Privacy Policy

Introduction

We respect your privacy. This Policy explains what data we collect, why, and how you can manage it.

Data We Collect

• Account information (email, user ID) via our authentication provider
• Usage data (app interactions, game results, device and network information) collected automatically
• Profile data (avatars, display names you provide)
• Payment data (when you opt into paid features; processed by a third-party payment service-we do not store raw payment details)

How We Use Data

• To authenticate and manage your account
• To operate, maintain, and improve the Service
• To process optional payments and billing
• To communicate service updates and support
• To detect and prevent fraud or abuse

Data Storage & Security

• Data is hosted with reputable cloud hosting and database services that employ industry-standard safeguards.
• Images you upload are stored with a secure media delivery service.
• All data in transit is encrypted via TLS/SSL.

Cookies & Tracking

Essential storage keeps the Service signed in and remembers settings needed for the product to work. Optional analytics are off until you choose Accept in our privacy control. Essential launch and maintenance controls may be evaluated through PostHog without analytics consent, using your account identifier and email only to decide access; those checks do not record analytics events or session replay.

If you accept, we use PostHog to understand product and landing-page usage and to improve DraftXV. PostHog may use browser storage for a persistent analytics identity. We may also use privacy-masked session replay: form inputs and all rendered text are masked, invite links are blocked, and replay is never started before acceptance. We do not intentionally send invite codes, raw error details, private messages, player or team names, or full page query strings as analytics properties.

If advertising is configured, accepting also permits the Google AdSense script to load on pages where ads may be shown. It is not loaded before acceptance or after rejection.

A same-browser campaign context may be kept for up to 30 days after acceptance. Reference-only server delivery records for league-funnel milestones are normally retained for up to 90 days; processed queue references are normally removed after seven days. PostHog analytics follow the retention settings configured for DraftXV. Consent and audit records may be retained while needed to operate your preference and demonstrate the choice you made.

You can withdraw analytics consent at any time by choosing Privacy choices in the site footer and selecting Reject. This stops future optional capture, session replay, and identification on that browser, and records a revocation for authenticated server analytics. Withdrawal does not automatically delete analytics already recorded; you can contact us about the rights listed below.

Marketing and league-funnel reports cover only people who opted in to analytics. We label them as “analytics-consented traffic” and do not treat those reports as measurements of every visitor or player.

Sharing & Disclosure

We do not sell personal data. We may share data with:

• Service providers acting on our behalf (for hosting, authentication, media storage, payments)
• Legal authorities when required by law or to enforce our policies

Data Retention

We keep your data while your account is active or as needed to provide the Service, and thereafter as required for legal or business purposes.

Account Deletion and Retention

After we verify an account-deletion request, ordinary account access is suspended. You may cancel for seven calendar days. We then aim to complete deletion or irreversible anonymisation of covered account data in active systems within 28 days.

Some payment, tax, fraud-prevention, security, legal, and anonymised competition records may be retained for their stated purpose and period. Your completion receipt lists deleted and anonymised categories, retained exceptions and review dates, processor outcomes, proof-email expiry, and the date by which encrypted backup remnants are put beyond ordinary use and expire, no later than 90 days after completion.

A public request form does not confirm whether an address is registered and does not start deletion until authority is verified. We retain a purpose-limited deletion ledger so that completion can be proved without recreating an account.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict certain processing

To exercise these rights, email privacy@draftxv.com.

Children's Privacy

We do not knowingly collect data from children under the applicable minimum age. If you believe we have, please contact us to delete it.

Policy Updates

We may revise this Policy from time to time. We'll post the new effective date here. Continued use indicates acceptance.

Contact

For privacy inquiries, email privacy@draftxv.com.