No account. No tracking. Your lists stay in your browser.

• No account. There's nothing to sign up for and no login.
• No backend list storage. Pick has no database. Your names, choices, class lists, raffle entrants, teams and results exist only in the browser tab you're using.
• No hidden uploads. After the page loads, Pick makes no requests of its own. The server only serves the app's files and refuses anything that could carry data (any request other than reading a page).
• No tracking. No analytics, no cookies, no advertising, no fingerprinting, and no third-party scripts, fonts or images.
• Nothing about your lists is stored. History lasts only while the page is open. Close or reload the tab and it's gone.

A share link only exists if you press Share. The dialog tells you that anyone with the link can see the entries. The list is written into the link itself, after the #:

https://pick.littleormore.com/spin-wheel#p=…

That part of a web address — the fragment — is never sent to a server: browsers keep it out of requests and out of the Referer header. So a shared list goes straight from your browser to the recipient's browser through whatever app you send the link with; Pick's server never receives it. When a shared link is opened, Pick reads the list, removes the fragment from the address bar, and checks it strictly — anything malformed or too large is rejected and never displayed.

Treat a share link like the list itself: anyone you send it to (and the app you send it through) can read it. The classroom picker has no share link at all, because rosters are sensitive.

Only display preferences, and only if you change them: theme, sound, celebration, spin speed and reduced motion — saved in your browser's local storage under one key (pick.prefs.v1). They contain no names, lists, results or history. Clearing site data removes them.

• Importing a .txt or .csv file reads it locally with your browser's File API. The file isn't uploaded.
• The clipboard is only read when you press Paste, and only written when you press Copy.
• Downloads (like raffle winners as CSV) are generated in the page — no request is made.

Off. Pick has no analytics code at all. If page-level analytics is ever added, it will never receive names, winners, weights, classroom data, team membership, decisions or share-link contents — and this page will say so first.

• A strict Content-Security-Policy only lets the page connect back to its own origin, blocks third-party scripts and forbids form submissions.
• The server returns 405 for every method except GET and HEAD, so there is no way to upload anything.
• Automated browser tests use distinctive fake names across the wheel, teams, raffle, classroom and sharing, and fail if any of them appear in a request URL, header or body, a cookie or persistent storage.
• Everything you type is displayed as plain text — never as HTML.

You can check it yourself: open your browser's developer tools, go to the Network tab, and spin a wheel. After the page loads, nothing is sent.

Pick is served by Cloudflare. Like any web server, the hosting provider processes standard request information (such as IP address and browser type) to deliver pages and protect against abuse. None of your lists are part of those requests.

Email bsamjoel@gmail.com. Last updated 12 October 2026.