Privacy Policy

Optional Google sign-in: information we receive

When available, Sign in with Google lets you create or access an Evidraw account. With your permission, Google provides our authentication provider, Supabase, with your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture. We request only basic sign-in permissions (openid, email and profile). Evidraw does not receive your Google password or request access to Gmail messages, contacts, Google Drive files or calendar events.

How we use Google account information

We use your authenticated identifier and email address to recognize you, connect you to your private Evidraw workspace, maintain your sign-in session and protect account access. Your email may also be used for support, account communications, the notifications you select and subscription administration if you choose Evidraw Plus. Signing in does not itself subscribe you to marketing emails. We do not use Google account information for targeted advertising, sell it, or automatically include it in Ask Evidraw AI requests. Google sign-in does not send your lottery portfolios or billing details to Google.

Where Google account information is stored and shared

Supabase stores the authentication account and the basic profile information received from Google. Evidraw stores the account identifier, email address, sign-in-provider association and account creation timestamps in its application database hosted on Cloudflare. The current workspace uses your email rather than your Google name or picture for its account display. Sign-in session information is stored in your browser using first-party authentication cookies.

Supabase and our hosting infrastructure process this information to authenticate you and operate the service. If you subscribe, Stripe receives account and billing information, including your email, to manage payments. Our email delivery provider, Resend, processes your email address and message content when we send account or selected notification emails. Authorized support personnel may access information needed to resolve your request. We do not provide Google profile information to affiliate partners or HeyCatch; the separate limited analytics described below do not include your name or email. Providers may process information outside Canada, subject to their own policies. See the privacy policies of Google, Supabase, Cloudflare, Stripe and Resend.

How we protect account information

The public website and its authentication services use HTTPS to protect information in transit. Evidraw validates sign-in sessions and checks account ownership before allowing access to private workspace records. Google sign-in uses a proof-key authorization flow to exchange the sign-in code for a session. Authentication secrets are kept on the server, not embedded in public application code. These safeguards reduce risk but cannot guarantee that any online service is completely secure. Avoid sharing your sign-in codes or leaving a signed-in session open on a shared device.

Retention, deletion and Google access controls

We retain account information while it is needed to provide your account and the services described here. You can download your Evidraw workspace data or request account deletion from Account & Privacy, or contact privacy@evidraw.com for help, access or correction requests. The in-app deletion flow requires an active subscription to be cancelled and its paid period to end first; contact us if you need assistance with a privacy request while subscribed.

Account deletion removes the workspace records covered by that flow and requests removal of the associated Supabase authentication account, including its Google sign-in identity. If authentication cleanup fails, support must complete it. This does not delete your Google account. We retain a hashed sign-in identifier and deletion timestamp to help block recently deleted sessions; this is not a retained copy of your Google profile. The current system does not automatically expire that deletion record. AI usage totals without an account association and records outside the workspace deletion flow, such as payment, referral, payout and provider security records, may remain for billing, dispute handling, fraud prevention or provider retention requirements. Deletion does not promise immediate removal from every provider backup or log.

You can separately remove Evidraw's access in your Google Account connections. Revoking access does not itself delete information already held by Evidraw or cancel a subscription. Signing out or clearing cookies also does not delete your account. Email-code sign-in remains available. We will update this notice if the way we use Google account information changes.

Ask Evidraw AI pilot

Ask Evidraw is optional. Before sending a question, you agree to share its text and up to three recent question-and-answer exchanges from the current conversation with OpenAI, within a size limit, along with the selected game, language, product guidance and public verified draw facts. Consent applies to each follow-up until you uncheck it or start over. We do not automatically send your identity, saved portfolios, account or billing details. Do not include sensitive information in a question. Conversation text is held temporarily in the open page, not saved to your account or browser storage. New conversation, switching games or reloading clears this page's history and resets consent; it does not erase usage records or data already processed by OpenAI. Older exchanges may be omitted from follow-up context to preserve limits. OpenAI may retain API data for security and abuse monitoring under its privacy policy, including processing outside Canada. We request that responses are not stored as API conversation state; that is not a promise of zero provider retention.

Evidraw stores a request identifier, account identifier, UTC date and time, and conservative budget reservation to enforce daily and shared monthly limits. Every follow-up counts as a request. These records contain no question or answer text. Usage records are included in account export; deletion removes their account association while retaining anonymous totals to preserve spending limits. AI answers can be wrong and cannot change settings, purchase tickets or guarantee winnings.

Optional portfolio explanations

Explain my portfolio first shows a summary calculated from one of your saved portfolios. Viewing this preview does not send it to OpenAI or consume an AI question. With your separate consent, each question in that conversation includes the displayed aggregate summary: game, line count, coverage, overlap, sums, parity counts, available previous-draw overlap counts and recorded preferences. Individual ticket lines, seeds, identity, spending and billing details are not automatically included. The server rechecks ownership and the summary before sending. Remove portfolio starts a new conversation without that summary; New conversation resets consent but keeps the preview available for review. Neither action deletes information already processed by the provider. These explanations do not change your portfolio or its settings.

Language preference

If you choose English or French, Evidraw stores your choice in a first-party preference cookie for up to one year. It contains only the language code, not your identity or lottery data. The choice applies to this browser and can be changed using EN / FR or cleared in your browser settings. It does not change your province, game choices, account permissions, or marketing consent.

Optional draw explanations

Explain this draw shows the selected verified draw and, when available, the immediately previous draw. Public facts include main numbers, bonus or special ball, sources, verification times, sums, parity and repeated main numbers. Explain my result can additionally show match counts from one owned portfolio confirmed as played before that draw. This private summary is sent to OpenAI only with separate consent for each question in that conversation; it excludes individual ticket numbers, identity, seeds, spending and billing. Viewing the preview does not contact OpenAI or use a question. Ownership, timing and displayed facts are rechecked before sending. Remove my results starts fresh without the private summary; New conversation resets consent. Neither action removes data already processed by OpenAI. No tickets, settings or results are changed.

Information we use

When you sign in, Evidraw receives basic account information needed to identify your private workspace. We store the portfolios you generate, the lines you confirm as played, ticket cost, settings, timestamps and later scoring results. If you subscribe, we also store the Stripe customer and subscription identifiers, plan, status and renewal date needed to manage your access. Our hosting providers may also process basic technical and security logs.

First-party launch analytics

When you visit Evidraw, we use a limited first-party cookie to count a unique visit and remember whether you arrived from an Evidraw link on Instagram, X, Reddit, or email. If you later sign in, that source may be connected to privacy-safe journey milestones such as signing up, building a portfolio, confirming a play, viewing results, or activating Plus. We do not send your lottery numbers, ticket contents, prizes or spending details to advertising platforms, and we do not use third-party advertising trackers for this measurement.

HeyCatch analytics

We also send HeyCatch limited server-side events to understand visits and key product milestones. These events contain a separate pseudonymous visitor identifier, campaign source, campaign name, a general landing-page category, and milestone names such as first connecting an account, building a portfolio, or activating Plus. We do not install HeyCatch browser click tracking or send it your email, name, Evidraw account identifier, lottery selections, ticket contents, costs, prizes, card information, payment amounts, or billing identifiers. HeyCatch and its service providers process these events in the United States and other locations to provide analytics to Evidraw. See HeyCatch's privacy policy.

How we use it

• Provide and secure your private workspace.
• Save locked pre-draw portfolios and score only confirmed played lines against official results.
• Respond to support or privacy requests.
• Maintain and improve the reliability of Evidraw.

Partner referrals

If you arrive through an approved partner link, Evidraw records a limited first-party referral identifier for up to 30 days and may connect that referral to a new account. A creator code can also connect an eligible account at checkout. We use payment, refund and dispute events to calculate commissions and prevent self-referrals or ineligible payouts. Partner dashboards show aggregate results, not customers' identities, ticket choices or private account activity. Partner applications include the contact, platform and audience details you submit for review.

Payments

Stripe processes Evidraw Plus checkout, payment methods, receipts, renewals and cancellations. Stripe may receive your name, email address, billing details, payment information and transaction information under its own privacy terms. Evidraw does not receive or store your full card number.

Sharing and selling

We do not sell your personal information. Information is processed by service providers only as needed to operate authentication, hosting, storage, payments and support. Evidraw is not a lottery operator and does not connect to your lottery account.

Retention and your choices

We keep workspace information while it is needed to provide the service and maintain its evidence record. To ask about your information or request deletion, email privacy@evidraw.com.

Contact

Privacy questions: privacy@evidraw.com
General support: support@evidraw.com