Draft CapitalPrivacy Policy
Draft: this policy is awaiting legal review and may change before Draft Capital is released.
Draft Capital is a free player stock market game for NBA fans, played with virtual cash only. There’s no real money, nothing to buy and no prizes. This policy explains what the Draft Capital iOS app and its servers collect, why, who helps us process it, how long we keep it, and how you can delete it.
The short version. We collect what we need to run your account and the game: your email address, an account ID, the name you choose, your game activity and, if you allow notifications, a push token. We count which days you use the app to understand how the beta is going. We don’t track you across other apps or websites, show ads, or sell or share your data. You can delete your account in the app at any time.
Who we are
Draft Capital is operated by Quinn Lonergan, an individual based in the United States (“we”, “us”). We plan to move the app to a company we own; we’ll update this policy when that happens. Contact: support@draftcapital.app.
What we collect and why
| Data | Why we use it |
|---|---|
| Email address. If you use Sign in with Apple and choose Hide My Email, this is Apple’s relay address. | To sign you in (we email you a one-time code) and to tell your accounts apart. It’s held by our sign-in provider; we don’t email you marketing. |
| Account IDs: the ID our sign-in provider gives your account, and our own ID for you. | To link your sign-in to your portfolio. |
| Handle and optional display name that you choose. | To show you on the leaderboards. These are public to other players (see below). |
| Game activity: your portfolio, trades, watchlist, alert settings and the alerts in your Activity feed. | To run the game: your holdings, your score and your alerts. |
| Push token (a device ID Apple issues for notifications), if you allow notifications, and whether it belongs to a development or a store build. | To send the alerts you’ve turned on, such as a price posting or one of your players being ruled out. |
| Activity days: for each day you use the app, which of these happened: you used it at all, during a game night, opened a morning price recap, viewed a leaderboard. We keep a daily count, not a log of each action. | To measure how the beta is going (weekly active players, return rates, retention). It’s only used in totals and isn’t shared. |
| Apple sign-in token, if you use Sign in with Apple. It’s stored encrypted. | Only so we can revoke it at Apple when you delete your account. |
| Server logs: IP address, the request, the time and the response. | To keep the service running and secure, and to fix problems. |
In Apple’s privacy terms, the app collects Email Address, User ID, Device ID and Product Interaction. All of it is linked to your account, and none of it is used for tracking.
What we don’t collect
- No payment details: the app has no purchases.
- No location, contacts, photos, microphone or camera.
- No advertising identifier, and no third-party analytics, advertising or tracking code in the app.
- Your real name only if you put it in your display name. With Sign in with Apple we ask Apple for your email address only, not your name.
What other players can see
Your handle, your display name (if you set one), your rank and your score (your portfolio’s return) appear on the public leaderboards. A portfolio that held no players during a week isn’t listed for that week. Your email address, cash, holdings and trades aren’t shown to other players.
Who processes your data for us
We use these service providers to run Draft Capital. They process data on our behalf, only to provide their service to us.
| Provider | What it does | Data involved |
|---|---|---|
| Supabase | Sign-in and accounts | Email address, account ID, sign-in records (including IP address) |
| Resend | Sends the sign-in code emails | Email address and the code email |
| Neon | Hosts our database | Everything in the table above except your email address |
| Render | Runs our servers | The same, plus server logs |
| Backblaze | Stores encrypted database backups | The same as Neon, encrypted before upload |
| Apple | Sign in with Apple, and delivering push notifications | Your Apple sign-in; your push token and the alert text |
| Cloudflare | Serves this website | Requests to this site, including IP address |
Player statistics and injury news come from BALLDONTLIE, a sports data provider. We only fetch data from them; none of your personal data is sent to them. Our servers and providers are in the United States.
No tracking, no ads, no selling
We don’t track you across other companies’ apps or websites, we don’t show ads, and we don’t sell or rent your personal data or share it for advertising. We disclose data only to the providers above, or if the law requires it.
How long we keep it
- Account and game data (including activity days and your watchlist): until you delete your account.
- Alerts in your Activity feed: 90 days.
- Push tokens: until you delete your account, or sooner when Apple tells us a token is no longer valid.
- Server logs: for as long as our hosting provider’s log retention, usually days to a few weeks.
- Backups: deleted data can remain in database backups for up to 30 days, until they’re overwritten.
- After you delete your account: your trades stay in the market’s records with no name attached, because other players’ results and the market’s accounting depend on them. We also keep a record that the account was deleted (our internal ID for it and your old sign-in ID, but not your handle), so a sign-in issued before the deletion can’t recreate the account, and so we can show the deletion was done.
Deleting your account
In the app, go to Settings → Delete account. Deleting your account:
- removes your handle and display name, and takes you off every leaderboard;
- deletes your alerts, alert settings, watchlist, push tokens and activity days;
- deletes your sign-in (your email address at our sign-in provider);
- if you used Sign in with Apple, revokes Draft Capital’s access at Apple and deletes the stored token.
It can’t be undone. If you can’t get into the app, email support@draftcapital.app from the address you sign in with and we’ll delete the account for you.
Your choices and rights
- Notifications: turn alerts off in the app’s Settings or in iOS Settings.
- Access, correction (including your handle or display name), a copy or deletion: email us. We’ll answer within 30 days, and we may need to confirm the request comes from your account’s email address.
Depending on where you live (for example California, the EU or the UK), you may have further rights under the law, including the right to object to some uses or to complain to a data protection authority. We process your data to provide the service you asked for and, for the beta measurements and security logs, for our legitimate interest in running and improving it.
Children
Draft Capital isn’t meant for children. You must be at least 13 to use it. We don’t knowingly collect personal data from children under 13; if you believe a child has given us their data, email us and we’ll delete it.
Security
Data is encrypted in transit (HTTPS). Apple sign-in tokens are encrypted in our database, and backups are encrypted before they leave our database provider. Access to production systems is limited to the operator. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects it, as the law requires.
This website
draftcapital.app sets no cookies and runs no analytics or ads. Cloudflare, which serves it, processes your IP address and request to deliver the pages and protect the site.
Changes
If we change this policy, we’ll update it here and change the date at the top. If a change materially affects how we use your data, we’ll also tell you in the app.
Contact
Questions or requests: support@draftcapital.app.