Secret Santa Draw

A draw the organiser cannot read

Secret Santa Draw does the one thing every generator does, which is pair everybody up, and one thing almost none of them do, which is keep the result away from the person who ran it. The pairings live in their own list, and the rule on that list is that a row may be read only by the person it names. Not by other participants, and not by the owner of the app either.

So the page looks different depending on who opens it. Each person sees a single card with one name on it and whatever that person wrote on their wishlist. Nobody sees a table of pairs, because for them no such table exists.

Why the person running it is the problem

Every office and every extended family has the same weak point. Somebody has to operate the generator, and that somebody now knows who has whom. Most tools answer it by emailing everybody separately, which means handing over a list of addresses. Paper and a hat answers it properly and does not survive one person being away that evening.

Getting everyone into the hat

Everyone in the draw is a row with a name, a wishlist and a list of people they must not be matched with. You can type them in, or describe the group and let your AI write them all at once, which is faster once there are more than about five.

A row can also be tied to somebody's sign-in, and that is what lets them edit their own wishlist and see their own result later. Once tied it stays tied: the field that says whose row it is cannot be changed afterwards, so a row cannot be pointed at somebody else once the draw has run.

Exclusions, and what honouring them means

The exclusions are the reason most people go looking for a generator rather than using a hat. Couples should not draw each other. Two siblings who exchange gifts anyway should not either. Someone drew the same person last year.

Here they are part of each person's row rather than a setting somebody has to remember, and they are visible: the page says plainly that these two are kept apart. What is not visible is whether the constraint was satisfiable. If the exclusions make a valid draw impossible, your AI will say so instead of quietly matching somebody with themselves.

What the AI actually does when it draws

Only the AI can write a pairing. That is not a nicety, it is the mechanism: if a person could write the list, a person could read what they wrote. Asked to draw, it reads everyone in the hat, produces a matching where nobody gets themselves and every exclusion holds, writes one private row per person, and reports back only the counts.

It also writes the small summary panel at the bottom, which is how an organiser knows the draw ran without learning anything from it: how many people were in the hat, how many pairs were kept apart, and when. Adding a late joiner means drawing again, which is a sentence: each person's pairing is written over in place, so nobody is left holding last week's name.

What it stops short of

It does not tell anyone. No email goes out with your name in it and no notification is sent, so each person finds out by opening the page. That is a deliberate trade, and it means somebody has to be signed in here to learn who they have. A person in the hat who never signs in stays in the draw and never sees their card.

It does not enforce a budget, buy anything, or carry messages between a giver and their person. Wishlists are open to everyone in the group by design, since a wishlist nobody can read is not much use. And a draw is one draw: running it again replaces the last one rather than keeping a history of previous years.

The part that carries the secret is the per-row read rule, which needs a server that knows who is asking. A published page with one shared store cannot do it, because every visitor of such a page sees the same data by design. what a shared browser page can keep for its visitors explains why that pool has no notion of whose row is whose.