ChosenFair
Privacy Policy
Effective date: June 23, 2026 · Last updated: June 23, 2026
ChosenFair is a fair-draw registration platform operated by Code of the North ("we," "us," or "our"), a digital consulting and technology firm based in Minneapolis, Minnesota. This policy explains what information we collect when you use ChosenFair, how we use it, and your rights with respect to it.
1. Who this policy covers
This policy applies to two groups of people:
- Operators — organizations (recreation departments, schools, camps, housing authorities, sports leagues, and others) that create programs and run draws using ChosenFair.
- Applicants — individuals who register for a draw through a ChosenFair-powered registration page.
2. Information we collect
From operators (account holders)
- Organization name, contact name, and work email address provided at signup.
- Account credentials (passwords are hashed by our authentication provider, Supabase; we never store them in plaintext).
- Billing information, if applicable, processed by our payment processor (Stripe) — we do not store full card numbers.
From applicants (draw registrants)
- First name, last name, and email address — required for all registrations.
- Phone number — collected when provided and used only for SMS notifications if you opt in.
- Program-specific fields — depending on the program you're registering for, operators may collect additional information (for example: a child's date of birth, emergency contact details, medical notes, or household income information for housing programs). Fields marked as sensitive are encrypted at rest using AES-256-GCM before being stored in our database. Sensitive field values are accessible only to the operator who created the program.
- Notification preferences — whether you wish to receive draw results by email, SMS, or both.
Automatically collected information
- Standard web server logs (IP address, browser type, pages visited, timestamps). These are retained for up to 90 days for security and abuse prevention.
- We do not use advertising trackers, behavioral analytics, or third-party marketing pixels.
3. Legal basis for processing
We process your personal information on the following legal bases:
- Performance of a contract — to operate the platform and fulfill the services you or your organization have requested.
- Legitimate interests — to secure the platform, prevent abuse, and improve our services, where those interests are not overridden by your privacy rights.
- Consent — for optional communications such as SMS draw notifications, which you may withdraw at any time.
- Legal obligations — where applicable law requires us to retain or disclose information.
4. How we use your information
- To operate the platform — creating programs, accepting registrations, running draws, and delivering draw results to applicants.
- To send transactional notifications — registration confirmations, draw results, and account communications. We do not send marketing email to applicants.
- To improve ChosenFair — debugging, security monitoring, and product development using aggregated, non-identifiable usage data.
- To comply with legal obligations — where required by applicable law.
5. SMS communications
If you provide a phone number and opt in to SMS notifications during registration, we will send you draw results by text message. Standard carrier message and data rates may apply.
- You can opt out at any time by replying STOP to any message.
- Reply HELP for assistance.
- We will never sell your phone number or send marketing SMS.
- Opting out of SMS does not affect your registration or draw eligibility.
6. Who we share your information with
We do not sell personal information. We share data only as follows:
- With the operator running your program — the organization that created the program you registered for can view your registration information through their ChosenFair dashboard. Their use of your data is governed by their own privacy practices.
- With service providers — we use the following sub-processors to operate ChosenFair:
- Supabase (database and authentication hosting)
- Cloudflare (content delivery, Workers compute, email routing)
- Resend (transactional email delivery)
- Stripe (payment processing, where applicable)
- Twilio (SMS delivery, where applicable)
Each is contractually bound to use your data only to provide services to us.
- In a business transfer — if Code of the North or ChosenFair is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
- As required by law — in response to valid legal process or to protect the rights and safety of ChosenFair users.
7. Children's privacy
Some programs on ChosenFair (such as summer camps or school enrollment) collect information about minors on behalf of a parent or guardian. We do not knowingly collect personal information directly from children under 13 without verifiable parental consent. If you are a parent or guardian submitting information about your child, you are doing so on their behalf. If you believe we have inadvertently collected information from a child without parental consent, contact us at hello@chosenfair.com and we will delete it promptly.
8. Data security
We take security seriously. Measures include:
- All data in transit is encrypted with TLS.
- Sensitive applicant fields (such as medical notes and financial details) are encrypted at rest using AES-256-GCM before storage.
- Access to production data is restricted to authorized personnel.
- Authentication is managed by Supabase, which uses bcrypt password hashing and supports multi-factor authentication.
No system is perfectly secure. Although we will do our best to protect your personal information, transmission of data to and from our services is at your own risk. In the event of a breach that affects your personal information, we will notify you as required by applicable law.
9. Data retention
- Applicant registration data is retained for as long as the program exists in ChosenFair, or until the operator deletes it.
- Operator accounts and associated program data are retained for the life of the account and up to 90 days after account termination.
- Where deletion is not immediately possible (for example, data stored in backup archives), we will isolate the data from further processing until deletion is possible.
- You may request deletion of your personal information at any time (see Section 11).
10. Cookies and tracking
ChosenFair uses only a session cookie to keep operators logged in. We do not use advertising cookies, cross-site tracking cookies, or analytics cookies. Applicants using the public registration form are not tracked with cookies.
Most web browsers include a Do-Not-Track (DNT) feature. Because there is no uniform technical standard for honoring DNT signals, we do not currently respond to DNT browser signals. If a standard is adopted that we are required to follow, we will update this policy accordingly.
11. Your rights
Depending on where you live, you may have rights including:
- Access — to know what personal information we hold about you.
- Correction — to correct inaccurate information.
- Deletion — to request that we delete your personal information.
- Portability — to receive a copy of your data in a portable format.
- Objection — to object to processing based on legitimate interests.
- Opt-out of SMS — by replying STOP to any text message.
To exercise any of these rights, email hello@chosenfair.com. We will respond within 30 days. We may need to verify your identity before acting on a request.
If you are in the European Economic Area and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority.
12. California residents (CCPA / Shine the Light)
California residents have additional rights under the California Consumer Privacy Act. We do not sell or share personal information for cross-context behavioral advertising. To submit a rights request, contact hello@chosenfair.com.
Under California Civil Code Section 1798.83 (the "Shine the Light" law), California residents may request, once per year and free of charge, information about any personal information we disclosed to third parties for their direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for direct marketing, so no such disclosure report is applicable. If you have questions, contact us at the address below.
If you are under 18, reside in California, and have a registered account, you may request removal of information you have publicly posted. Contact us at hello@chosenfair.com with your email address and a statement that you reside in California.
13. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to operators by email. The "last updated" date at the top of this page reflects the most recent revision. Continued use of ChosenFair after a policy update constitutes acceptance of the revised terms.
14. Contact us
Questions about this policy or your data: