Terms of Service

The official organizers of the promotion are MB Renginio genas (company code 304662851) and VŠĮ Kultūringai (company code 304114538).

Two independent prize draws run after Comic Con Baltics 2026 (Vilnius, 22–24 May 2026):

1. Comic Con Baltics Quest — the card-collection raffle. Attendees who scanned the most Quest Cards at the venue compete for prizes across three tiers (Scout, Hunter, Legend).
2. Visitor survey raffle — a single prize awarded among attendees who completed the post-event visitor survey and opted in by signing in.

Both raffles use the same publicly-verifiable random-selection process, described in detail in Section 4 below. This document explains exactly how to enter, what disqualifies an entry, what prizes exist, how winners are picked, and how anyone — without an account or admin access — can reproduce and verify the result.

2.1 How to enter

• Install the Comic Con Baltics app and create an account (your hero number, displayed as #NNNN, is your public pseudonym).
• At the venue, hold your phone close to a Quest Card poster’s NFC tag or scan its QR code. Each successful scan adds that card to your collection.
• Re-scanning a card you already have does nothing — duplicates are not counted.
• Your collection (and your draw eligibility) is tied to your account, not to your phone.

2.2 Prize structure

• Legend tier — 30 or more cards. Prize: Samsung 55″ 4K TV (model UE55U7022FKXXH). 1 winner.
• Hunter tier — 20 or more cards. Prizes: 2× Superhero tickets to Comic Con Baltics 2027 and 5× Comic Con Baltics Mystery Boxes. 7 winners.
• Scout tier — 10 or more cards. Prize: 10× Weekend tickets to Comic Con Baltics 2027. 10 winners.

Total: 18 winners across the Quest raffle.

2.3 Eligibility — cumulative pools

Each tier draws from everyone who reached its card threshold:

• 10+ cards — eligible for the Scout draw.
• 20+ cards — eligible for the Scout and Hunter draws.
• 30+ cards — eligible for the Scout, Hunter, and Legend draws.

2.4 What disqualifies a Quest entry (anti-cheat)

Two automated fraud signals are evaluated against your scan history when the draw is run. They apply identically to all three Quest tiers.

• Off-hours scans. The Quest is only meant to be played during the festival. Any scan that lands outside 06:00–21:00 Europe/Vilnius local time on 22, 23, or 24 May 2026 is treated as a clear cheating signal — that window is intentionally wider than the actual hall opening hours (Fri/Sat 09:00–19:00, Sun 09:00–18:00) so that early-arriving staff and late stragglers are not falsely caught. A single off-hours scan permanently excludes you from all Quest tiers. This rule cannot be overridden.
• Rapid scans. The venue is large enough that walking between two different posters takes much more than ten seconds. If you successfully claim a different card less than 10 seconds after your previous claim, the second claim is flagged. Up to three flags are treated as edge-case noise (your entry stays clean). Four or more flags exclude you by default. Organizers may, after reviewing manual evidence, re-include a flagged account — but the off-hours rule above is never overridden.

These rules are applied automatically by the server at draw time, not manually selected per account. Re-scanning a card you already have does not flag you (duplicates are silently ignored at the moment of the scan, so they never start the 10-second timer).

2.5 How winners are selected — one-paragraph summary

For each tier, the eligible heroes (identified by hero number only) are shuffled using a cryptographically-seeded, deterministic algorithm. The top N entries of the shuffled list become the winners, where N is the number of prize slots in that tier (1 for Legend, 7 for Hunter, 10 for Scout). The seed used, the input list, and the algorithm source are all published — anyone can reproduce the shuffle and check the result. The full technical description is in Section 4.

2.6 One-prize-per-person rule

The three tiers are drawn top-down: Legend first, then Hunter, then Scout. Once you have won a prize, your hero number is removed from the candidate pool of every lower tier before that tier is drawn. So if you collected 30+ cards you enter all three pools — but you can only win one prize from the Quest. This is enforced by the code, not by hand.

2.7 Draw order & timing

• Draw order: Legend → Hunter → Scout, followed by the visitor survey draw (which is independent — see Section 3).
• Date: the draws run after the festival closes (after 2026-05-24).
• Visibility: the draw process is recorded and the recording is made public.

2.8 Verifying the result yourself

After the draw, anyone — no login, no app — can verify the result at https://app.ccbaltics.com/prize-draws/verify.

Pick a tier and you will see the seed used, the full sorted list of candidate hero numbers, the winners the algorithm produced, and the actual winners stored in the database. They must match. The same page includes a “test it yourself” form where you can paste a seed and a candidate list and watch the shuffle run in your browser — useful for sanity-checking the algorithm against any input.

The raw JSON API endpoints behind that page are listed in Section 4.5.

3.1 How to enter

• Open the Comic Con Baltics app and submit the post-event visitor survey.
• On the thank-you screen, tap Sign in to opt your response into the prize draw. Sign-in uses Google or Apple (the survey itself stays anonymous either way — the only reason we ask you to sign in is so we can contact you by email if you win).
• Anonymous survey responses (where you did not sign in) are kept for analytics but are not eligible for the prize draw.

3.2 Prize

• 1× Samsung 55″ 4K TV (model UE55U7022FKXXH).

This is a physically separate TV from the Quest Legend prize, sponsored on its own track.

3.3 Eligibility & one entry per account

• You must have submitted the active visitor survey.
• You must have completed the sign-in opt-in on the thank-you screen.
• The database guarantees one entry per signed-in account per survey via a uniqueness constraint. Submitting from multiple devices, or re-submitting after signing in, cannot increase your odds — the second attempt is rejected by the database before it ever counts.

3.4 Independence from the Quest draw

The survey raffle uses its own pool. Anyone who won a Quest prize is not excluded from the survey draw, and vice versa — the two raffles are sponsored separately and run as independent tracks. One person could, in principle, win both a Quest prize and the survey TV.

3.5 Selection + verification

The survey draw uses the same algorithm as the Quest draws — see Section 4. The public verifier for the survey draw is at https://app.ccbaltics.com/prize-draws/verify?tier=survey.

This section is intended for journalists, auditors, and anyone who wants to verify the draw end-to-end. It is more detailed than the rest of the document; an ordinary attendee does not need to read it to trust the draw — the public verifier in Sections 2.8 and 3.5 is enough for that.

4.1 Seed generation

The shuffle is driven by a single value called the seed. Two modes are supported:

• Default — server-generated cryptographic seed. 32 bytes (256 bits) read from the operating system’s cryptographic random source via Node.js’s crypto.randomBytes. The exact byte string is stored on every draw row and is published by the public verifier.
• Optional — pre-committed external seed. Organizers may instead announce, before the draw is run, a public value that will only become known later (for example, a future Bitcoin block hash, or a value from the NIST Randomness Beacon). Once the public anchor is known, that value is plugged into the algorithm verbatim. This rules out the possibility that organizers cherry-picked a seed that produces a favored winner — the value was committed before the seed could be known.

In either case, the seed is recorded on the draw and exposed by the verify endpoints below.

4.2 The shuffle

• Algorithm: HMAC-SHA256 streamed pseudo-random number generator, with the seed acting as the HMAC key and an incrementing counter as the message. The byte stream feeds an unbiased Fisher–Yates shuffle: each draw of a random index uses rejection sampling on 32-bit chunks to remove modulo bias.
• Input: the list of eligible hero numbers for the tier.
• Output: a deterministic permutation of the candidates. The first N entries are the winners, where N is the number of prize slots in the tier (1, 7, 10 for Legend/Hunter/Scout, 1 for the survey).
• Source code: the live algorithm is published in plain text at https://app.ccbaltics.com/api/v1/prize-draws/algorithm. Anyone can implement it in any language and reproduce the shuffle.

4.3 Reproducibility — what we store per draw

Every winner row in the database carries enough information to reproduce the draw from scratch:

• The seed used (hex).
• The SHA-256 hash of the candidate hero-number list — proof that the candidate set hasn’t changed since the draw.
• The full candidate list itself, as hero numbers.
• A timestamp for the draw and the email of the organizer who triggered it.

Anyone can: (1) read the algorithm from the source URL; (2) fetch the seed and candidate list from the verify endpoint (or the verifier page); (3) run the shuffle locally — or in the in-browser tester at /prize-draws/verify — and check that the resulting winners match what’s stored.

4.4 Re-rolls & audit log

If organizers re-run a draw (for example, due to an operational error caught before the public announcement), the previous draw row is not deleted. It is preserved in the database with a voidedAt timestamp; both the original and the replacement remain audit-visible afterwards. A re-roll cannot be retroactively hidden, and the number of voided rows is visible in the audit log.

4.5 Public verification endpoints

• https://app.ccbaltics.com/prize-draws/verify — human-friendly verifier page.
• https://app.ccbaltics.com/api/v1/prize-draws — published winners (JSON).
• https://app.ccbaltics.com/api/v1/prize-draws/verify?tier=<tier> — verify a single tier (JSON; tier ∈ legend / hunter / scout / survey).
• https://app.ccbaltics.com/api/v1/prize-draws/algorithm — algorithm source code (text/plain).
• https://app.ccbaltics.com/api/v1/prize-draws/algorithm/test — interactive shuffle tester (POST).

For each winner, we publish only:

• The hero number (for example, #9811) — the public pseudonym already shown in the app.
• The prize won.
• The timestamp of the draw.

We never publish:

• Real names, emails, account IDs, or IP addresses.
• Any sign-up data, login data, or device identifiers.
• Anyone’s per-card collection history beyond the aggregate count needed for eligibility.

We do publish the full candidate list — as hero numbers, not as identities — so that anyone can confirm their own hero number was in the running for the tier they qualified for. This is the only public exposure of who participated in the draw.

• How winners are contacted. By email, sent to the address registered on the winner’s Comic Con Baltics account (for Quest winners) or the email of the account that opted into the prize draw on the survey thank-you screen (for the survey winner).
• Ticket prize delivery. Scout weekend tickets and Hunter Superhero tickets are delivered by email.
• Physical prize delivery. Samsung TVs and Mystery Boxes are shipped to a postal address that the winner provides after notification. Shipping costs are paid by the organizers — winners are not asked to cover delivery.
• Claim window. Winners have 30 days from the date the notification email is sent to reply with the information needed to deliver the prize (postal address for physical prizes, or simply confirming receipt for ticket prizes). After 30 days without a reply the prize is forfeited and reassigned per the “unreachable winners” rule below.
• Taxes. Any Lithuanian tax due on the prizes is paid by the organizers — winners do not owe tax on what they receive.
• Transferability. Prizes are not transferable to another person and cannot be exchanged for cash or other goods.
• Unreachable or declining winners. If a winner does not reply within the 30-day claim window, or declines the prize, the prize passes to the next hero number in the already-published shuffled list for that tier. Because the seed and the full shuffled list are public, no re-draw is needed — anyone can verify the substitution from the same inputs.

• Contact email: info@ccbaltics.com.
• Dispute window: disputes must be raised within 14 days of the public winner announcement.

Because the algorithm, seed, candidate list, and source code are all public, disputes over selection can be resolved by re-running the published algorithm against the published seed and candidate list. Disputes over eligibility (for example, “my account was wrongly flagged for rapid scans”) should be sent to the contact email above with any supporting evidence; organizers commit to reviewing manual evidence for rapid-scan flags but cannot override the off-hours hard exclusion (see Section 2.4).