Effective date: August 15, 2026. Pickfetti (pickfetti.com) is a tool for picking Instagram giveaway winners at random. It is operated by CGHM Associates LLC ("we", "us"). This policy explains what data we collect from the people who use Pickfetti (hosts) and from the Instagram users who appear in a draw (commenters), why we collect it, how long we keep it, and the choices you have. Short version: we only read publicly visible Instagram data, we never ask for your Instagram login, we never sell data, and we never contact commenters.

1. Who this policy covers

Two groups of people are described here:

Hosts — anyone who visits pickfetti.com, pastes a link, runs a draw, buys a Draw Pass, or creates an account.
Commenters — Instagram users whose public comments appear on a post that a host draws from. Commenters do not use Pickfetti directly and usually never know it exists.

2. What we collect

From hosts

Draw inputs: the public Instagram post or reel URL you paste (or comments you paste manually), your draw rules (number of winners and alternates, filters such as "must mention a friend" or "one entry per person"), and the timestamp of the draw.
Account data (optional): if you create an account, your name, email address and a password hash, or the identifier we get if you sign in with a third-party provider.
Billing data: if you buy a Draw Pass or subscribe to Pro, Stripe processes your payment. We receive your email, the amount, the last four digits and brand of your card, and a Stripe customer ID. We never see or store your full card number.
Guest token: if you use Pickfetti without an account we set an anonymous, random cookie so your browser can find its own draws again (see Cookies). It is not linked to your identity.
Technical data: IP address, browser type and basic request logs, used for security, rate limiting and debugging.
Support messages: anything you send us by email.

About commenters

For the post a host chooses, we obtain the publicly visible comment data: comment text, the commenter's public @username and public numeric user ID, the comment timestamp, its like count, and whether it is a reply to another comment. We also obtain the post owner's public @username, avatar, caption and post thumbnail so the host can confirm they picked the right post. If a host enables the optional "must follow @host" check, we look at whether a drawn winner's or alternate's public following list contains the host account. We do not do this for every entrant — only for the handful of accounts that are actually drawn.

We do not collect commenters' email addresses, phone numbers, private messages, or anything from private accounts.

3. How we get Instagram data

Pickfetti never asks for your Instagram username, password or access token, and it never logs in to Instagram on your behalf. When a host pastes a public post URL, we request the publicly visible comments through a third-party Instagram data provider, HikerAPI (operated by an independent company). If HikerAPI is unavailable we may use Apify as an alternate provider. These providers return the same data anyone could see by opening the post in a browser while logged out. Posts on private accounts cannot be read. Hosts can also skip Instagram entirely and paste a list of comments themselves.

Pickfetti is not affiliated with, endorsed by, or associated with Instagram or Meta Platforms, Inc.

4. How we use data

To run the draw. Fetched comments are stored as "draw entries" so we can apply the host's rules, pick winners with a verifiable random seed, show the host an audit table, and generate a CSV export.
To publish the proof page for the draw (see next section).
To operate accounts and billing: sign-in, receipts, subscription status, usage against your monthly allowance.
To send transactional email only: account emails, receipts, and an optional "your draw is ready" notification. We do not send marketing email and we do not email commenters.
To keep the service secure and working: abuse prevention, rate limiting, error diagnostics.
To understand usage in aggregate via privacy-friendly analytics (see Cookies).

We do not use commenter data to contact anyone, to build profiles of Instagram users across giveaways, to train models, or for advertising, and we never sell it.

5. Public proof pages

Every draw gets a proof page at pickfetti.com/d/{code} so hosts can show entrants the result was fair. A public proof page displays the winners and alternates by @username, the rules that were applied, the random seed and hashes, and entry counts. The full list of entries (all commenters) is visible only to the host who ran the draw. Hosts can make a proof page private at any time from the draw page. If you are a commenter and would like your @username removed from a proof page or from a draw's entries, email us (see Deleting your data).

We share data only with service providers ("sub-processors") that help us run Pickfetti, under contracts that limit what they can do with it:

Provider	Purpose	Location
HikerAPI (fallback: Apify)	Retrieving public Instagram post and comment data	Third-party; see their policies
Stripe	Payments, receipts, subscription billing	United States
Resend	Sending transactional email	United States
DigitalOcean	Servers and database hosting	United States
Cloudflare	CDN, DNS, proxy and DDoS protection	Global edge; United States
Google Analytics 4	Aggregate site analytics (if enabled; IP truncated)	United States

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or sale of the business (in which case this policy continues to apply). We do not sell personal information.

7. Cookies and analytics

We use a small number of essential cookies, which cannot be switched off because the site does not work without them:

Session cookie — keeps you signed in and remembers what you were doing (expires when the session ends or you sign out).
CSRF token — protects forms against forgery.
Guest token — a random identifier, stored for 1 year, that lets a visitor without an account get back to their own draws. It contains no personal information.
Appearance preference — remembers light or dark mode.

Analytics cookies may also be used. We prefer privacy-friendly aggregate analytics; where we use Google Analytics 4, it sets its own cookies and we configure IP truncation and no advertising features. Where the law requires it, we ask for your consent before setting analytics cookies. You can opt out at any time by declining in the cookie notice, blocking or deleting cookies in your browser settings, installing the Google Analytics opt-out browser add-on, or by turning on the Global Privacy Control (GPC) signal in your browser, which we honor for analytics.

8. How long we keep data

Data	Retention
Guest draws (no account), including entries and proof page	Automatically deleted 30 days after creation
Account draws, including entries and proof page	Until you delete the draw or close your account
Account profile (name, email)	Until you close your account
Billing records (Stripe receipts, invoices)	7 years, as required for tax and accounting
Guest token cookie	1 year from last visit
Server and security logs (IP address, request data)	Up to 90 days
Support email	Up to 2 years after the conversation ends
Aggregate analytics	Up to 14 months (Google Analytics default), not personally identifiable

Data on backups is overwritten on a rolling basis within 30 days of deletion.

9. Security

All traffic to and from Pickfetti is encrypted with TLS. Passwords are hashed, and provider API tokens and other secrets are encrypted at rest. Access to production systems is limited to the people who need it (least privilege) and protected with multi-factor authentication. Payment card data is handled entirely by Stripe, a PCI DSS Level 1 provider. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and any regulator as the law requires.

If you are in the European Economic Area, the United Kingdom or Switzerland, CGHM Associates LLC is the controller of your personal data. Our legal bases are:

Legitimate interest (Article 6(1)(f)) — processing publicly visible comment data so a host can run and prove a fair draw. We consider this low-risk because the data is already public, is used only for the specific post the host chose, is not combined across giveaways, and is deleted on a short timeline.
Contract (Article 6(1)(b)) — creating your account, processing payments and providing the service you asked for.
Consent (Article 6(1)(a)) — analytics cookies, where consent is required. You can withdraw consent at any time as described in Cookies.
Legal obligation (Article 6(1)(c)) — keeping billing records.

You have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing based on legitimate interest, and to complain to your local supervisory authority. Commenters can email us to have their @username removed from a proof page and from a draw's stored entries; we will action this within 30 days. Because our servers are in the United States, your data is transferred there. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our sub-processors, and where a provider is certified under the EU-U.S. Data Privacy Framework, on that certification as well.

11. California residents (CCPA/CPRA)

In the past 12 months we have collected the following categories of personal information: identifiers (name, email, IP address, Instagram @username and public user ID); commercial information (purchases); internet activity (pages viewed, draws run); and, for commenters, publicly available information (comment text and public profile details). We collect it for the purposes in How we use data and disclose it only to the service providers listed above.

We do not sell personal information and we do not share it for cross-context behavioral advertising, so a "Do Not Sell or Share" link is not required. We nevertheless honor the Global Privacy Control signal by disabling analytics for browsers that send it. You have the right to know what we hold about you, to delete it, to correct it, and not to be discriminated against for exercising these rights. Submit a request by email; we will verify it using the email address on your account or, for commenters, by asking you to confirm control of the Instagram account in question. You may use an authorized agent if they provide signed permission.

12. Children

Pickfetti is not directed at children under 13 (or under 16 where that is the local threshold) and we do not knowingly collect their data. Hosts must be at least 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Deleting your data

Hosts with an account: go to Settings → Delete account. This deletes your profile, all your draws, entries and proof pages. Or delete an individual draw from its page.
Guest hosts: draws are deleted automatically after 30 days. To delete sooner, email us with the draw code (the part after /d/).
Commenters: email us with the draw code or proof-page link and your @username, and we will remove you from that draw's entries and proof page.

Billing records held by Stripe are retained as required by law even after account deletion.

14. Changes to this policy

We may update this policy as Pickfetti changes. We will post the new version here with a new effective date and, for material changes, notify account holders by email or a notice on the site.

15. Contact

CGHM Associates LLC
Email: hello@pickfetti.com