Secret SantaHow the draw and the links work
The draw
The server makes the draw when you press Draw names. Nobody draws themselves, and no pair you set draws each other. The server first checks that a full draw is possible. Then it picks the givers in a random order. For each giver, it picks a random receiver who still leaves a full draw possible. So the draw never gets stuck.
The random numbers come from the secure random generator of the server (crypto.getRandomValues), with no bias.
The links
You get one organizer link and one private link for each person. The secret is the part of the link after the # sign. A browser never sends that part to a server. So the secret is not in the request, not in the server logs and not in the Referer header. The page reads the secret in your browser and sends it in the body of a request.
The server keeps only a hash (SHA-256) of the organizer key and of each private token. It cannot read them back. The organizer page needs the links, so your browser works them out again from the organizer key. A redraw gives new links. The old links stop working.
What the organizer can see
The organizer page shows the names and whether each person opened their link. It does not show who drew whom. The organizer can redraw while nobody has opened a link. The organizer can delete the draw at any time.
Be honest with yourself about one thing. The organizer has every link. If the organizer also takes part, the organizer could open another person's link and see their match. The organizer page shows when a link was opened, so the group can see it. If you want a draw that even the organizer cannot see, ask a person who does not take part to make it.
What a person sees
A person who opens their link sees who they give a gift to, that person's wish list, the budget and the date. They can write their own wish list. The person who draws them can read it.
Keep your link private. Anyone who has your link can see your match. Read the privacy page for what the server stores and for how long.