Privacy Policy

Effective date: July 26, 2026

WonYet (“WonYet,” “we,” “us”) operates wonyet.com and the WonYet web application. This policy explains what we collect, why, how long we keep it, and the rights you have over it. The short version: we collect the minimum needed to check your lottery tickets, we don’t sell your data, and you can delete everything whenever you want.

1. What we collect

2. How we use it

We do not sell or rent your personal information, and we do not share it with data brokers or for advertising of any kind. WonYet runs no ads and uses no advertising or conversion cookies. Our analytics providers process data only to provide analytics to us — not for their own ad targeting (Google Analytics “Google signals” and ads-data sharing are off, and Google ad personalization is off). You can decline analytics at any time (below), and we honor Global Privacy Control.

3. Who we share it with

Only service providers necessary to run WonYet, each bound to use data solely to provide their service to us:

We may disclose information if required by law, or to protect the rights and safety of users — and if legally permitted, we’ll tell you first.

4. How long we keep it

5. Your rights

If you have an account, you can export a complete copy of your data and permanently delete your account and everything in it yourself, instantly, from Account → Data in the app — no request or waiting period. You can also exercise any of the rights below (regardless of state) by emailing privacy@wonyet.com (we respond within 30 days):

California residents (CCPA/CPRA): you have the right to know the categories of personal information we collect (listed in section 1), the right to opt out of any “sale” or “sharing” of personal information, the right to limit use of sensitive personal information (we don’t collect any), and the right not to be discriminated against for exercising these rights. We do not sell your personal information. The only processing that could be considered “sharing” under the CPRA is the analytics described in section 1 (Google Analytics — on by default for U.S. visitors). You can turn it off at any time via the control (in the footer of every page), which has the effect of an opt-out: analytics cookies are removed and Google receives only anonymous, cookie-free counts that carry no identifier. We also honor Global Privacy Control (GPC) signals: if your browser sends GPC, Google Analytics does not load at all — not even the anonymous counts — regardless of any other setting. Authorized agents may submit requests on your behalf with proof of authorization.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws: you have substantially similar rights of access, correction, deletion, and portability, and the right to appeal a refused request by replying to our decision email; we’ll respond to appeals within 45 days.

EU/EEA, UK, and Swiss residents (GDPR / UK GDPR): WonYet is the data controller for the personal data described above. Our lawful bases are performance of our contract with you (reading and checking your tickets, sending transactional emails about your own saved tickets such as win notifications and drawing reminders, running your account), your consent (push notifications; cookie-based analytics — Google Analytics — which for EU/EEA, UK, and Swiss visitors do not load at all until you opt in, not even in an anonymous mode, and which you can withdraw at any time via Cookie settings), and our legitimate interests (security and abuse prevention). You have the rights of access, rectification, erasure, restriction, portability, and objection, plus the right not to be subject to solely automated decisions with legal effect — our scan reads are informational and you confirm every result. Our processors — Cloudflare (hosting), Anthropic (ticket reading), Stripe (former payment processor; retained records only), Google LLC (Google Analytics, as described in section 1) — act under Article 28 data-processing terms. Because they process data in the United States, international transfers rely on the EU-US Data Privacy Framework (Google is certified; with the UK Extension and Swiss-US DPF) and/or the EU Standard Contractual Clauses with the UK Addendum. You may lodge a complaint with your local supervisory authority, though we’d welcome the chance to resolve it first at privacy@wonyet.com.

Brazil (LGPD): you have the equivalent rights of confirmation, access, correction, anonymization, portability, deletion, and information about data sharing, and can exercise them at the address above.

6. Security

All traffic is encrypted in transit (TLS). Passwords are hashed with PBKDF2. Ticket photos are never written to storage — each image is processed in memory only, just long enough to read your ticket, then discarded. Payment credentials never touch our servers. No system is perfect; if a breach affects your data we will notify you promptly and as required by law.

7. Minors

WonYet is only for users who are of legal lottery age in their own jurisdiction — 18 in most U.S. states, 19 in Nebraska, and 21 in Arizona, Iowa, Louisiana, and Mississippi (and the applicable minimum elsewhere). It is not directed to anyone below that age. We do not knowingly collect data from anyone under the legal lottery age in their jurisdiction; if we learn we have, we delete it.

8. Changes

If we change this policy materially, we’ll notify you in the app and by email (if we have yours) at least 14 days before the change takes effect. The changelog of this document lives at /changelog.

9. Contact

Privacy questions, requests, or complaints: privacy@wonyet.com. We answer within 30 days, usually much faster.