Privacy Policy

Who we are

Sunday Squares is a product of Domavant Holdings LLC ("we", "us"), which operates the website at sundaysquares.org and is the controller of the personal information described here.

You can reach us at hello@sundaysquares.org, or by post at Sunday Squares, 8512 Aspen Way, Gilroy, CA 95020. A real person reads that inbox.

Organizations run their own raffles — what that means for your data

Sunday Squares is software that nonprofit organizations use to run their own raffles. The organization — a council, booster club, parish or PTA — decides who to sell tickets to, records who bought them, and awards the prizes. We provide the tools and store the records on their behalf.

So when a volunteer sells you a ticket and writes down your name and email, that organization is deciding to collect it, and it remains responsible for how it uses it. We hold that information for them, use it only to operate the service, and give you the rights described below over your own copy of it. If you want your details corrected or removed from a specific raffle, your organizer can do that directly, and usually faster than we can.

What we collect

Account information, when you create an account:

• Email address, and a password (stored only as a cryptographic hash by our authentication provider — we never see it).
• Display name, an optional phone number, and a preset avatar. There are no photo uploads.
• Your email notification preferences.

Ticket records, created when you buy a ticket or an organizer records a sale:

• The buyer's name, email address and phone number, as given to the volunteer at the point of sale.
• The buyer's mailing address, if given, and whether they agreed to be contacted by email, text or mail — recorded with when it was given and whether the buyer or the organizer recorded it.
• Which tickets are yours, when they were recorded, and whether the organizer has marked them paid — including the method (cash, check, card reader) and a check number if one was written.
• A mailing address, but only where an organization awards a physical prize that has to be posted. It is optional and entered by the organizer, not by us.

Organization information, when a group applies to run raffles:

• The organization's name, type, home state, mission, website, and its EIN where it is a nonprofit.
• The applicant's name, email and phone number.
• For organizations that file state raffle paperwork: the organization's mailing address, phone, registration numbers, and the name and title of the officer who signs the filing.

Sponsor information, where a business sponsors a raffle: contact name, email, the amount pledged or paid, and a logo link if they provide one.

Operational records, generated as the service runs:

• A log of emails and text messages sent, sign-in events, and administrative actions, used to diagnose delivery problems and to keep an audit trail. Message contents are redacted before logging so that links containing access codes are never stored in the log.
• Whether an email we sent was delivered, bounced, was reported as spam, or had a link clicked, as reported by our email provider, so we can stop mailing addresses that bounce and see which messages are worth sending. We do not use open-tracking pixels.
• Which raffle and organizer pages you open while signed in, and whether you are on a raffle page during a game (a count of how many people are watching, shown to the raffle's organizer), plus any thumbs-up or thumbs-down you tap on a message. Nobody sees these per person except you; organizers and Sunday Squares see totals.
• Your answer if you respond to a short question in the app, such as how likely you are to recommend us. We keep it with your account. Sunday Squares reads any comment you add and may reply to it; your organizer does not see your answers, and they are not sent to our analytics provider.
• To slow down anyone guessing ticket codes or grabbing tickets in bulk: when a code is looked up and doesn't match, a scrambled form of the internet (IP) address it came from — never the address itself — or, if you are signed in, a note against your account; and each time you hold tickets, a note against your account. The same scrambled address is noted when someone submits our organizer application or a print request, to stop those forms being used to send spam. We use these only for that, and delete them after 24 hours.
• Standard server and security logs kept by our hosting providers.

What we never collect

This is a short list, and it is deliberate:

• No payment card numbers. Raffle tickets are sold in person and the organization collects the money directly — no funds move through Sunday Squares.
• No bank account or routing numbers. Where an organization prepares a bank authorization form for a sponsor, the banking fields are left blank for the organization to complete offline.
• No Social Security numbers. Where the service prepares an IRS Form W-9 for an organization, it fills the employer identification number only and never the individual boxes.
• No advertising identifiers and no third-party marketing scripts. Measurement on this site is three things: page-view counting (the page, the referring site, and a general location, device type and browser) and page-load timings (how quickly a page rendered on your device, by page and connection type), both by our hosting provider, Vercel; and product analytics by PostHog — which pages are visited in what order, and whether a few key steps worked (signing in, claiming a ticket, entering a booklet code, applying as an organizer, the setup guide) — only the kind of problem when one fails, never the error text or what you typed — so we can see where organizers and ticket holders get stuck. PostHog does not see the text on the page or anything you type, link addresses are cut back to the page itself (no codes, links from our emails, or email addresses), and there is no recording of your screen. We also send PostHog summary counts we compute ourselves — for example how many tickets a raffle has sold, how many of an organization's accounts signed in this month, or how many of its emails were delivered — totals per organization, raffle or day, never a list of people. None of these records a name, an email address, or a persistent identifier, and none follows you across other sites.
• No precise location data, and no biometric information.

How we use it

• To operate the service: create your account, show you which tickets are yours, and record the results of each drawing.
• To tell you things you asked to know — that numbers have been drawn, that you have won, and the weekly summary for raffles you hold a ticket in. You can turn these off individually.
• To let an organizer contact the people who bought tickets in their own raffle.
• To help an organization prepare its own state filings from figures the service already holds.
• To keep the service secure and working: diagnosing failed email, investigating misuse, and keeping an audit trail of administrative actions.
• To answer you when you write to us.

We do not use personal information to train machine-learning models, and we do not build advertising profiles.

Who we share it with

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We use a small number of service providers to run the product. Each may process personal information only on our instructions.

We also share information with the organization whose raffle you took part in — that is the point of the service — and with its organizers, who see the buyers of their own raffles only. Organizers never see the patrons of another organization.

We may disclose information where we are legally required to, or where it is necessary to investigate suspected fraud or protect someone's safety. If we are ever involved in a merger or sale, information may transfer with the business, and we will say so before it does.

Cookies

We use cookies for one purpose: keeping you signed in. These are set by our authentication provider and are required for the site to work. There is no cookie banner because there is nothing optional to consent to — we set no advertising cookies, and neither the page-view counting our hosting provider does nor our product analytics uses cookies or any other storage in your browser.

Platform administrators additionally have a short-lived cookie that records when they are viewing an organizer's console in read-only mode, so that the interface can show it plainly.

Your choices

• Email categories — turn win alerts, weekly summaries, organizer updates or product news on and off individually on your Profile page.
• Unsubscribe — every email we send carries a one-click unsubscribe link that works without signing in.
• Text messages — reply STOP to any message to stop them, and START to allow them again.
• Correcting your details — your organizer can fix the name, email, phone or address recorded against your tickets, and the change applies across every ticket you hold with that organization.

We will still send you the occasional message that is not marketing — a reply to a question you asked us, or notice of a problem with a raffle you are in. Unsubscribing always stops the rest.

Your rights, and how to use them

You can exercise the two most important rights yourself, immediately, without writing to anyone:

• Download your data — Profile → Export. You get everything we hold that is tied to your account, in a machine-readable file.
• Delete your account — Profile → Delete account. This removes your account and the personal details attached to it. If you are the sole owner of an organization, you will be asked to transfer or close it first, so that a group is never left stranded.

You also have the right to know what we hold, to have it corrected, and to complain to a regulator. Write to hello@sundaysquares.org and we will respond within 30 days.

Deleting your account does not erase the organization's own record that a ticket was sold and a prize awarded, where it needs that record for its accounts or a state filing. That record is the organization's, and its retention obligation, not ours to delete.

California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising them.

We have not sold or shared personal information in the preceding twelve months, and we do not use or disclose sensitive personal information for any purpose other than providing the service. The categories we collect are identifiers (name, email, phone, postal address, and — for 24 hours after a ticket code fails to match — a scrambled form of an IP address) and commercial information (which tickets you hold and whether they are paid) — described in full above. Use the export and delete tools on your Profile page, or write to us; we do not require an account to make a request.

How long we keep it

• Account information: until you delete your account.
• Ticket and prize records: for as long as the organization needs them for its own accounts and filings. Charitable raffle rules commonly require several years of records.
• Message and sign-in logs: 400 days, which covers a full season plus the following year's filing.
• Records used to slow down code guessing and bulk ticket holds: 24 hours.
• Phone numbers that replied STOP: until that number replies START, so we never text it again by mistake.
• Backups: deleted data may persist in encrypted backups for a short period before being overwritten.

Security

Traffic is encrypted in transit and data is encrypted at rest by our hosting provider. Access to records is enforced in the database itself, so a person can only read the raffles and buyers their role allows, rather than relying on the interface to hide them. Passwords are hashed, and are checked against known-breached password lists when set.

No system is perfectly secure. If a breach ever affects your information, we will tell you and the relevant regulator as the law requires.

Children

You must be 18 or older to hold a Sunday Squares account. The service is not directed at children and we do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

We will update this page when what we do changes, and we will move the date at the top. If a change materially affects your rights, we will tell account holders by email before it takes effect.