Privacy Policy

1. Information We Collect

Personal Data You Provide

When you create an account or use DraftGraders, you voluntarily provide us with certain personally identifiable information, including but not limited to:

• Account information: Email address, display name, and password (stored using industry-standard bcrypt hashing — we never store plain-text passwords)
• Profile information: Optional bio, avatar, and sport preferences
• Draft submissions: Fantasy draft picks, league settings, platform source (Sleeper, ESPN, Yahoo, etc.)
• User-generated content: Ratings, grades, comments, and reviews you post on the platform
• Transaction data: Token purchase history and pro grade request records (payment processing is handled by Stripe — we do not store your credit card number)
• Communications: Messages you send to us via email or the contact form

Data Collected Automatically

When you access the Service, we automatically collect certain information about your device and usage:

• Log data: IP address, browser type and version, operating system, referring/exit pages, date/time stamps, and clickstream data
• Device information: Device type, screen resolution, and unique device identifiers
• Usage data: Pages visited, features used, time spent on pages, search queries, and interaction patterns
• Location data: Approximate geographic location derived from your IP address (we do not collect precise GPS location)

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Service: Operate DraftGraders, process draft submissions, display ratings and leaderboards, and facilitate pro grading
• Account management: Create and manage your account, authenticate your identity, and enable account recovery
• Process transactions: Handle token purchases through Stripe, manage pro grader payouts, and maintain transaction records
• Personalize your experience: Remember your preferences, display relevant content, and tailor the feed to your sport interests
• Improve the Service: Analyze usage patterns, diagnose technical issues, test new features, and optimize performance
• Safety and security: Detect and prevent fraud, abuse, spam, and security threats; enforce rate limits; and maintain platform integrity
• Communications: Send essential account-related notices (password resets, security alerts, ToS updates) — we do not send marketing emails without opt-in consent
• Legal compliance: Comply with applicable laws, regulations, and legal processes

3. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your data only in the following limited circumstances:

• Public content: Your display name, drafts, ratings, comments, and profile information are publicly visible to all users of DraftGraders. This is core to how the platform works — consider this before posting.
• Service providers: We share data with trusted third-party vendors who assist in operating the Service, including:
  • Vercel (hosting and deployment)
  • Neon (PostgreSQL database hosting)
  • Stripe (payment processing)
  • Upstash (rate limiting via Redis)
  • Google (Analytics and AdSense advertising)
  These providers are contractually obligated to use your data only as necessary to provide services to us.
• Legal requirements: We may disclose your information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service:

• Essential cookies: Required for authentication, session management, and security (e.g., keeping you logged in, CSRF protection). These cannot be disabled without breaking core functionality.
• Analytics cookies: We may use Google Analytics to understand how users interact with DraftGraders. Google Analytics uses cookies to collect anonymous usage data. You can opt out using the Google Analytics Opt-out Browser Add-on.
• Advertising cookies: Google AdSense may set cookies to serve personalized ads based on your browsing activity. You can manage ad personalization at Google Ads Settings.
• Local storage: We use browser local storage to remember UI preferences (e.g., feed view mode). This data stays on your device and is not transmitted to our servers.

Most web browsers allow you to control cookies through their settings. Disabling cookies may limit your ability to use certain features of the Service.

5. Data Security

We take the security of your data seriously and implement industry-standard measures to protect it, including:

• All connections encrypted via HTTPS/TLS
• Passwords hashed using bcrypt with appropriate salt rounds
• CSRF (Cross-Site Request Forgery) protection on all state-changing requests
• Rate limiting and account lockout to prevent brute-force attacks
• Input validation and content sanitization to prevent injection attacks
• Strict HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options)
• Database hosted on Neon with encrypted connections (SSL required)

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you the Service. Specifically:

• Account data: Retained until you request deletion
• Draft submissions and ratings: Retained as long as the draft exists on the platform; deleted when the draft or your account is deleted
• Transaction records: Retained for up to 7 years for tax and legal compliance
• Log and usage data: Retained for up to 90 days, then aggregated or deleted
• Security data (IP addresses, rate-limit records): Retained for up to 30 days

7. Your Rights & Choices

Depending on your location, you may have certain rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data (subject to legal retention requirements)
• Portability: Request a machine-readable copy of your data
• Opt-out: Opt out of non-essential cookies and personalized advertising
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at support@draftgraders.com. We will respond to your request within 30 days.

8. California Residents (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the "sale" of your personal information — we do not sell personal information
• The right to non-discrimination for exercising your CCPA rights

To make a CCPA request, email us at support@draftgraders.com with "CCPA Request" in the subject line.

9. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• We process your data based on: (a) your consent, (b) performance of our contract with you (Terms of Service), (c) our legitimate interests (security, fraud prevention, service improvement), or (d) legal obligations
• You have the right to lodge a complaint with your local data protection authority
• You may request restriction of processing or object to processing based on legitimate interests

10. Children's Privacy

DraftGraders is not intended for users under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages. If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information as quickly as possible. If you believe a child has provided us with personal data, please contact us at support@draftgraders.com.

11. Third-Party Links

The Service may contain links to third-party websites or services (e.g., Sleeper, ESPN, Yahoo for draft imports). We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party services you interact with.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and may post a notice on the Service. Your continued use of DraftGraders after any changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@draftgraders.com
• Website: draftgraders.com/contact