Social giveaway picker
Paste a list, or import authorized interactions from YouTube, Facebook Pages, Instagram, and Threads, then run reproducible prize draws.
Manual lists, raw OAuth code/token values, and imported-list snapshots remain transient browser state. Provider calls send the fields below to the GoGo backend, but it does not persist raw code, token, or import snapshots; it separately stores the pseudonymous OAuth metadata described below.
Every request includes locale. YouTube: videoUrlOrId, maxComments, optional keyword, locale. Facebook: auth-URL locale; Pages authCode and locale; post pageId, postUrlOrId, accessToken, includeReactions, locale. Instagram: auth-URL locale; authorization authCode or accessToken plus locale; comments mediaId, accessToken, maxComments, locale. Threads: auth-URL locale; profile authCode or accessToken plus locale; replies mediaId, accessToken, maxReplies, locale. Raw code/token values and import snapshots remain transient browser state and are not persisted by the backend; the OAuth metadata below is stored separately.
At OAuth start, the backend separately stores a pseudonymous HMAC nonce digest document key, provider, createdAt, and expiresAt; raw code, token, state, and nonce are not stored. The record becomes unusable after 10 minutes and enters asynchronous Firestore TTL deletion; physical deletion at minute 10 is not guaranteed.
- Import 1 to 500 items per request.
- Winner and backup counts are each 0 to 100 per prize and cannot exceed eligible participants in total.
- Seed must be 1 to 128 characters.
- Prize labels may contain at most 100 characters.
How to use this tool
Keep manual lists in the browser, or import available YouTube comments and interactions accessible to authorized Facebook Page, Instagram, or Threads accounts.
Run provably fair giveaways for social media contests on Instagram, YouTube, and Facebook. Uses cryptographic randomness to ensure unbiased drawing with built-in spam deduplication.
💡 3 Quick Steps to Get Started
Paste comment usernames or entry names (one per line).
Select winner count and toggle duplicate account filtering.
Click Draw to reveal unbiased winners selected via cryptographically secure RNG.
When it helps
Keep manual and provider-imported participants separate, then dedupe, exclude, seed the draw, select winners and backups, and export CSV.
How it works
Enter one manual participant per line. YouTube comments are fetched by the backend with its configured YouTube API key; Facebook Page, Instagram, and Threads use content accessible to the authorized account. Only the active tab’s latest successful snapshot is drawn in seeded order.
Worked example
Example: import up to 500 YouTube comments, set 1 winner, 1 backup, and a seed of at most 128 characters, then download CSV.
Limits and data handling
YouTube comments are fetched by the backend with its configured YouTube API key. Facebook Page, Instagram, and Threads support only content accessible to the authorized account. Unconfigured, unauthorized, timed-out, or invalid responses show a safe localized error; raw provider messages are not displayed, and arbitrary public posts are not guaranteed. Browser requests for provider imports wait up to 20 seconds. The backend accepts up to 12 social import or authorization requests from the same source in 60 seconds. Successful imported lists are not cached by the backend; only the latest successful snapshot remains transiently in the current browser, and a failure creates no new snapshot.
Every request includes locale. YouTube comment import sends videoUrlOrId, maxComments, optional keyword, and locale. Facebook auth URL sends locale; Page loading sends authCode and locale; post import sends pageId, postUrlOrId, accessToken, includeReactions, and locale. Instagram auth URL sends locale; authorization loading sends authCode or accessToken plus locale; comment import sends mediaId, accessToken, maxComments, and locale. Threads auth URL sends locale; profile loading sends authCode or accessToken plus locale; reply import sends mediaId, accessToken, maxReplies, and locale. Manual lists are not sent. The backend separately stores a pseudonymous HMAC nonce digest document key, provider, createdAt, and expiresAt, never raw code, token, state, or nonce. The record becomes unusable after 10 minutes and enters asynchronous Firestore TTL deletion; physical deletion at minute 10 is not guaranteed.
Cryptographic RNG, Provable Fairness & Social Giveaway Guide
1. CSPRNG Randomness and Fisher-Yates Uniform Distribution
Provable giveaway integrity requires cryptographic randomness. We leverage hardware-seeded `window.crypto.getRandomValues()` mapped through the Fisher-Yates unbiased shuffle algorithm. This mathematically guarantees an exact uniform probability distribution of 1/N for every candidate entry.
2. Deduplication and Anti-Bot Fraud Filters
Built-in sanitization routines deduplicate spam accounts, enforce keyword validation rules, and allow weighted multi-ticket allocation models for loyal brand advocates.
3. Provable Transparency and Audit Logging
Documenting giveaway audits via cryptographic SHA-256 state hashes and continuous screen capture validates operational integrity, safeguarding brand reputations against rigging claims.
Feedback
How can we improve this tool?
Send a suggestion or bug report for this tool.
FAQ
Social giveaway picker: What participant and prize limits apply?
Each provider import accepts 1 to 500 items. Winner and backup counts are each 0 to 100 per prize and cannot exceed eligible participants in total. Seeds are 1 to 128 characters and prize labels at most 100 characters.
Social giveaway picker: How are manual and API lists drawn?
Enter one manual participant per line; that list stays in the browser. API draws use only the active provider tab’s latest successful snapshot, never another provider’s data after a switch, replacement, or failure. Raw OAuth code/token values and imported-list snapshots remain transient browser state and are not persisted by the backend.
Social giveaway picker: Which provider content can be imported?
YouTube comments are fetched by the backend with its configured YouTube API key. Facebook Page, Instagram, and Threads support only content accessible to the authorized account. Unconfigured, unauthorized, timed-out, or invalid responses show a safe localized error; raw provider messages are not displayed, and arbitrary public posts are not guaranteed. Browser requests for provider imports wait up to 20 seconds. The backend accepts up to 12 social import or authorization requests from the same source in 60 seconds. Successful imported lists are not cached by the backend; only the latest successful snapshot remains transiently in the current browser, and a failure creates no new snapshot.
Social giveaway picker: What does each API request send?
Every request includes locale. YouTube comment import sends videoUrlOrId, maxComments, optional keyword, and locale. Facebook auth URL sends locale; Page loading sends authCode and locale; post import sends pageId, postUrlOrId, accessToken, includeReactions, and locale. Instagram auth URL sends locale; authorization loading sends authCode or accessToken plus locale; comment import sends mediaId, accessToken, maxComments, and locale. Threads auth URL sends locale; profile loading sends authCode or accessToken plus locale; reply import sends mediaId, accessToken, maxReplies, and locale. Manual lists are not sent. The backend separately stores a pseudonymous HMAC nonce digest document key, provider, createdAt, and expiresAt, never raw code, token, state, or nonce. The record becomes unusable after 10 minutes and enters asynchronous Firestore TTL deletion; physical deletion at minute 10 is not guaranteed.
