Privacy

Who this is

Nth is run by Bob Caine. Nth is the software that counts visits to a promotion link and picks a winner. Each individual promotion also has a sponsor, named in that promotion’s Official Rules, who provides the prize.

If you have a question about anything here, or want a copy of what is held about you, or want it deleted, email bob@bobcaine.com.

What happens when you follow a campaign link

A cookie named pg_vid is set on your browser. It holds sixteen random bytes and nothing else — no name, no email address, nothing derived from you. Its only job is to recognise the same browser so you are not counted twice. It is marked HttpOnly, Secure and SameSite=Lax, which means scripts on the page cannot read it, it is only sent over HTTPS, and it is not sent from other sites. It lasts about 400 days.

One record is written for each visit. It holds:

• A one-way hash of that cookie value.
• A one-way hash of your IP address. The address itself is never written down.
• Your browser’s user-agent string — which names your browser, its version and your operating system — stored as your browser sent it.
• The address of the page you arrived from, if your browser sent one, also stored as sent.
• Which promotion and round the visit belonged to, its position in the count, and the time.

The two hashes are made with SHA-256 and a secret key held by the server, and are truncated. Nothing in the database can be turned back into your IP address.

This is used to count each visitor once per promotion per day, to pick the winning visit, and to spot automated traffic trying to game a promotion. It is not used to build a profile of you, and it is not combined with anything from other sites.

If you win a prize

Nothing identifying you is collected unless you win and choose to claim. The claim form asks for your name and email address, and sometimes one extra detail the sponsor needs to deliver the prize, such as a postal address. You choose whether to give them.

They are used to deliver your prize and to contact you about it. Your email address is also recorded on the message sent to you, so a failed delivery can be retried.

A winner’s name and email address are kept for up to seven years, because prize records may be needed for tax purposes. You can ask for them earlier than that and they will be removed where records law allows.

If you run promotions on Nth

Account holders sign in through Clerk, which handles the password or sign-in link and holds the account itself. Nth stores the account’s email address and name, plus the promotions created and their results.

Signing in with Google

Signing in with a Google account is one option for account holders. It is never used for entrants — following a promotion link needs no account at all.

If you choose it, Google is asked only for the basic sign-in details: your name, your email address, your profile picture, and the identifier Google uses for your account. No other Google data is requested. Nth never asks for access to your Gmail, your Drive, your contacts, your calendar, or anything else in your Google account, and could not read them if it tried.

Those details go to Clerk, which runs sign-in and holds the account. Of them, Nth’s own database stores two: your email address and your name. They are used only to know which account you are and to show your own promotions to you.

Data received from Google is not sold, rented, or passed to anyone else. It is not used for advertising, not used to build a profile, and not used to train any model. If you later sign in by email instead, the same account is recognised by its email address.

You can disconnect Nth at any time from your Google account’s permissions page, which stops any further sign-in through Google. To have the stored email address and name removed as well, email bob@bobcaine.com.

Getting a copy, or having it deleted

Email bob@bobcaine.com and ask. You will get either what is held about you, or confirmation that it has been removed, and a reply within a few days.

Two limits worth stating plainly. Visit records cannot be traced back to you on request, because the only identifiers in them are one-way hashes — there is nothing to search by. And a winner’s name and email address may be held for up to seven years where tax record-keeping requires it; anything not required is removed.

You can also clear the pg_vid cookie from your browser at any time. Doing so only means a future visit is counted as a new visitor.

Who else handles this data

Four services, each doing one job. Vercel hosts the site and, like any web host, keeps its own server request logs. Supabase hosts the database the records above live in. Clerk handles account sign-in. Resend delivers the email sent to a winner and to the sponsor.

Data is not sold, rented, or shared with anyone else. There are no advertising cookies, no third-party analytics, and no tracking pixels — the site loads no scripts, fonts, or images from anywhere but itself and the services above.

Changes

If this page changes, the date at the top changes with it. A promotion’s own Official Rules describe how that promotion works, and stay available for it.