Privacy

Who we are

UUID Lotto is run by Ville Mikkola, a private person in Finland, who decides what happens to the data described here. Write to contact@uuidlotto.com about anything on this page.

What we keep

When you get a ticket, we make a player for you: a random id, a pseudonym like "player 3f9a", and the display name if you set one. We keep your tickets and the day this browser last visited.

If you add a passkey, we keep its public key and when it was last used. The private key never leaves your device.

Your tickets, their scores and your pseudonym or display name are public: they show in a draw's results, on the leaderboard and on share cards.

Cookies and your browser

One cookie keeps you signed in as your player: a random token, which we store only as a hash. It lasts 400 days from your last visit. Two short ones carry a message to the next page (a minute) and a passkey sign-in (five minutes). All three are needed for the site to work, so there is no cookie banner.

Your browser also remembers whether sound is on, whether to hide seconds, and which results you have seen. That stays on your device; we never see it.

IP addresses

We use your IP address to limit how many players and requests come from one network, which keeps the game fair. We hold it in memory for at most a day and never write it down. Our host may keep it in its own logs for running the service.

Who else is involved

Sliplane (Germany) hosts the site on servers in Finland and processes the data above for us.

drand, the source of the draws, is asked by our server, not your browser, except when you press Check on the verification page: then your browser asks drand directly.

Two timestamp authorities, freeTSA.org and Certum, get a fingerprint of each closed ticket list, nothing about you.

We count visits with Plausible Analytics (Estonia, data kept in the EU), without cookies: the page, the site that linked here, your approximate location (country, region and city) and the kind of device and browser. Plausible doesn't store your IP address and can't recognise you from one day to the next. Ticket pages are counted without the ticket's id. There are no ads.

How long

A sign-in this browser hasn't used for 400 days is deleted. A player nobody can sign in as any more loses their display name, and is deleted if they have no tickets. Tickets stay with the draws they were in.

Backups hold a copy of everything for up to two weeks.

Your rights

Profile shows everything we keep about you. "Forget me" there removes your player's link to you. For anything else, such as a copy of your data or a correction, write to contact@uuidlotto.com.

If you think we handle your data wrongly, you can complain to the Data Protection Ombudsman in Finland (tietosuoja.fi).