How Dream Car
Competitions works
A plain-English guide to the website and admin panel: how customers join and buy, how ticket numbers are picked, how live draws are recorded, and what you control as the owner.
What runs your website
Two applications on your own server, one database, and a few trusted services for payments, bot protection and email.
Everything is priced and charged in GBP. Customers can view prices in EUR or USD; those are conversions refreshed every 6 hours, for display only.
Every customer gets a permanent number
Joining
- Name, email, mobile and password; confirm 18+ and the Terms; pass the captcha.
- A 6-digit code is emailed to confirm the address.
- Emails are case-insensitive: Name@Gmail.com and name@gmail.com are one account.
- A mobile number is required before paying.
Membership number
- Permanent. It never changes, even when an admin edits the account.
- Never recycled. If #27 is disabled or deleted, #27 is never given to anyone else.
Numbers can restart from #1 once, before launch, as part of removing all test customers. After launch they are never reset. See the launch checklist.
The six stages of every competition
The website never picks a winner. Your team draws live; the system locks the entries and records the result.
Create
Prize, price, number of tickets, dates, skill question, instant wins.
AdminSell
Customers buy until the end time or until it sells out.
AutomaticClose & lock
Sales stop. The official list of eligible entries is frozen.
AdminLive draw
You pick a number live on Facebook or YouTube with an external generator.
YouRecord
Enter the number. The system shows the ticket and customer. Confirm.
AdminPublish
Winner appears on the site and gets the winner email.
AdminActive
Live and on sale between its start and end time.
Launching soon
Visible with a countdown. Sales locked.
Draft / hidden
Not visible to customers.
A competition counts as ended when its end time passes or it sells out. The admin team then gets a notification to close and lock entries.
From basket to tickets
Held 10 min
Tickets in the cart are held so nobody else can take them while the customer browses.
Reserved 35 min
Tickets are reserved while the customer pays by card or wallet.
Tickets issued
Only after Stripe confirms payment. Random numbers are assigned and emailed.
Released
Abandoned or failed payments release the tickets automatically.
Tickets available = total − sold − currently reserved. Even if hundreds of people buy at once, a competition can never sell more tickets than it has.
Bundle discounts
Per competition in the basket. No promo codes yet.
The competition page currently advertises different tiers. See decision 6.
The skill question
Tickets are eligible for the main draw.
Tickets are still issued and paid for, but marked ineligible and left out of the official draw list.
Minimum 1 ticket per purchase; the selector allows up to 500 at a time. No per-customer maximum yet.
Random, unique, permanent
Numbers are picked at random from the whole competition, not handed out in order. A buyer of 10 tickets in a 15,000-ticket competition might receive:
Why a number can never repeat
- Numbers are assigned only after payment succeeds.
- While an order is being processed, that competition is locked in the database. Two orders at the same moment are handled one after the other.
- The database refuses to store the same number twice in one competition, as a final safety net.
- Each competition has its own secret key that scrambles the order, so the next number can't be guessed.
15 orders placed at the same instant: every ticket unique, stock count exact.
2024 Audi RS6 Avant Carbon Black, Rolex Daytona Platinum (Ice Blue Dial) and 2024 Mercedes-AMG G63 Magno were created before random numbering existed, so their earlier tickets were sequential. From now on, every purchase in these three receives random unsold numbers too. Tickets already sold keep their numbers, because customers already hold them.
Prizes hidden inside the ticket pool
Choose prizes
Add instant-win prizes, how many of each, and the sales % at which they switch on.
Numbers hidden
At that %, the system secretly picks winning numbers from tickets not yet sold.
Instant win
When a new ticket matches, the win is recorded on the spot. Customer and admins are told.
Your team
You arrange the prize. It is not paid into the wallet automatically.
The Instant Wins admin page lists every winning number, whether it has been won, by whom and when.
You draw live. The system keeps the record.
Admin → Draw Console. Here is a worked example of a competition that did not sell out.
of 6,240 sold; 40 answered wrongly
ordered by ticket number
| Draw position | Ticket | Member |
|---|---|---|
| 1 | #3 | #108 |
| 2 | #9 | #61 |
| … | … | … |
| 4,117 | #11,893 | #452 |
| … | … | … |
| 6,200 | #14,996 | #233 |
Download as CSV before going live.
Locking stops all sales instantly and can't happen while a customer is mid-payment. A payment that arrives afterwards issues no tickets: wallet payments go straight back to the wallet, card payments are flagged for refund.
A confirmed result can't be edited. To correct one, an admin voids it with a written reason; the frozen list stays the same and a new result can be recorded.
Permanent draw record
Every draw keeps: total eligible entries, winning draw number, winning ticket and customer, draw time, the admin who recorded it and the live video link. Every action (lock, preview, confirm, publish, void) is logged with who and when. The log can never be edited or deleted, not even directly in the database.
Every order can be traced to Stripe
Inside each order
- Customer, competition, amount and discount
- Ticket numbers shown as #181
- Stripe Payment Intent ID and Checkout Session ID, with copy buttons and a link straight to Stripe
- Payment method and status
- Refund history and an event timeline
Order timeline
Example only.
Refund in your Stripe dashboard as usual. Stripe tells the website, which records the amount, date, reason and refund ID against the order automatically. Orders placed before 16 October 2026 have no timeline events, because the feature didn't exist yet.
Balance customers can spend on tickets
Top up
Customers add money to their wallet with a card and spend it on tickets.
Gift cards
Bought online. A code is emailed to the buyer or recipient. Valid 365 days, single use.
Redeem
The code's value is added to the wallet. Wallet money can't be withdrawn as cash.
You decide who can do what
Admin → Admins & Roles. Today there is one administrator account and it is a Super Admin.
Owner
Everything, including creating, editing, disabling and deleting other admins and resetting their passwords.
Manager
Everything except managing other administrators.
Team member
Only the areas you tick. Everything else is hidden from their menu and blocked by the server.
| Area | Super Admin | Admin | Staff |
|---|---|---|---|
| Competitions & tickets | ✓ | ✓ | If ticked |
| Draws & winners | ✓ | ✓ | If ticked |
| Payments & refunds | ✓ | ✓ | If ticked |
| Customers | ✓ | ✓ | If ticked |
| Gift cards · Newsletter · Enquiries · Settings | ✓ | ✓ | If ticked |
| Manage administrators | ✓ | – | – |
What you can do
- Create an admin. A secure password is generated and shown once.
- Edit name, email, role or permissions.
- Disable: they're signed out immediately and can't log in.
- Delete or reset password.
Built-in safety
- You can't disable, delete or demote yourself.
- The last Super Admin can never be removed.
- Admins sign in only through the captcha-protected admin login.
- Admin accounts can't buy tickets.
Give each person their own named login on your business email, instead of sharing one account. Disabling someone is then one click.
Admin → Customers
| Action | What happens |
|---|---|
| Create | Account is created already verified; a password is shown once. |
| Edit details | Change name, email (must be unique) and phone. The membership number never changes. |
| Block | Customer can't log in or buy. Can be unblocked. |
| Delete | Login is closed for good. The record and membership number are kept; the email can register again. |
| Reset password | Generates a new password shown once to you. |
Blocking or deleting doesn't change a customer's existing tickets or wallet. See decision 4.
What customers receive
| Sent when | |
|---|---|
| Verification code | On sign-up, or when a new code is requested |
| Welcome | After the email is verified |
| Password reset | From "Forgot password" |
| Your tickets | After every purchase, with ticket numbers and any instant wins |
| Instant win | When a ticket matches an instant-win number |
| Gift code | After a gift card purchase |
| You're a winner | When the draw result is published |
| New & ending soon | Hourly check, to customers who opted in and newsletter subscribers |
| Weekly round-up | Mondays 10:00, the 5 newest competitions |
| Klaviyo journeys | Closing soon (about 24h and 2h before), new launch, order placed, refunds |
How customer data is protected
- All traffic is encrypted; certificates renew automatically.
- Passwords are stored one-way. Nobody can read them, only reset them.
- Every admin function needs an admin login; staff only reach their permitted areas.
- Public pages never show customers' emails, phone numbers or passwords. Winners appear by name and member number.
- Captcha blocks automated sign-ups and password guessing.
Security review · 16 Oct 2026
A full review found and closed several gaps, for example admin actions reachable without an admin login. All fixed and re-tested.
Backups
A full backup was taken before the latest update, and one is taken before every data change. We recommend also turning on Neon's point-in-time restore, so the database can be rolled back to any moment.
Clearing test data, safely
Nothing is deleted or reset until we agree the plan together and a backup has been checked.
Agree
We send the list of test data, and you confirm anything to keep.
Back up
Full backup, test-restored to prove it works.
Reset
Test orders, tickets, draws, winners and customers removed. Member numbers can restart at #1.
Your admins
Named logins on business emails; old shared login disabled.
Go live
Live Stripe keys, one real order end to end, refunded, then open sales.
Your questions, answered
No questions match that search.
Administrators
How many administrator accounts exist?
How do I create, edit, disable or delete administrators?
Can staff have different permissions?
Do I have full Super Admin control?
Customers & membership numbers
How are membership numbers generated?
Can a membership number ever be reused?
Can I edit, suspend or delete customers?
Can membership numbers restart from #1 for launch?
Tickets & draws
Are ticket numbers random?
What if two people buy at exactly the same time?
Does the website choose the winner?
What if a competition doesn't sell out?
Who is left out of the draw?
Can a confirmed winner be changed?
Can anyone buy after entries are locked?
Payments
Where's the Stripe reference for an order?
How do refunds work?
Are tickets cancelled when an order is refunded?
Which currency is charged?
Running the business
Who looks after deployment, development, the database, security and support?
How are updates released?
Is my data backed up?
Twelve choices for you
These came out of testing. Each is a business choice or a small follow-up. We'll send a recommendation for each separately.
Refunds are recorded; the tickets stay in the draw.
Should a refund cancel the tickets and remove them from the draw?
A partial refund is split across the basket's competitions by value.
Fine as is, or should the admin choose the competition?
Only the main prize is drawn in the Draw Console.
Do you live-draw 2nd and 3rd prizes too?
Their eligible tickets stay in the draw.
Should they be excluded?
An instant win is awarded even if the skill answer was wrong.
Should a wrong answer disqualify instant wins too?
The competition page shows 30% at 100 tickets; checkout gives 20% from 50.
Which tiers are right? We'll make both match.
Wallet top-ups are charged in USD.
Switch to GBP like everything else? (Recommended)
The 18+ tick is checked on the form only.
Also enforce and record it on the server?
All staff can see the revenue dashboard.
Limit revenue figures to Admins and Super Admins?
No maximum per customer per competition.
Do you want a per-customer limit?
Information page only; postal entries aren't in the system.
Need admin tools to add postal entries to draws?
Admins can change a customer's email without re-verification.
Notify the customer, or ask them to verify?