Privacy Policy

This policy covers two things: drawhunter.uk, the marketing site you are reading now, and app.drawhunter.uk, the terminal. They behave very differently, so they are described separately. The short version is that this site collects nothing at all, and the terminal collects what an account needs and no more.

This site asks you for nothing

There is no form on this site, no sign-up field, no newsletter box and no comment thread. There is nothing here you can type into and nothing you do on these pages is sent to us. Every asset — stylesheet, icon, font — is compiled into the page itself rather than fetched from anywhere else.

No page here loads anything from a third party at all. That is a property of how the site is built rather than a promise about how it is run, and the build enforces it.

No cookies on this site

This site sets no cookies. It writes nothing to local storage, session storage or IndexedDB — the light/dark and colour toggles in the header do not even remember your choice between page loads, which is why the page always opens in the dark palette. There is no consent banner because there is nothing to consent to.

Counting visits

We see aggregate traffic figures for this domain, and there is nothing in the page that produces them. Cloudflare counts requests as they arrive at its edge and reports totals to us — how many requests, roughly which countries, which pages. No script runs, no cookie is set, and nothing is stored in your browser.

We cannot pick an individual visitor out of those figures, and we do not try to. There is no analytics product loaded here, no advertising network, and nothing that follows you to another site.

That is also why there is no consent banner on this site. There is no tracking to consent to, and a banner implying otherwise would be theatre.

Hosting

Both the site and the terminal sit behind Cloudflare. As with any website, your request arrives carrying your IP address, the page requested, the time, and your browser's user-agent string. Cloudflare processes that to deliver the page and to protect the service from attack and abuse, acting as our processor. We do not combine it with anything else and it is not used to build a profile of you.

The terminal: what an account holds

Registration at app.drawhunter.uk is open. If you create an account, this is the complete list of what is stored against it.

• Your email address, which is the only direct identifier we ask for. There is no name field, no phone number and no address.
• Your password, hashed using scrypt. The password itself is never written down and we cannot read it.
• The country you last connected from — two letters, as Cloudflare reports it, and nothing finer. It decides whether prices can be shown to you. Your IP address is never stored: it is used to derive those two letters and then discarded.
• Your sessions — a hash of each sign-in token, when it was issued and when it expires, and the browser user-agent string for the session, so you can tell your own sessions apart.
• Failed sign-in attempts against your email address, to rate-limit password guessing. These are cleared when you sign in successfully.
• Your subscription — tier, status, renewal date, and the customer and subscription identifiers our payment provider uses, plus the provider's own record of each billing event. No card number ever reaches us.
• The positions you track — the teams, stake amounts, odds and dates you enter into the ladder. This is the most revealing thing here, because it is a record of betting activity, and it is the part we are strictest about.
• Your alert settings, including your Telegram chat identifier if you connect Telegram, and a log of which alerts were sent to you.

Who else handles it

We keep the list short deliberately. Each of these is a processor acting on our instructions.

• Neon — the database, hosted in Singapore.
• Render — the application server, in Singapore.
• Cloudflare — DNS, TLS, and the country lookup.
• Airwallex — payments. It receives your email address and an internal account identifier, and it handles card details directly so that they never pass through us. No payment has been taken yet, so it holds nothing about anyone.
• Telegram — only if you connect it, and only to deliver the alerts you asked for.

We sell nothing to anybody, we run no advertising, and we share none of this for anyone else's purposes. Your data is stored in Singapore, so if you are elsewhere it has crossed a border to get there.

Cookies in the terminal

The terminal sets one cookie, dh_refresh, which keeps you signed in. It is HttpOnly so no script can read it, SameSite=Strict so it is never sent from another site, scoped to the sign-in endpoints rather than every request, and it lasts 30 days. Signing out clears it. It is strictly necessary to keep you logged in and it is not used to track you.

The terminal also remembers your theme choice in your own browser's local storage. That never reaches us.

How long it is kept

• Your account and positions — while the account exists. Delete the account and they go with it.
• Expired sessions — 90 days, then removed. Live ones expire after 30 days regardless.
• Failed sign-in records — cleared the moment you sign in successfully, and in any case after 30 days.
• Telegram link codes — ten minutes.
• Billing records — seven years after the transaction. We cannot delete these on request; tax law requires them kept.

These are not aspirations. A job runs every six hours and deletes what has passed its window; until it existed these records were merely ignored after expiry rather than removed, which is not the same thing and not what this page meant.

Your rights

We are a Hong Kong data user, so the Personal Data (Privacy) Ordinance (Cap. 486) applies to us. Under it you may make a data access request — asking whether we hold personal data about you and for a copy of it — and, once you have that copy and can see something is wrong, a data correction request. We must answer either within 40 days. If you ask us not to use your data for direct marketing we must stop, and we will not have started without asking you first.

We would rather not stand behind the minimum, so you do not have to ask and you do not have to wait. Both of these are buttons in your account:

• Download my data gives you a JSON file of everything held against your account, from every table listed above, immediately. Password and token hashes are withheld — publishing a credential to whoever is holding the session would be a poor way to honour a privacy right — and the file says which fields were withheld and why.
• Delete my account permanently does it there and then, not within 30 days. You confirm by typing your own email address. Any live subscription is cancelled with the payment provider first, and if that cancellation fails nothing is deleted — being billed for an account that no longer exists is the worse outcome. The response tells you what was removed.

Only the billing records survive that, for the seven years named above. If the country you are in gives you stronger rights than this, we will honour those instead — write to us at the address below.

Who is responsible

The data user responsible for this site and the terminal is Draw Hunter Limited, registered in Hong Kong. Hong Kong operates no register of data users, so there is no registration number to quote.

For any privacy question, an access or correction request, or a deletion: support@drawhunter.uk.

Complaints

If you think we have handled your personal data badly, tell us first so we can put it right. You can also complain to the Privacy Commissioner for Personal Data, Hong Kong, who supervises us, and you do not have to come to us first to do it. If the country you are in has its own data protection authority, complaining to that one instead is open to you as well.

Changes

Any change to this policy is published on this page with the date at the top updated. If a change means we start collecting something new, it is published before that starts, not after.