Privacy notice.
Who we are
MomentDraw (momentdraw.com) is operated by Anthony Su, an individual based in Ontario, Canada. This notice explains what personal information the service collects, why, and what your choices are. Effective September 11, 2026. Questions: [email protected].
Organizer accounts
When you create a workspace we collect your name, email address, a hashed password and, if you enable it, two-factor authentication secrets. Billing is handled by Stripe, which receives your payment details directly; MomentDraw stores only your Stripe customer and subscription identifiers, plan, and paid-through date. We use this information to run your account, send account and billing emails, and provide support.
Entrants
When you join an event you provide your name and either your email address or, when the organizer has chosen phone entry, your phone number (with email optional). You may tick an optional marketing consent for that organizer. We never send text messages. We also record the time of entry and a short-lived proof that the entry came from a person (CAPTCHA and rate limits). Your name is shown masked on public screens with a random ticket code; your email address or phone number is encrypted, used for verification and winner contact, and shared with the organizer of that event only.
Organizers are responsible for their events
The organizer named on an event page decides who may enter, what the prizes are and how winners are contacted. For questions about a specific event, your entry or a prize, contact that organizer first. MomentDraw provides the software and acts on the organizer’s instructions for entrant data.
Who we share information with
Service providers that host and run MomentDraw: Supabase (database, Canada region), our application server host, Cloudflare (DNS and network protection), Resend (transactional email) and Stripe (payments). Each receives only what it needs to provide its service. We do not sell personal information and we do not use it for advertising.
Cookies
MomentDraw sets a session cookie for signed-in organizers and a per-event entry receipt cookie for entrants so you can return to your ticket. There are no advertising or cross-site tracking cookies.
Retention
Entrant contact details are automatically removed 90 days after an event finishes, unless a prize claim, dispute or legal hold is still open. A minimal pseudonymous draw receipt (ticket code, pool hash and prize allocation) is kept as the record of the result. Organizer account data is kept while the workspace exists and deleted when the workspace is closed, subject to invoices we must retain for tax purposes.
Your rights
You can ask to access, correct or delete your personal information. Entrants can request erasure from the event page or through the organizer; organizers can delete events, remove members, cancel subscriptions and close their workspace from Settings. Where the law gives you additional rights, such as under Canada’s PIPEDA or the GDPR, you can exercise them by emailing [email protected]. We will respond within 30 days.
Security
Data is encrypted in transit and at rest, entrant emails are additionally encrypted in the database, backups are encrypted with a key kept off the server, and access to production is limited to the operator with two-factor authentication. No system is perfectly secure; if a breach affects you we will notify you and the relevant authorities as the law requires.
Changes
We will post any material change to this notice on this page and update the effective date. Continued use of MomentDraw after a change means you accept the updated notice.