Stateless by design

There is no MerryShuffle database. Your exchange exists in exactly two places: the organizer’s browser tab (until it closes) and the private links themselves.

What that means

• Keep the links. Once the tab is closed, the links are the only copy of the draw. Lose them and the exchange is unrecoverable — by anyone, including us.
• “Deleting” an exchange means destroying the links. There is no server copy to purge.
• Nothing to leak. A breach of this site could expose static files and nothing else — the design keeps the interesting data out of the building.

Why we chose this

A gift exchange is a small, short-lived secret. The strongest privacy policy for data with a two-week shelf life is to never hold it. The cost is the warning above — and we’d rather give you the warning than the database.