Never ask a giveaway winner for their address in chat

Digital prizes are easy: a key goes in an email and nobody learns anything about anybody. The moment the prize is physical, someone has to tell you where they live — and the ways that usually happens range from careless to actively unsafe.

The three bad versions

Asking in chat is the worst, and it happens constantly because it is the path of least resistance in the moment. Chat is public, logged by third parties, and read by more people than are talking in it. Nobody should ever type their street address there, and a winner who is excited and being asked by a streamer they like may well do it before thinking.

Platform DMs are better and still not good: they are a permanent record in a conversation neither of you controls, they are frequently the vector for impersonation scams, and they train your audience that a message from you asking for personal details is normal. That last one causes real harm later, because the next person asking will not be you.

A shared form or spreadsheet is the most common "responsible" version and it is where the addresses of everyone who has ever won anything sit forever, in an account with a password you last changed in 2022. It is not that the form is wrong; it is that nothing ever gets deleted from it.

What good looks like

Four properties, none of them exotic. The winner enters it themselves, so it is never dictated or retyped. The link is private to them rather than a form anyone can open. It is never shown on any public page — not the results page, not the overlay, not the entry list. And it does not live forever.

In Kloot, a prize marked as physical turns the claim into an address form: the winner fills it in on their own device, and it is stored separately from the giveaway record so it cannot leak through a public read. They can correct it for 24 hours, which matters more than it sounds — the most common failure with addresses is a typo made in a hurry by someone who has just won something.

The impersonation problem, which is the real risk

The reason to care about this beyond tidiness is that giveaway winners are a known target. Someone watches your stream, sees who won, and messages them from an account with your avatar and a near-identical name asking for a shipping address, a phone number, or a small fee to cover postage. This works often enough to be a standard scam, and it works best when the real streamer has already normalised asking for details over DM.

Which gives you a concrete policy worth stating out loud when you announce a winner: everything about the prize happens through the claim link, and you will never DM them asking for anything. That sentence costs you nothing and makes the impersonation obvious when it arrives.

Announcing the winner is also a disclosure

Worth a thought before you read a name out. A username on screen is usually fine, because it is the name they chose to be known by. A real name, a location, or a photo of a parcel with a label visible in shot is not — and the last one happens surprisingly often when streamers show off what they are sending.

The same applies to thanking people afterwards. "Congrats to @someone, your thing is on its way" is good. Anything that pairs a person with where they live, including a screenshot of your shipping tool, is a mistake that cannot be undone once it is in a VOD.

Do not collect it before the draw

A tempting shortcut is to ask for an address at entry, so shipping is instant. Do not. It means holding the addresses of everyone who entered rather than the one person who won — hundreds of records instead of one, all of them a liability, for a convenience worth about ten minutes.

It also costs you entries, and costs them disproportionately from people who are new and have no reason to trust you yet. Which is a reasonable instinct on their part — being asked for a home address by a channel you found four minutes ago is exactly the shape of thing people are right to refuse.

Say what you need and why

Ask for the minimum the courier requires and say what it is for. Most streamers ask for a full name, address and sometimes a phone number, and the phone number is usually only needed because a particular courier demands one — so say that, rather than collecting it because the form had a field.

Then delete it when the prize arrives. There is no reason to keep a stranger’s address after the parcel has been delivered, and a great deal of reason not to — the data you do not hold is the data that cannot leak, be subpoenaed, or be found by whoever gets into your account in three years.

The bit people forget: you are now shipping something

A physical prize commits you to customs forms, postage costs and the possibility that it does not arrive. State the territory you can actually ship to before entries open rather than discovering afterwards that the winner is in a country where the postage exceeds the prize.

And be aware that a country list on a giveaway page is usually displayed rather than enforced — including in Kloot. It tells people who the giveaway is for; it does not stop anyone entering. So if shipping genuinely constrains eligibility, check at the point of awarding rather than assuming the entry form handled it.