Draw Rules

Scope

These rules apply to every ORVETTA prize draw unless the draw's own published rules say otherwise. They form part of our Terms.

Before a draw opens

1. We publish the prize, its value, any cash alternative, the entry price, the maximum number of entries, the maximum per person, the opening time, the closing time and the draw time.
2. We generate a secret 32-byte seed and publish its SHA-256 hash (the "commitment"). We cannot change the seed later without the commitment failing to match.
3. Once the first entry is made, the prize, value, cash alternative, entry price, maximum entries, closing time, draw time and free entry arrangements are locked. They can change only for a legal or regulatory reason, an error, or the prize becoming unavailable, through a recorded process that needs two members of staff. Low sales is never a reason. Everyone who entered is told.

Entries

1. A paid entry is valid when the payment provider confirms payment for an order made before the closing time.
2. A free entry is valid when it meets the Free entry rules and arrives by the closing time.
3. Paid and free entries are numbered in one sequence and go into one pool.
4. An entry can be withdrawn before the pool is frozen only if: the order is refunded, the payment is reversed by a chargeback, the entrant is not eligible, or the entrant chose a pause, suspension or closure. Withdrawn paid entries are refunded.

Freezing the pool

1. After the closing time, once every free entry that arrived in time has been decided, we freeze the pool.
2. We publish the pool file: one line per valid entry, with its number and its random reference, in number order. We publish the SHA-256 hash of that file.
3. At the same time we fix which round of the drand "quicknet" public randomness beacon will be used. It is always a round produced after the freeze.

Choosing the winner

1. When the chosen drand round is published, we check its signature against the League of Entropy public key.
2. We start the random number generator for the draw: HMAC_DRBG with SHA-256, as defined in NIST SP 800-90A. Its inputs are the 32-byte server seed, the 32-byte drand randomness, and the draw reference with the 32-byte pool hash.
3. The generator picks a position in the pool. Every entry has exactly the same chance: numbers that would favour some entries are discarded. Further winners, if any, are picked without repetition.
4. For prizes at or above our high-value threshold, a second member of staff approves the draw before it runs.
5. We publish the result, the revealed seed, the drand round and signature, the version of the random number generator, the full manifest and its hash. Anyone can repeat the calculation; see Transparency.

If a technical failure stops the draw

A draw is never run twice and never redrawn. A recovery is allowed only before a result exists, and only if our system itself finds one of these failures: the committed seed cannot be used, the chosen drand round has not been published 6 hours after its time, or the round fails its signature check.

1. One member of staff asks for a recovery and records the reason. A second member of staff confirms it.
2. We commit to a new seed, publish its hash, and fix a new drand round produced after that moment.
3. The pool of entries does not change.
4. The draw page shows what failed and when, with the original and the new commitment and round.

Results cannot be edited

A recorded result is never changed. If a winner is later found to be ineligible, we publish a separate correction record explaining what happened.

Winners

1. We contact the winner within 2 working days and verify their identity, age and eligibility.
2. The winner can take the prize or, where published, the cash alternative.
3. If a winner is not eligible, or does not respond within 28 days, the prize is forfeited and the published correction process applies.

Livestreams

We may stream or record a draw. Livestreams never show entrants' names, contact details or payment information; only entry numbers and references.