Privacy

Who we are

Draftastic is run by Alex Bristow, an independent developer in the UK. He decides what is kept and why. If you have a question about your information, email hello@draftastic.co.

What we keep, and why

• Your name in a draft, so the organiser and the others in it can see who is on which team.
• What a host remembers about you. If a draft has a host (a club, a school or a group), the host keeps the name you joined with and the device or account you joined with, so it can say “You’re back” next time. If an organiser types your name into a list instead, the host keeps that name too, with no device, so the organiser can add you again; it never says “You’re back” for it. It also counts the nights you played and won, and your best finish, so your own badge can show them. The organiser can see this, and so can any organiser the host’s owner has added, who see what the owner sees. Nobody else can. If the host has ever run a draft for children, it keeps only first names and the device, and counts nothing. When the organiser removes you, the host stops recognising you at once and forgets you 30 days later. It is all deleted when the host is deleted, or when you ask us to.
• Your answers to the draft’s questions, such as a position or a skill, so teams can be made fairly. The organiser chooses who can see each answer.
• Your email address, only if you give it: to sign in, or to get reminders about a draft. Every reminder has a link to stop them.
• An address for alerts, only if you turn alerts on on your phone. Your phone’s browser gives us an address to send it alerts for this draft only, such as “You’re on now”. Its own push service (Apple’s, Google’s or Mozilla’s) carries each alert, encrypted so only your phone can read it. The address is deleted when you turn alerts off, leave the draft or move to another phone, and 30 days after the draft ends. A draft for children has no alerts unless the organiser turns them on.
• Team chat, if the organiser turns it on. Organisers can read every team’s chat.
• A cookie that keeps you signed in, and one that remembers if you chose larger text. We use no advertising or tracking cookies.
• Short technical logs, to find and fix faults. They hold no names or email addresses.
• A count of page visits, so we know which pages help people. It uses no cookies, and records the kind of page, never your name, your draft or its code.

Drafts for children

A draft an organiser sets up for children is private by default, as the ICO’s Children’s Code asks:

• only first names are kept and shown
• there is no chat, and no reactions
• answers are seen only by the organiser
• joining needs the draft’s code, as well as the link
• children’s names, pasted lists and messages are never sent to the AI service
• no account, email address or sign-in is asked of a child

AI

Draftastic uses AI in four places. Each sends only what it needs to an AI service (Vercel AI Gateway):

• Making teams from a description. If an organiser asks for it, the request and the draft’s answers are sent to work out the teams.
• Reading a pasted list. If an organiser asks for it, the lines of the list are sent, with email addresses and phone numbers taken out, so the names can be told from the headings and notes.
• Checking names and chat messages. When someone joins or changes their name, the name is sent on its own, and a chat message on its own when it is posted, to check it is not offensive, hateful or sexual. No draft and no other names go with it. If the check is sure, the name or message is turned down. If it is not sure, a name is let in and the organiser sees a marker by it, which they can clear. If the check cannot run, nothing is held up.
• Suggesting questions and team names. If an organiser asks for it, the sentence or the draft name they typed is sent. No people.

Some of these checks use small, fast AI models from TypeSafe or OpenAI that answer with a choice or a number, not text. In drafts for children, people are sent as numbers, never names, and a pasted list, a name or a chat message is never sent. In other drafts, names may be sent so a request makes sense. Email addresses are never sent. Every request asks the Gateway to use only AI providers that never train on what they are sent. The provider may keep a request for a short time under its own terms, for example up to 30 days to check for misuse, and then deletes it. If there is no such provider, the Gateway refuses the request and Draftastic carries on without AI.

Who else handles it

We use these services to run Draftastic. Each one only sees what it needs:

• Cloudflare, to host the site
• Supabase, to store drafts
• Resend, to send emails
• Cloudflare, for limits on misuse and crest images organisers upload, and to send emails when we use it instead of Resend
• Railway, for live updates: names and chat pass through it
• Upstash, for timers
• Uploadthing, for crest images organisers upload
• Vercel AI Gateway, only when an organiser uses AI

Some of these store information in the United States. Where they do, they are bound by the safeguards UK law asks for.

How long we keep it

• A draft nobody saves to an account is closed and hidden 30 days after it was last used. Ask us and we will delete it for good.
• Deleted questions and their answers are gone for good after 30 days.
• Reminders stop when the draft starts, and your address is no longer used for them.
• Anything else, until the organiser deletes the draft or you ask us to.

Your rights

You can ask to see the information we hold about you, to correct it, or to delete it, by emailing hello@draftastic.co. We reply within a month. If you are not happy with our answer, you can complain to the Information Commissioner’s Office (ico.org.uk).