NMajor Studios LLC, a Wyoming limited liability company, operates RandomizerLab at randomizerlab.com. This policy covers the website, accounts, Plus subscriptions, cloud workspaces, anonymous share links, account email, support, and privacy requests.
1. Data stored in your browser
RandomizerLab can store lists, wheel settings, theme and sound preferences, and short-lived interface state in local storage or session storage. That data stays in your browser unless you create a share link, save a Plus cloud workspace, submit a form, or otherwise send it to us.
Local data remains until you reset it, clear the site's browser data, or your browser removes it. Clearing browser data may remove lists and preferences that you have not exported or saved to the cloud.
2. Data stored on our systems
We collect or store the following when you use the related feature:
- Account data: name, email address, verification status, password hash, dates, and identifiers.
- Session and security data: session tokens, expiry, IP address, user agent, and rate-limit records.
- Cloud workspaces: workspace names, list entries, interface settings, revision metadata, and dates.
- Anonymous shares: list entries, display settings, and embedded images when a user added them.
- Subscription data: Polar customer and subscription identifiers, product, billing status, renewal date, and cancellation status.
- Requests and email delivery: contact or privacy form details, request-handling records, and account-email delivery data.
- Technical logs: request details, IP address, device or browser data, timestamps, status, and errors created when Cloudflare delivers the service.
We do not receive or store your full payment card number.
3. How we use data
We use data to:
- provide accounts, tools, cloud workspaces, share links, and Plus access;
- authenticate users and send verification, deletion, or password-reset messages;
- process subscriptions and keep paid access in sync;
- answer support and privacy requests;
- secure the service, prevent abuse, and investigate errors; and
- meet tax, accounting, legal, and regulatory duties.
Where privacy law requires a legal basis, we rely on performing our contract, legitimate interests in operating and protecting the service, compliance with law, or consent when required.
4. Anonymous share links
Creating a share link uploads a snapshot to Cloudflare KV storage. The snapshot is not linked to your account and has no automatic expiration. Anyone with the link may be able to retrieve and copy it.
Shared pages are marked not to appear in search results, but that is not access control. Do not include sensitive personal information, confidential student information, or private images. Anonymous shares persist until the operator deletes them. Request removal through the privacy request form and include the full share link.
5. Plus cloud workspaces
Plus workspaces are stored in Cloudflare D1 and linked to the account that created them. Canceling Plus stops cloud access but does not delete stored workspaces. Delete individual workspaces while Plus is active; after it ends, you can delete the account or request workspace deletion through the privacy request form. Cloud workspaces reject embedded image data URLs.
6. Payments
Polar Software, Inc. is the Merchant of Record and authorized reseller for Plus. At checkout, we send Polar the account email, RandomizerLab user identifier, selected plan, and request IP address. Polar collects billing and payment details, charges taxes, issues receipts, and manages the billing portal.
We receive the customer and subscription status needed to manage Plus. Polar handles its own processing under its privacy policy and buyer terms.
7. Service providers
Current providers include:
- Cloudflare for site delivery, Workers, D1, KV, security, and operational logs.
- Polar Software, Inc. for checkout, taxes, subscriptions, receipts, refunds, and billing support as Merchant of Record.
- AhaSend for account verification, deletion, and password-reset messages.
- Chatwoot, hosted on NMajor infrastructure, for contact and privacy-request intake.
Better Auth is authentication software running inside our Cloudflare deployment, not a separately hosted recipient. We may disclose information when law requires it, to protect people or the service, or during a merger, acquisition, financing, or sale subject to appropriate privacy obligations.
8. Advertising, analytics, and cookies
RandomizerLab does not currently serve ads, load advertising trackers, or install analytics cookies. We may add advertising to Free later. Before doing so, we will update this policy and add consent or opt-out controls where required. Plus is intended to remain ad-free.
An essential session cookie keeps signed-in users authenticated. Public tools use local storage and session storage for lists and preferences. Polar may use necessary technology on its hosted checkout or portal under its own policy.
9. Retention
Local tool data stays in your browser until you clear it. Account data and cloud workspaces remain until you delete the workspace or account, including after Plus is canceled. Anonymous shares persist until the operator deletes them.
We retain authentication, security, support, privacy-request, email-delivery, subscription, and provider records as needed to run and secure the service, answer requests, handle disputes, comply with law, and follow applicable provider settings. Expired authentication and form rate-limit rows may remain until later maintenance. Polar may retain transaction records required for tax, accounting, fraud prevention, and payment law.
10. Deletion and export
You can request an export through your account or the privacy request form. Account deletion requires a verification link. After you confirm it, we check for a linked Polar customer record. If one exists, we first ask Polar to cancel subscriptions and anonymize that customer; if this fails, the account remains open so you can try again. If there is no Polar record, or after successful Polar cleanup, we immediately delete account-linked database rows, including cloud workspaces and the local subscription record.
Browser data remains until you clear it. Anonymous shares are not account-linked, so include each full share link in a privacy request. Polar and other providers may keep limited records needed for legal, security, dispute, or backup obligations. Account deletion does not automatically create a refund. Submit an eligible refund request through the contact form before deleting the account.
11. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of personal information, object to or restrict some processing, withdraw consent, or appeal a denied request. You may also have a right to opt out of sale or targeted advertising. We do not currently conduct those activities.
Submit a request through the privacy request form. We may ask for information needed to verify that the request concerns your account. We will not discriminate against you for exercising a privacy right.
12. Children and classroom use
RandomizerLab does not offer child accounts and does not knowingly collect account information directly from children under 13, or a higher age where local law requires it. Accounts must be adult-owned or controlled by a person old enough to enter a binding contract.
Teachers and parents may use public tools with children under adult supervision. They must not create accounts in a child's name. A teacher entering student names is responsible for required school authorization, notice, or consent and for limiting the information used. Do not put sensitive student information in RandomizerLab, especially in an anonymous share link.
13. International processing and security
RandomizerLab and its providers may process information in the United States and other countries where they operate. Where required, we use lawful transfer mechanisms.
We use HTTPS, password hashing, access controls, server-side authorization, input limits, and rate limits. No internet service can guarantee absolute security. Report a suspected compromise through the contact form.
14. Changes and contact
We may update this policy as the product changes. We will post a new effective date and provide notice or request consent when law requires it.
Submit privacy-rights requests through the privacy request form. Use the contact form for general support or legal notices.