Scope and responsible publisher
This notice describes UAE Draw News and its OVHcloud VPS hosting in Singapore. The site provides editorial guides, stored draw results, history, statistics and optional practice/replay tools. There is no registration, payment processing, contact-submission form, third-party advertising script or analytics integration.
Session cookie
Browsing the public editorial pages does not create a practice session cookie. In the practice/replay application, accessing a functioning API creates a random udn_practice cookie if none is present. It identifies a browser session, not a named account. It expires at most 30 days after issue; reuse does not refresh expiry. It is HttpOnly, SameSite=Strict, Secure in production and scoped to /api/practice.
The database stores a SHA-256 hash of the session identifier. The application uses that identifier for history access, request deduplication, rate limits and CSRF protection. It does not use localStorage or sessionStorage for practice history. Cookie expiry or manual cookie removal does not delete server records.
Practice and replay records
Practice records contain selected digits, draw identifiers, submission and cutoff times, versions, matching outcomes and correction audit entries. Replay also stores its delay setting, round choices, pending settings, cached request responses and unavailable-result markers. These records are held in a separate SQLite practice database on the VPS.
There is no automatic age-based purge of these stored records. A displayed history limit is not a retention limit. Existing records remain until an applicable session deletion control or an administrator removes them. Use the session deletion controls described below, or contact contact@uaedrawnews.com for a privacy enquiry.
What deletion does and does not remove
“Delete my history” in practice removes that session’s practice choices, saved requests, audit and rate-limit rows. “Delete my replay history” separately removes replay choices, requests, audit, unavailable-result markers, rate-limit rows and delay settings. Both require the current session cookie and security checks; neither removes the other mode’s history.
These controls do not clear the cookie, remove operator-result records, erase access logs or rewrite existing backups. Opening replay again can create a new settings row. Clear both histories before removing the cookie if you want both active histories deleted. If the cookie is lost, the site cannot automatically reconnect you to those records.
Deletion removes active database rows, not a guaranteed forensic erasure of disk space. Restoring an older backup may restore previously deleted rows; there is currently no deletion ledger that automatically reapplies those deletions.
Access logs and operational logs
Caddy records requests to the main domain for operation and diagnosis. Access records can contain the IP address, request time, method, URL including query string, response status, size, duration and browser headers such as User-Agent and Referer. Cookie and authorization headers are redacted by Caddy’s default configuration; this does not anonymise the IP address or URL.
Access logs rotate at 10 MiB with up to five rotated files. The default rotated-file age limit is 90 days and cleanup occurs on rotation; the active file has no fixed time-based rotation configured. This is not a promise to delete every request within 90 days. Application diagnostic JSONL logs rotate by size with 14 rotated files; system journal retention uses OS defaults, not a site-specific deletion deadline.
Backups, providers and requests
Daily local backups include the practice database and retain the latest 14 successful backup directories. This is a count, not a guaranteed 14-day expiry: failures can leave older copies retained longer. An administrator-held off-server copy also exists without an automated deletion schedule. Automated off-site backup is prepared but has no configured destination or active schedule.
OVHcloud supplies the server infrastructure; authorised administrators can access stored data for operation and recovery. Clicking an external operator link takes you to a separate service with its own privacy practices. No practice choices are sent to the operator as play instructions.
Contact
For enquiries about this page, email contact@uaedrawnews.com.
Email correspondence
Messages sent to contact@uaedrawnews.com are forwarded by Namecheap to an owner-designated Gmail inbox. Namecheap and Google process the message for delivery and storage. The recipient can see your sender address, message and attachments. Email correspondence is not stored by the website contact form; no such form is connected.
There is no configured automatic deletion schedule for contact email. Website practice-history deletion controls do not delete email correspondence. Use the contact address for a privacy enquiry without sending your session cookie or identity documents.