Privacy Policy | DrawRelay

Summary

Calculator inputs are saved only in your browser. They are not sent to DrawRelay.
Free draw alerts need only your email address and the alert settings you choose. They start after you confirm by email (double opt-in), and every alert has an unsubscribe link.
Pool Pass stores your email address, your purchase record, the CRS profile you choose to save and the dates you enter, so CRS Guard can send reminders. Card numbers go to Stripe, never to DrawRelay.
The only cookie, pp_session, is set when you sign in to CRS Guard and keeps you signed in.
Analytics are aggregate and never include calculator inputs, scores or email addresses.
DrawRelay does not sell personal information or use it for advertising.

Who is responsible

DrawRelay is responsible for the personal information described on this page. Questions, requests and complaints go to DrawRelay’s privacy contact at hello@drawrelay.com, including questions about how service providers outside Canada handle personal information.

Laws that apply

DrawRelay handles personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). Both laws require that personal information is collected only for reasonable purposes that are explained up front, with consent, and that it is protected, kept accurate and retained only as long as it is needed. Both give individuals the right to see and correct the personal information an organization holds about them. Commercial emails are also governed by Canada’s Anti-Spam Legislation (CASL).

What is collected

Calculator inputs

The values entered in the CRS calculator (age, education, language results, work experience and related answers) are saved in your browser’s localStorage so the form is filled in on your next visit. The calculation runs in your browser, and these inputs are not transmitted to DrawRelay. The calculator’s “Reset to example” button, or clearing this site’s data in your browser settings, deletes them. Anyone who uses the same browser profile can see them.

Free draw alerts

When you sign up for draw alerts, DrawRelay stores:

your email address;
your alert settings: every new round, or only rounds with a cutoff at or below your score, and any round types you picked;
for score-based alerts only, the CRS score shown in the calculator when you signed up (calculated with the rules that apply from November 3, 2026). Your other calculator answers are not sent;
the page where you signed up, and whether the subscription is pending, active or unsubscribed;
consent records: the exact consent wording you agreed to, and the date and time of your sign-up request, your confirmation and any unsubscribe;
a log of which rounds you were emailed about, so no alert is sent twice;
a scrambled (hashed) copy of your confirmation link’s code. The link itself is never stored and works for7 days.

Pool Pass and CRS Guard

Pool Pass is a paid 6 months pass for CRS Guard, which sends reminders before your score or documents change and recalculates your score when the rules change. For it, DrawRelay stores:

your email address, which is also how you sign in;
your purchase record: product, amount, currency, payment date, the date the pass ends, refund status and Stripe reference numbers. Card details are entered on Stripe’s page and never reach DrawRelay;
the CRS profile you choose to save: the same answers the calculator asks for. DrawRelay does not ask for passports, identity documents or IRCC application numbers;
the dates you enter: date of birth, language test dates, Educational Credential Assessment date, Express Entry profile submission date and Canadian work start date. Each is optional and is used only to time reminders;
a log of the reminders sent, so none is sent twice;
sign-in records: a hashed copy of each one-time sign-in link and of your session, with the email address and an expiry time.

Cookies

DrawRelay sets one cookie, pp_session, and only when you sign in to CRS Guard. It is strictly necessary: it keeps you signed in, holds a random value (DrawRelay stores only a hashed copy), cannot be read by scripts on the page, and expires after 30 days or when you sign out. It is not used for analytics or advertising. The calculator, the draws pages and the free alerts set no cookies.

Analytics

DrawRelay measures aggregate traffic, such as pages viewed, referring site, browser and device type, and approximate country, to understand which pages are used. Calculator inputs, scores and email addresses are never sent to analytics. Analytics data is not used for advertising. If DrawRelay adopts an analytics tool that sets cookies or identifies individual visitors, this page will be updated before that tool is used.

Server logs

Like most websites, DrawRelay’s hosting provider records technical request logs (IP address, time, page requested and browser user agent) to deliver the site and protect it from abuse. These logs are kept for a limited period and are not combined with other data to identify visitors. DrawRelay does not write email addresses to its application logs.

How it is used

to confirm your sign-up and send the draw alerts you chose;
to keep evidence of your consent and its withdrawal, as CASL requires;
to provide CRS Guard: reminders, recalculations and sign-in;
to process Pool Pass payments and refunds, and keep the records tax rules require;
to answer your requests and keep the service secure.

DrawRelay does not sell personal information, does not share it for anyone else’s marketing and does not use it for advertising.

Service providers

DrawRelay uses the providers below to run the service. Each handles personal information on DrawRelay’s behalf, only for the task described.

Cloudflare

What it doesHosts the website, runs its server functions (Cloudflare Pages Functions) and the D1 database, and protects the site from abuse.

What it receivesEverything DrawRelay stores, as listed on this page (alert subscriptions, consent records, purchase records, CRS Guard data, sign-in records), and technical request logs.

Resend

What it doesDelivers DrawRelay’s emails: confirmation requests, draw alerts, sign-in links, purchase emails and CRS Guard reminders.

What it receivesYour email address and the content of each email sent to you.

Stripe

What it doesProcesses Pool Pass payments and refunds on a payment page it hosts.

What it receivesThe payment details you enter on Stripe’s page. DrawRelay never sees or stores card numbers; it receives your email address, the amount, the currency, the payment status and Stripe reference numbers.

What it doesHosts DrawRelay’s public channel, where summaries of new Express Entry rounds are posted.

What it receivesPublic round data only (date, type, cutoff score, invitations). No personal information.

If you follow DrawRelay’s Telegram channel, Telegram’s privacy policy applies to your use of Telegram. DrawRelay does not collect information about channel followers.

Processing outside Canada

Cloudflare, Resend and Stripe may store or process personal information outside Canada, including in the United States. While it is there, it is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities. To ask how these service providers handle your personal information, or for written information about DrawRelay’s practices with service providers outside Canada, write to DrawRelay’s privacy contact at hello@drawrelay.com.

How long data is kept

Calculator inputs: In your browser until you press “Reset to example” or clear this site’s data. DrawRelay never receives them.
Draw alert subscription (email address, alert settings, saved score, sign-up page): Until you unsubscribe or ask for deletion. After you unsubscribe, only the consent evidence below is kept.
Consent records (the wording you agreed to and the times of sign-up, confirmation and unsubscribe): While you are subscribed and for 3 years after you unsubscribe, as evidence of consent under CASL. Then deleted.
CRS Guard data (saved CRS profile, the dates you enter, the log of reminders sent): Deleted 90 days after your Pool Pass ends, or sooner if you ask.
Pool Pass purchase records: 6 years, as Canadian tax rules require for business records.
Sign-in links and sessions: Until they expire: sign-in links after 24 hours (or once used), sessions after 30 days or when you sign out.
Technical request logs: For the limited period set by the hosting provider.

Email consent (CASL)

Draw alerts use express consent with double opt-in. The consent box is unticked by default and reads: “Yes, send me Express Entry draw alerts by email from DrawRelay. I can unsubscribe at any time.” Alerts start only after you click the confirmation link that DrawRelay emails you.
Every alert and CRS Guard reminder identifies DrawRelay as the sender, gives a way to contact DrawRelay and includes an unsubscribe link.
Unsubscribing takes effect immediately. CASL allows up to 10 business days; DrawRelay does not use that time.
Messages you need for a service you asked for, such as sign-in links and purchase confirmations, are sent only for that purpose.

Security

The site is served only over encrypted connections (HTTPS). Links in emails and sign-in sessions are stored only as scrambled (hashed) values, so a copy of the database cannot be used to open them. Card details are handled by Stripe and never reach DrawRelay. Access to the systems that hold personal information is limited to DrawRelay’s operator.

Your rights and contact

You can ask what personal information DrawRelay holds about you, ask for it to be corrected or deleted, or withdraw consent, by writing to hello@drawrelay.com from the email address concerned. DrawRelay responds within the time limits set by PIPEDA and PIPA. Some records may be kept after a deletion request when the law requires it, such as purchase records for tax purposes and the consent evidence described above; they are then used for nothing else.

If a concern is not resolved, a complaint can be made to theOffice of the Privacy Commissioner of Canada or theOffice of the Information and Privacy Commissioner of Alberta.

External and affiliate links

Pages link to IRCC and to third-party services; affiliate links are explained on theaffiliate disclosure page. After following a link, the other site’s privacy policy applies, and a partner may use cookies to record that the visit came from DrawRelay. DrawRelay does not pass calculator inputs, scores or email addresses to partners.

Changes to this policy

When this policy changes, the date at the top of the page is updated. Changes that affect how existing personal information is used will be announced on the site before they take effect.