Legal
Privacy Policy
Effective August 21, 2026. Last updated August 22, 2026. Draft Depot, contact [email protected]. This policy covers the website, PWA, and any App Store / Play builds of the same product.
What we collect
Identifiers: account email or social login id, display name, a hashed user id. Commercial: membership tier, Bobble Bucks balance, product id, amount, last4, card brand, payment status — never the full card number on live Stripe. Internet activity: pages and feature taps if analytics stay on, crash logs, IP used to run the session and stop abuse. Age: an 18+ checkbox and timestamp, not a birth date. Content you type: lineups, chat, trades, comments. We do not collect government IDs, precise GPS, biometrics, or health data. We do not sell your personal information and we do not “share” it for cross-context behavioral ads as those words are used in the CPRA.
Why
To run your account, score contests, fulfill purchases, send alerts you turned on, fix crashes, keep the product up, detect fraud, and enforce the plan you paid for. Legal bases if you are in the EEA/UK: contract (the account), legitimate interests (security and uptime), and consent (optional analytics). You can refuse analytics in Settings.
Processors
Hosting on Vercel. Database on Neon (or a local preview database). Auth via Better Auth (Google / X / email). Mail via Resend when configured. Payments via Stripe, Apple, or Google — live card data is handled by those processors under PCI rules, not stored as PAN on our servers. Live scores from The Odds API and TheSportsDB — those feeds see our server IP, not your name or email. Optional insight reads use xAI when a key is set; we send the prompt, not your password. Crash reporting may use Firebase Crashlytics on native builds. We do not send your lineups to ESPN or Sleeper. First-party sponsorships: we keep the advertiser’s business name and invoice email so we can bill and take a placement down. Sponsors do not receive your account data.
Cookies
We use a first-party session cookie (or an equivalent token in the preview iframe) to keep you signed in. We do not run third-party advertising cookies, an ad network, or a tracking pixel for ads. Sponsored placements are first-party: the same card is shown to everyone in that slot. You can block cookies in the browser; the app will not stay signed in. We honor a Global Privacy Control signal as an opt-out of sale/share, which is already our default because we do not sell or share.
Retention and security
We keep account data while the account is open. Deleted accounts are purged from live systems within 30 days, except records we must keep for tax, fraud, or App Store / card-network audit (receipts, typically up to 7 years). We use HTTPS, hashed passwords, and access limited to running the product. No method is perfect; you use the app knowing that.
Your rights
Access or delete your Draft Depot data in Settings, or email [email protected]. EEA/UK users may object to analytics and ask for a copy. California residents: we do not sell or share personal info as the CPRA defines those terms. Categories we collect are listed above. We do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising a privacy right. Shine the Light: we do not disclose personal info to third parties for their direct marketing.
Kids
Draft Depot is for adults 18+. It is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If we learn we have it, we delete it. COPPA is not aimed at this product because we do not serve children.
International
Servers may be in the United States. If you use the app from elsewhere, you understand your data is processed in the U.S.
Changes
We may update this policy. The date at the top will change. Material changes will also show in the app. Contact: [email protected].