SweetDraw
Sign in Join

Privacy Policy

Effective date: May 31, 2026

1. Who we are

SweetDraw ("SweetDraw", "we", "us", or "our") operates the SweetDraw website (sweetdraw.me) and the SweetDraw mobile applications for Android and iOS (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have under applicable laws — including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA, and other applicable privacy laws.

For privacy questions or to exercise your rights, contact our Data Protection Officer at support@sweetdraw.me.

2. Data we collect

  • Account data: email address, display name, password hash, authentication provider (e.g. Google).
  • Profile / shipping data: full name, phone number, postal address, country, date of birth (used to verify you are 18+).
  • Transactional data: sweepstakes entries, ticket purchases, points balance, ad-view rewards, points transfers.
  • Gameplay data: Fairy Challenge mini-game results, scores, win credits, challenge attempts, and related progression.
  • Device and technical data: IP address, device type, OS version, app version, language, time zone, crash logs.
  • Advertising identifiers: Google Advertising ID (Android), IDFA (iOS), AdMob ad-interaction events.
  • Cookies and similar technologies on our website (see Section 8).

We do not knowingly collect special-category data (race, religion, health, etc.).

3. How we use your data

  • Create and manage your account, authenticate sign-in, and prevent fraud or abuse.
  • Operate sweepstakes: register entries, draw winners, contact winners, and ship prizes.
  • Verify legal eligibility (age 18+, country of residence, sanctions screening).
  • Provide free-entry mechanics (Fairy Challenge mini-games, rewarded video ads, win credits, points, transfers).
  • Send transactional emails (OTP codes, draw results, account changes).
  • Show personalised or non-personalised advertising via Google AdMob (see Section 6).
  • Comply with legal obligations (tax, accounting, anti-money-laundering, consumer protection).
  • Improve the Service, debug issues, and ensure security.

4. Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 GDPR:

  • Contract (Art. 6(1)(b)) — to provide the Service, process entries, and deliver prizes.
  • Legal obligation (Art. 6(1)(c)) — for tax, accounting, sweepstakes regulation, and responding to lawful requests.
  • Legitimate interests (Art. 6(1)(f)) — for fraud prevention, security, service improvement, and basic analytics. You may object at any time.
  • Consent (Art. 6(1)(a)) — for personalised advertising, marketing emails, and non-essential cookies. You may withdraw consent at any time.

5. Your rights under GDPR (EU) and UK GDPR

If you are located in the EU, UK, EEA or Switzerland, you have the following rights:

  • Right of access — obtain a copy of the personal data we hold about you.
  • Right to rectification — correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations.
  • Right to restriction of processing.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object to processing based on legitimate interests or for direct marketing.
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Right not to be subject to solely automated decision-making producing legal or similarly significant effects. Winner selection is a randomised draw and does not profile you.
  • Right to lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority in the EU, or the UK Information Commissioner's Office, ICO, at ico.org.uk).

To exercise any of these rights, email support@sweetdraw.me. We will respond within one month, as required by Article 12(3) GDPR. You can also delete your account at any time from Profile → ⋮ → Delete profile, which removes your personal data subject to limited legal retention.

International transfers: when we transfer personal data outside the EEA or UK (for example to our cloud providers in the United States), we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) to ensure an adequate level of protection.

EU / UK representative: if you would like to contact our representative in the EU or UK, please write to eu-rep@sweetdraw.me.

6. Advertising and Google AdMob

SweetDraw shows rewarded video advertisements via Google AdMob. Rewarded ads may be offered to claim a Fairy Challenge mini-game win credit, to unlock an additional game attempt, or to earn points directly. When you watch an ad, AdMob and its certified third-party advertising partners may store and/or access information on your device (including advertising identifiers, IP address, and other device data) and may use this data to:

  • Show personalised or non-personalised ads and content;
  • Measure ad and content performance and conduct audience research;
  • Develop and improve advertising services.

For users in the EEA, UK, and Switzerland we present a Google-certified IAB Transparency & Consent Framework (TCF v2.2) consent message before any personalised advertising. You may choose Consent, Manage options, or refuse personalised ads — in which case only non-personalised, contextual ads will be served. You may change your choices at any time from Profile → Privacy preferences.

For users in California and other US states with similar laws, we honour Global Privacy Control (GPC) signals and treat them as a request to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising.

Learn more about Google's data practices at policies.google.com/technologies/partner-sites.

7. Sharing your data

We share personal data only with:

  • Service providers (processors) acting on our behalf: cloud hosting (Lovable Cloud / Supabase, Cloudflare), email delivery, customer support, analytics, and crash reporting.
  • Advertising partners (Google AdMob and its certified vendors) — only with your consent where required.
  • Payment and shipping partners to deliver prizes you win.
  • Authorities where required by law, court order, or to protect our rights, safety, or property.
  • Successors in connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We do not sell your personal data for money.

8. Cookies and similar technologies

We use strictly necessary cookies to operate the Service (authentication, session, security). With your consent we also use analytics and advertising cookies. You can manage cookies in your browser settings and revoke consent at any time.

9. Data retention

We retain personal data only as long as necessary for the purposes set out in this Policy, or as required by law (typically up to 7 years for tax and sweepstakes records). When you delete your account, we erase or irreversibly anonymise your data, except for information we must keep to comply with legal obligations or to resolve disputes.

Account deletion: You can delete your account at any time by going to Profile → ⋮ → Delete profile. Upon deletion, all your personal data — including your profile, entries, tickets, transaction history, points, win credits and gameplay records — will be permanently removed from our active systems and nothing will be stored. Any points you have earned or accumulated will be forfeited and cannot be recovered. We may retain minimal anonymised records where required by law (for example, tax or sweepstakes compliance), but these will not identify you personally.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption at rest, row-level security, hashed passwords, access controls, and regular backups. No system is 100% secure; please use a strong, unique password.

11. Children

The Service is intended for users 18 years or older. We do not knowingly collect personal data from children under 18 (or under the applicable age of digital consent in your jurisdiction, where higher). If you believe a child has provided us data, contact support@sweetdraw.me and we will delete it. We comply with the US Children's Online Privacy Protection Act (COPPA).

12. California, Virginia and other US state rights

If you are a California resident, you have the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information, and the right not to be discriminated against for exercising your rights, under the CCPA/CPRA. Similar rights apply under Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA) and other state laws. To exercise these rights, email support@sweetdraw.me.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app or by email at least 30 days before they take effect. The "Effective date" at the top reflects the latest revision.

14. Contact us

SweetDraw — Data Protection Officer
Email: support@sweetdraw.me

See also our Terms & Conditions.