Privacy policy

Fluky (fluky.com and the Fluky app for iPhone) is run by Eeas Group AS, a Norwegian company. This page explains what we collect, why we collect it and what you can do about it. The short version: you do not need an account, the lists you type stay on your device, and we never sell your data.

Who is responsible

Eeas Group AS (org. no. 836 583 272), Drøbakveien 401, 1433 Ås, Norway. Email: hello@fluky.com.

Eeas Group AS is the data controller for the personal data described on this page.

What we collect and why

Randomizer tools

This covers the spin wheel, yes or no wheel, name picker, team generator, random number generator, dice and coin flip. Every result is drawn on your own device. The options and names you type are saved only on your device (in your browser on the website, in the app's own storage in the app), so they are still there when you come back. They are not sent to us, and results are never stored.

Shared wheels

When you choose to create a share link, we store the wheel's title, options and settings so that anyone with the link can open the same wheel. Do not put anything in a shared wheel that you would not want others to see. A shared wheel is deleted automatically when nobody has opened it for 90 days.

To stop abuse, we keep the IP address of the device that created a share link for 2 days.

Legal basis: providing the feature you asked for (GDPR art. 6(1)(b)) and our legitimate interest in preventing abuse (art. 6(1)(f)).

Secret Santa

To draw names and give everyone a private link, we store:

• the group name, budget, date and the organizer's message
• the participants' names
• participants' email addresses, if the organizer adds them
• the organizer's email address, if given
• each participant's wishlist, if they write one

The draw happens on our server. Nobody at Fluky looks at who drew whom: each result is shown only behind that person's private link. A wishlist is shown only to the person who drew its author, and the organizer page never shows the pairs.

If the organizer adds email addresses, we email each person their private link. Organizers should only add people who expect to take part.

Everything in a group is deleted automatically 60 days after the event date (or 60 days after the group was created, if it has no date). The organizer can delete the whole group at any time from the organizer page, and every participant can remove their own email address and wishlist from their private link.

To limit how many groups can be created per day, we store a one-way hash of the creator's IP address and of a random device identifier (a cookie called fluky_ssd on the website, a random ID kept on the phone in the app). These hashes cannot be turned back into an IP address or a device.

Legal basis: providing the draw the organizer asked for (GDPR art. 6(1)(b)), our legitimate interest in running a working draw for everyone in the group and in preventing abuse (art. 6(1)(f)).

Anonymous usage statistics (website)

To see which tools are used and to find problems, the website records simple events such as "page viewed" or "wheel spun". Each event contains the page, the tool, the language, the country (worked out from the network, never your exact location), the website you came from, campaign tags in the link and a random ID that lasts only while the browser tab is open. We do not record your IP address, your options, names or results.

These statistics are kept for up to 14 months. Legal basis: our legitimate interest in running and improving Fluky (art. 6(1)(f)).

Analytics and advertising cookies (website, only with your consent)

If you click "Accept" in the cookie banner, the website also loads Google Analytics 4 (Google Ireland Ltd.) and Meta Pixel (Meta Platforms Ireland Ltd.). They measure visits and actions such as starting a Secret Santa or spinning the wheel, so we can measure and improve our ads. Names, email addresses and list contents are never sent to them. You can withdraw your consent at any time under "Cookie settings" at the bottom of every page.

Legal basis: your consent (art. 6(1)(a)).

The Fluky app

The app works like the website, with these differences: it has no analytics or advertising tools, it does not track you across apps or websites, and it does not send usage statistics. It contacts our server only for Secret Santa, shared wheels and the random facts. Your lists, wheels and settings are stored only on your phone.

Contacting us

If you email us, we use your email address and message to answer you, and delete them when they are no longer needed.

Cookies and storage on your device

• fluky.consent remembers your cookie choice. Necessary.
• fluky_ssd is a random ID used to limit how many Secret Santa groups can be created. It lasts 1 year and is stored only in hashed form on our side. Necessary.
• Your lists, wheels and settings are stored only on your device. Necessary for the tools.
• fluky.sid, fluky.source and fluky.ssref hold the session ID and where you came from, for the anonymous statistics. They last for the session or up to 30 days.
• Google Analytics and Meta Pixel cookies are set only after you accept them.

Who processes data for us

We use these providers, under data processing agreements:

• Lovable and Supabase: hosting, server functions and database
• Cloudflare: content delivery and security
• Resend: sending Secret Santa emails
• Google and Meta: analytics and ad measurement, only with your consent on the website

Some of these companies are based in the USA. When personal data is transferred outside the EEA, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

We never sell personal data.

Your rights

You can ask us for access to, correction of, deletion of or a copy of your personal data. You can also ask us to restrict processing, and object to processing based on our legitimate interest. Much of it you can do yourself straight away (see Secret Santa above). Because Fluky has no accounts, we may need the private link to find your data. Write to hello@fluky.com.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or to the data protection authority in your own country.

Children

You do not need to give any personal data to use the tools. Teachers and organizers who type pupils' or family members' names into Fluky are responsible for doing so with care. Secret Santa groups should be created by an adult, or with an adult's help.

Changes

If we change how we handle data, we will update this page and the date at the top.