2SG · Privacy Policy · Version 1.2 · Under review
What we collect, why we collect it, who else touches it, and what you can make us do about it. Written to be read, not to be survived.
Under review
This Privacy Policy is published in full and written to be relied on, but it is with a promotions attorney for review and may change before the giveaway opens. Wording may be corrected, clarified, or tightened; a few details — the sponsor’s legal name, the business address and the effective date — are still being finalised and appear as marked blanks.
This document may change. Every change is published here with the version noted, and anyone with a 2SG account is emailed when a new version goes up — never quietly. The version in force on the day you use the Services is the one that governs you. Questions: support@2sg.us.
We do not sell your personal information for money. We have never done it and we are not planning to. If we ever turn on advertising pixels, that counts as "sharing" under California law, and Section 8 tells you exactly how to switch it off.
This summary exists to be readable. It is not the policy — if it ever disagrees with the sections below, the sections below win.
This policy is issued by 2nd String Gaming, LLC ("2SG", "we", "us", "our"), of [Mailing Address TBD]. The company is in formation and will be registered before the giveaway opens; until then the business is operated by its founder under the same name. We are the business responsible for the personal information described here.
It covers 2sg.us, our store, our accounts and rosters, our giveaway entry system including the mail-in route, and our Twitch and Discord presences where we operate the space.
It does not cover Twitch, Discord, Shopify or any other platform's own handling of your information — they are separate businesses with their own policies. Section 6 names the ones we use.
Our Services are intended for people in the United States. We are not offering them to people in the European Economic Area or the United Kingdom, and we do not target them.
| Information | Where from | Why we need it |
|---|---|---|
| Legal name | Signup, mail-in card | Matching entries to one person, verifying a winner, the household limit |
| Email address | Signup, mail-in card | Your account identity, entry notices, winner contact |
| Residential address | Signup, mail-in card | Enforcing two-per-household, shipping merch and prizes |
| Date of birth | Signup | Confirming you are 18 or older |
| State of residence | Signup, address | Excluding Rhode Island and the territories; publishing a winner's state |
| Display name | Signup | Public on the Open Roster and the winners page |
| Messages to us | Email, support | Answering you, and keeping a record of what we said |
| Information | What it is |
|---|---|
| Entry ledger | Every entry, where it came from, when it was earned, when you added it to a giveaway, and what became of it |
| Order records | What you bought, the amounts, the date, and the entries it awarded |
| Payment fingerprint | A one-way SHA-256 hash of the card brand, issuer digits and last four. See Section 3. |
| Roster position | Your Player number, or Partner number if you are one |
| Account standing | Warnings, entry blocks, suspensions and the reasons for them |
| Activity timestamps | Last active, used only for the five-year dormancy rule |
| Device and usage data | IP address, browser and device type, pages viewed, referring site |
Twitch, if you sign in with it: your Twitch user ID, login name and display name. We do not receive your Twitch password, your email-verified status, your follower list, your chat history or your payment details.
Shopify, when you buy: the order, the amounts, the shipping address, and the card metadata described in Section 3.
Discord, if you link it or contact us there: your Discord user ID and username.
We do not ask for and do not want your Social Security number, taxpayer identification number, driver's licence number, passport number, biometrics, precise geolocation, health information, or information about your race, religion, politics, sexual orientation or union membership. Our database is built so that a taxpayer ID column cannot exist, and that is enforced by an automated test.
Plain speak — the one exception
If you win, the IRS requires a Form W-9 because the prize is worth more than $600. That form carries a taxpayer ID. It is collected outside our systems, handled only for tax reporting, stored securely with our tax records, and it never touches the site's database. Section 10 says how long it is kept.
We never receive, see or store your full card number, expiry date or security code. Payment is processed by Shopify and its payment providers, who are responsible for it under their own policies and under the card industry's security standards.
What we do keep is a payment fingerprint: a SHA-256 hash of the card brand, the issuer identification digits, and the last four digits. It is a one-way value. It cannot be turned back into a card number, it is never shown to anyone including you, and it is never used to charge you.
Its only purpose is fraud detection — noticing when several accounts claiming to be different people at different addresses are all paying with the same card, which is the signal that someone is farming entries. We think you are entitled to know this exists rather than discover it.
We treat the images accordingly. They are stored in private storage, are never published, never posted on stream, and never shown on the Open Roster or a winners page. Access is limited to administrators reviewing them, and every review is logged.
When a card arrives we photograph it and record what it says. The system reads the card automatically and an administrator confirms it by hand; both the machine's reading and the human's confirmation are stored separately, so a dispute can be traced. We also store a hash of the image to detect the same card being submitted twice.
We keep the physical card as well as the image. A photograph can be argued with; the original cannot. Keeping the paper means that if anyone ever questions whether a card was misread, whether an entry was credited, or whether a batch of cards claiming to come from different people is all in one handwriting, the answer exists in a form that does not depend on taking our word for it.
Cards are held in locked storage, handled only by the administrators who process them, and are used for nothing beyond entry processing and resolving a dispute about an entry. They are not sold, not shared, not shown on stream, and not photographed again. At the end of the period in Section 10 they are destroyed by cross-cut shredding, on the same schedule as the images.
Plain speak — what this costs you
Paper is harder to delete than a database row. If you ask us to delete your information while we still hold your cards, we have to physically find them, and that takes longer than deleting a record. We will still do it — see Section 8 — but we would rather tell you that now than have you discover it later.
Do not write anything on a card beyond what the Official Rules ask for. If you send us information we did not ask for, we will delete it.
We do not sell your personal information for money. We share it only as set out here.
| Provider | What they do | What they get |
|---|---|---|
| Shopify | Store, checkout, payments, fulfilment | Name, email, shipping and billing address, order contents, payment (processed by them, not us) |
| Supabase | Database, authentication, file storage | Everything in your account, the entry ledger, and mail-in card images |
| Twitch | Sign-in, streaming | Only what you authorise at sign-in |
| Discord | Community server | Your Discord identity and what you post there |
| [Email Provider TBD] | Sending transactional and marketing email | Your name and email address, and the content of the message |
| [Analytics Provider TBD] | Site measurement | Usage and device data, as described in the Cookie Policy |
| [Ad Platforms TBD] | Advertising | Online identifiers and activity, only if and when advertising is switched on |
Each provider is contractually limited to using your information to provide its service to us.
California and several other states define "sale" and "sharing" broadly. Under those definitions, letting an advertising platform set a pixel that sends online identifiers about your visit can count as sharing for cross-context behavioural advertising, even though no money changes hands.
We do not sell personal information for money, and we never have. If and when we enable advertising pixels, that activity would be "sharing", and the categories involved would be online identifiers and internet activity. Our Cookie Policy says exactly what is running at any given time.
We do not sell or share the personal information of anyone we know to be under 16. Our Services are 18 and over.
Most state privacy laws only apply to businesses above certain size thresholds, and we are well below all of them. We are giving you these rights anyway, and not only if you happen to live in the right state.
You may ask us to:
You will never be treated differently for exercising a right. We will not deny you service, charge you more, or give you a worse experience.
Email support@2sg.us from the address on your account, or write to us at the address in Section 13. We will acknowledge within ten (10) days and respond within forty-five (45) days, extendable once by a further forty-five days if the request is complex — we will tell you if that happens.
We will verify it is really you, usually by confirming details already on your account. For a deletion request we may ask for more. An authorised agent may act for you with written permission.
If your browser or extension sends a Global Privacy Control signal, we treat it as a valid request to opt out of any sale or sharing and of targeted advertising, automatically, for that browser. You do not have to contact us, and we do not require you to have an account.
Every marketing email carries a working unsubscribe link and our postal address. Unsubscribing stops marketing within ten (10) business days. It does not stop transactional messages about your orders, your entries or a giveaway you have entered, and it does not close your account.
We may refuse a deletion request, in whole or in part, where we must keep the information to complete a transaction, detect or prevent fraud, comply with a legal obligation such as tax reporting, exercise or defend legal claims, or maintain the integrity of a giveaway that is open or recently drawn. We will tell you which exception applies.
Physical mail-in cards take longer. Where we hold cards you sent us and no exception above applies, we locate and shred them as part of your request, but paper cannot be deleted with a keystroke. We may need the full forty-five (45) days for that part, and we will tell you when it is done.
Deleting your account forfeits any entries it holds, including entries already added to an open giveaway. That cannot be undone.
Tell us first — support@2sg.us. If you are not satisfied, you may appeal by replying and asking for a review; we will respond within forty-five (45) days with our decision and our reasons. You may also complain to your state Attorney General.
We use cookies and similar technologies. What is running, what it does and how to control it is set out in our Cookie Policy, which is part of this policy.
On your first visit we show a cookie notice and nothing optional runs until you answer it. US state privacy laws would let us skip that and simply offer an opt-out afterwards, since they work on an opt-out rather than an opt-in model — we ask first because being asked is better. We also honour Global Privacy Control automatically, as described in Section 8.
| What | How long | Why |
|---|---|---|
| Account information | While the account is open | To run it |
| Unclaimed mail-in entries | 6 months | The window to claim them, per the Official Rules |
| Mail-in card images | 7 years | From the draw. Matches the entry ledger, so the record of an entry and the evidence for it expire together |
| Physical mail-in cards | 7 years | From the draw. The original is the better evidence if a draw or an entry is ever questioned, and Nevada allows six years to bring a contract claim |
| Entry ledger and draw records | 7 years | Proving a draw was fair, and the record a regulator may ask for |
| Order and tax records | 7 years | Tax law |
| Winner documents and W-9 | 7 years | Tax law |
| Dormant accounts | 5 years | Closed after five years inactive, with a warning three months before |
| Support email | 3 years | Continuity, and a record of what we told you |
| Analytics data | 14 months | Year-on-year comparison, then gone |
Each period runs from the event in its row, not from the day you ask. Giveaway records run from that giveaway's draw, so every contest ages out on its own clock rather than everything accumulating forever.
When a period ends we delete the information or irreversibly anonymise it. Backups roll off on their own cycle, and deleted data disappears from them as they rotate.
We protect your information with encryption in transit and at rest, access controls enforced at the database itself rather than only in the application, private storage for card images, one-way hashing of payment fingerprints, logged administrative access, and the principle that no one sees more than their role requires. Moderators, for instance, cannot see entry counts, balances or order history at all.
The physical cards get physical security. They carry your name and home address in your own hand, so they are kept in locked storage rather than a box on a shelf, they never leave it except to be processed or shredded, and they are never taken off site.
No system is perfectly secure. We cannot guarantee absolute security, and you send information to us at your own risk. If a breach affects your personal information we will notify you and the relevant authorities as the law requires.
Use a strong, unique password. Tell us at support@2sg.us if you think your account has been accessed by someone else.
The Services are for adults. We do not knowingly collect personal information from anyone under eighteen (18). If we learn we have, we will delete it and close the account. If you believe a minor has given us information, write to support@2sg.us and we will act promptly.
We may update this policy. The current version is always posted here with its version number and effective date. If we make a material change we will notify you on the Services or by email before it takes effect. Continuing to use the Services after that means you accept it.
For anything about privacy, including a rights request:
We will provide this policy in an alternative format on request.
Second String Gaming Privacy Policy v1.2 · Under review 17 Sep 2026 Every player belongs.
No number yet? Take a player number.
Accounts are not live yet — the roster system is being built on stream. Nothing you type here is sent anywhere until it ships.