Your information
What we hold, and what keeps it safe
You trusted us with your name and your email address. Here is exactly what that means in practice — what we keep, who can see it, and what stops anybody else.
What we hold
Four things: the name you use on Facebook, your legal first and last name, your email address, and your town. That is the whole of it.
We do not hold a phone number for you, we do not hold any payment details, and you do not have an account here — there is no password of yours for anybody to steal, because there is nothing for you to log into.
For the technically curious
Gifts go directly from member to member through SpotFund. No money passes through this site, so there is no card or bank detail here to protect in the first place. Your legal name is held because the identity check before a gift compares it with your ID; your Facebook name is what the group knows you by.
Who can see it
Only a short list of named admin accounts — in practice that means Dayna, who runs the group. Not other members, not visitors, not search engines — and that is enforced by the database itself rather than by hiding it on a screen.
The weekly list of members is never published. We publish the fingerprint of it, which is what lets anybody check a drawing was fair, and your name cannot be worked back out of that.
For the technically curious — what “enforced by the database” means
Every table is protected by row-level security (RLS). A normal web app decides what to show you in its own code, so a mistake in that code can show the wrong person the wrong thing. RLS puts the rule one layer deeper: the database refuses to hand over rows to anyone not entitled to them, no matter what asks for them or how. A page with a bug in it still gets nothing back.
We check this by attacking it rather than by reading our own rules. Using the public key that anybody can read out of this site’s own code, every table holding member information returns empty, an attempt to add a member is refused, and an attempt to delete members removes nothing. Signing in is limited to a named list of admin addresses; nobody else can reach a screen that shows a member at all.
Nobody can sign you up but you
When you register, we email a six-digit code to the address you typed and nothing is saved until you enter it. Somebody who typed your address would get nowhere, because the code goes to your inbox and not to theirs.
For the technically curious
The code lasts ten minutes, allows five attempts and is stored only as a one-way hash, so even we cannot read it back. The form itself has no password field, no Google or Facebook sign-in, and loads no code from any other company — so there is nothing on it that could quietly be turned against you.
We keep less, and not for long
Anything we only need for a moment is deleted on a timer rather than kept in case it is useful later. The codes we email you go after a day. The record that somebody checked the eligibility page goes after a week. Nothing about you sits here indefinitely just because nobody got round to removing it.
For the technically curious
Sign-in codes and the counters behind them are deleted after a day, eligibility checks and contact messages after a week. Nothing personal is written to our error logs either: anything arriving from the database or another service is stripped of email addresses and IP addresses before it is recorded, because the useful part of an error is never the address in it.
How we count visits, without following anybody
We count how the site is used so we can make it easier to use: how many people visit each page, how far down a page they read, which of our buttons get tapped, where people give up on the sign-up form, and whether a page answered your question when you tap Yes or No at the bottom of it.
We do this ourselves. No Google, no tracking company, no cookie, and nothing saved on your phone. We never record what you type, where on the screen you tap, or a recording of your visit. Each day your visit gets a new random-looking tag, so nobody, including us, can connect today’s visit to yesterday’s.
The resources page is only counted as a visit and nothing more, and the Quick Exit button is never counted at all.
When one of our Facebook posts links to this site, the link carries a short tag naming that post, so we can see which posts help people find us. The tag says which post, never who you are, and links to the resources page never carry one.
For the technically curious
Each event is a page path, one name from a short fixed list (a sign-up step, a scroll mark of 25, 50, 75 or 100 percent, a named button, or the kind of element a tap landed on), and a daily key: a keyed hash of your connection address, your browser and the date. The address and browser are never stored, only the hash, and the date in it changes every day. Events go to our own server with the browser’s beacon, after the page has loaded. Admin pages, and visits by our own admins, are left out. On the resources page nothing is sent but the page view, and that view is stored with no key at all.
Our contact form cannot be turned on anybody
A contact form that will email anyone, as often as asked, is a way to bury a stranger in mail that appears to come from us. Ours now sends one message, to the group, and limits how often it can be used. It no longer sends you a confirmation email — the page tells you it worked instead.
For the technically curious
This protects you even if you never use the form. The address that carries your sign-in codes is the same one the form sent from, and a mail provider that decides that address sends spam stops delivering the codes too. Closing it keeps the codes arriving.
Signing up twice is caught before a drawing, not after
If a registration arrives under a name already on the roster, the drawing will not start until a person has looked at it and said whether it is one woman who signed up twice or two women who happen to share a name. It is never decided automatically, in either direction.
For the technically curious
Deciding it automatically is the part we refuse. Merging two women wrongly means one of them cannot be selected at all; leaving one woman as two entries gives her two chances. Both are unfair and only a person can tell which is which, so the check finds the question and holds the drawing until somebody answers it.
The record cannot be quietly rewritten
Selections, commitments and timestamps can be added to but never edited or deleted — not by us either. A correction is a new entry, and the original stays visible underneath it.
For the technically curious
29 tables sit behind a database trigger that refuses UPDATE and DELETE outright. That is why the weekly record can be trusted: not because nobody would alter it, but because the database will not allow it. You can check any drawing yourself on How it’s random.
How to know a message is really from us
This is the one that protects you most, because it does not depend on us at all.
- Our only website is forthegirlsofiowa.com.
- We will never ask you for a password, and we will never ask you to read a code back to us.
- We will not text you. A message saying your registration needs confirming or your place in the drawing is at risk, with a link to tap, is not from us — and is worth reporting as spam.
- If something looks like it came from the group and you are not sure, ask in the group before you tap anything.
For the technically curious
There are two addresses to protect and we treat them differently. Nothing is ever sent from forthegirlsofiowa.com itself, so it publishes SPF and DMARC records saying exactly that, with a policy of reject: anything claiming to come from it is a forgery and should be refused outright.
Our real emails — the sign-in codes — come from auth.forthegirlsofiowa.com, which is signed with DKIM on every message. Since 12 October that address carries a DMARC policy of quarantine, so a message forged to look like one of our codes should land in spam rather than your inbox. We publish a reporting address with it and read what comes back, and we will tighten it to reject once those reports show nothing legitimate is being caught by it.
None of that stops somebody using a lookalike address, which is why the plain rules above matter more than any of it.
Two things we will not pretend otherwise about
A page like this is worth nothing if it only lists the good parts.
The group’s admins can see your information. Running a weekly drawing means somebody has to be able to find you and check it is really you. There is no clever way around that, so we will not claim one. What we do instead is keep that access to a short list of named accounts, and record who changed what, permanently.
No system can stop a convincing fake message. Anybody can set up a lookalike address or send a text. Nothing we build prevents that, which is exactly why the rules above are written down and repeated rather than assumed.