Privacy Policy

Introduction

We respect your privacy. This Policy explains what data we collect, why, and how you can manage it.

Data We Collect

• Account information (email, user ID) via our authentication provider
• Usage data (app interactions, game results, device and network information) collected automatically
• Profile data (avatars, display names you provide)
• Payment data (when you opt into paid features; processed by a third-party payment service-we do not store raw payment details)

How We Use Data

• To authenticate and manage your account
• To operate, maintain, and improve the Service
• To process optional payments and billing
• To communicate service updates and support
• To detect and prevent fraud or abuse

Data Storage & Security

• Data is hosted with reputable cloud hosting and database services that employ industry-standard safeguards.
• Images you upload are stored with a secure media delivery service.
• All data in transit is encrypted via TLS/SSL.

Cookies & Tracking

We use cookies and similar technologies to remember preferences, personalize your experience, and analyze usage. You can manage these settings in your browser.

Sharing & Disclosure

We do not sell personal data. We may share data with:

• Service providers acting on our behalf (for hosting, authentication, media storage, payments)
• Legal authorities when required by law or to enforce our policies

Data Retention

We keep your data while your account is active or as needed to provide the Service, and thereafter as required for legal or business purposes.

Account Deletion and Retention

After we verify an account-deletion request, ordinary account access is suspended. You may cancel for seven calendar days. We then aim to complete deletion or irreversible anonymisation of covered account data in active systems within 28 days.

Some payment, tax, fraud-prevention, security, legal, and anonymised competition records may be retained for their stated purpose and period. Your completion receipt lists deleted and anonymised categories, retained exceptions and review dates, processor outcomes, proof-email expiry, and the date by which encrypted backup remnants are put beyond ordinary use and expire, no later than 90 days after completion.

A public request form does not confirm whether an address is registered and does not start deletion until authority is verified. We retain a purpose-limited deletion ledger so that completion can be proved without recreating an account.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict certain processing

To exercise these rights, email privacy@draftxv.com.

Children's Privacy

We do not knowingly collect data from children under the applicable minimum age. If you believe we have, please contact us to delete it.

Policy Updates

We may revise this Policy from time to time. We'll post the new effective date here. Continued use indicates acceptance.

Contact

For privacy inquiries, email privacy@draftxv.com.