Your address is not content.

What is stored

• Organizer account: name, email, password verifier, optional Discord handle, session records.
• Participants: name, optional email and Discord, shipping address, home region, the regions they will ship to, and their survey answers.
• Exchange data: names, dates, budget, rules, questions, matches, tracking numbers, and approval status.
• Operational logs: coarse events inside an exchange, rate-limit buckets, and Cloudflare's standard request logs.

Who can see it

• The organizer(s) of your exchange can see basic details, addresses, and (once collection closes) survey answers.
• With two organizers, full answers are sealed from the organizer screens until both mark collection complete. Each organizer only sees the half of the draw they manage. This is a UI-level seal: a participant's private link is a bearer key, so someone who saved it before the split could still open that page.
• Your assigned Santa sees the name, Discord, address, and answers you provided — that is the point of the exchange.
• Your Santee sees your name and the details you chose to share, because the gift needs a label.
• Nobody else. There are no ads, no third-party analytics, and no data sale.

Cookies, fonts, and tracking

The only cookie is the organizer session (HttpOnly, SameSite=Lax, 30 days). Participants use a private link instead of an account. Fonts are self-hosted, so loading a page does not call Google. There is no third-party analytics script. Cloudflare processes requests and may keep standard edge logs; that is the hosting layer, not me building a profile.

How long it stays

Exchange data stays until the organizer deletes the exchange, or until I am asked to remove it. Participant answers are tied to the exchange. If you want your data removed, ask the organizer who sent you the link first — they can delete the exchange or your row. If you cannot reach them, use the contact on the site where you found it.

The honest caveats

Private links are bearer links: anyone who has one can open that person's page. Send them one-to-one. The organizer controls the database; a determined solo organizer could always look at the draw, which is why two-organizer mode exists. This is a hobby tool with a small security budget, not a bank. Do not use it for anything you would not put in a family group chat.