social account is a separate action, and you may also revoke Google or YouTube access through your Google account security permissions.

When we process a deletion request, we may send a confirmation email before deleting the account. If active giveaways, unresolved creator-side obligations, or unused spendable credit remain, we may delay or block deletion until those obligations are resolved.

If deletion is completed, any remaining credit may be permanently removed and cannot be recovered, withdrawn, transferred, or converted to cash. We also keep records needed for legal compliance, payment processing, accounting, fraud prevention, dispute handling, giveaway integrity, and security.

Backups and operational records may take time to remove, and some giveaway records, billing records, support records, or security logs may remain after deletion if we need them to operate or defend the Service.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing.

You can update many account details inside the Service. For privacy requests, contact us at Legal@giviways.com or through our contact form.

If you want to stop receiving non-essential emails, use the unsubscribe link in the email where available or contact us for help.

The Service is not intended for children who are not old enough to consent to online services under the laws that apply to them.

If you believe a child has provided us personal information without appropriate consent, contact us so we can review the request.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the effective date below.

If a change is material, we may provide additional notice where required by law.

Privacy questions, deletion requests, and data-rights requests can be sent to Legal@giviways.com or through our contact form.

If you need a postal address for formal notices, contact support@giviways.com.