1. Information we process
- Guest and account information. A random account identifier is created when you first play. If you choose to save the guest account, we also process the email address you provide and authentication records needed to send a secure sign-in link.
- Game activity. We process your themes, three-card selections, challenges, responses, matchups, votes, results, timestamps, and the random codes used in share links.
- Public game information. A person with a challenge or matchup link can see the information designed for that game. Mirror host picks remain hidden until the other player locks their response. Your email and authentication details are never included in a public game link.
- Reliability and product events. We may process a short list of actions such as creating, sharing, responding, viewing a result, opening a paywall, or seeing the generic recovery screen. These events use fixed categories and do not include public link codes, card IDs, names, emails, report text, or raw exception messages.
- Purchase information. If paid features are offered, Apple and RevenueCat may provide product, entitlement, renewal, and transaction status. Draft Duel does not receive your full payment-card details or Apple Account password.
- Support and safety information. If you contact support or report abuse, we process the message, related game identifiers, and any material you choose to provide.
2. Why we use it
We use this information to create and resolve games, keep Mirror picks sealed until reveal, show vote results, secure and recover accounts, restore eligible purchases, prevent spam and manipulation, investigate reports, answer support requests, and improve reliability.
Draft Duel does not run third-party advertising. We do not sell personal information.
3. Service providers
Draft Duel relies on service providers only where needed to run the product. These currently include Supabase for authentication and hosted game data, Apple for iOS distribution and in-app purchases, and RevenueCat for purchase and entitlement status when billing is enabled. Those providers process information under their own terms and privacy commitments.
We may also disclose limited information when required by law, to protect people or the service, or as part of a business transfer subject to appropriate safeguards.
4. Guest accounts and shared links
A guest session is still an account in the technical sense, but it is not connected to an email unless you choose to save it. Guest access can be tied to one installation; deleting the app, clearing its storage, or changing devices may make that session unrecoverable.
Challenge and matchup links use hard-to-guess codes, but they are not private vaults. Anyone who receives or forwards a link may be able to open it. Do not use a shared game for confidential, sensitive, or identifying information.
New Free challenge links are open for 24 hours, Monthly Plus links for 30 days, and links created or upgraded during a verified paid Annual Club period have no automatic expiry. Existing beta links created before this policy keep their prior behavior. Expiry stops new challenge responses; related results and limited integrity records may remain until deletion under this policy.
5. Retention and deletion
We keep account and game information while it is needed to provide the service, maintain game integrity, resolve disputes, prevent abuse, and meet legal obligations. Privacy-safe product events are automatically removed after 90 days. Self-service deletion of a guest or saved account removes the Supabase Auth user and account-linked profile, games, picks, match relationships, votes, progression, device records, curiosity data, product events, and Draft Duel entitlement mirrors through database ownership rules. Apple and RevenueCat may retain store transaction records under their own requirements.
Deleting Draft Duel does not cancel an App Store subscription. Store subscriptions must be managed separately through Apple.
6. Your choices
You may stay in guest mode, save your account by email, manage each Mirror's optional name permission, manage notification permission in iOS, request access to your data, or request account deletion. An exact three-of-three Mirror response can create a private curiosity alert for the challenge owner. The responder's identity remains hidden unless the responder separately opts in for that Mirror and the owner has active Plus; ordinary game answers never imply that consent. A responder can revoke or change that per-Mirror permission from the result. A separate profile switch remains available only for older responses that used the former account-wide setting.
Guest and saved accounts can use Profile → Privacy & safety → Delete guest data or Delete account and confirm inside the app. See Delete your Draft Duel account for details. For other privacy questions, use the support path described on the Support page.
7. Age and safety
Do not use Draft Duel if you are not legally permitted to use the service where you live. Any feature described as 18+ is unavailable to minors and requires a separate eligibility and consent flow. Draft Duel does not treat ordinary game participation as consent to dating, discovery, or identity reveal.
8. Security and policy changes
We use access controls, encrypted transport, random public identifiers, and database authorization rules to protect the service. No system is perfectly secure, so report suspected misuse through the in-app support path.
We may update this policy as the service changes. The date above will change when we make a material revision, and important changes may also be shown in the app.