Draft DuelBack to Draft Duel
Privacy

Your picks are for play—not for sale.

This policy explains what Draft Duel processes when you create a three-pick challenge, respond to a friend, vote, save an account, or use a Plus feature.

Last updated September 23, 2026

1. Information we process

  • Guest and account information. A random account identifier is created when you first play. If you choose to save the guest account, we also process the email address you provide and authentication records needed to send a secure sign-in link.
  • Game activity. We process your themes, three-card selections, challenges, responses, matchups, votes, results, timestamps, and the random codes used in share links.
  • Public game information. A person with a challenge or matchup link can see the information designed for that game. Mirror host picks remain hidden until the other player locks their response. Your email and authentication details are never included in a public game link.
  • Reliability and product events. We may process a short list of actions such as creating, sharing, responding, viewing a result, opening a paywall, or seeing the generic recovery screen. These events use fixed categories and do not include public link codes, card IDs, names, emails, report text, or raw exception messages.
  • Optional website analytics. If you allow analytics, Mixpanel receives selected action categories, a random browser identifier, event timestamps, and campaign labels such as the source and campaign name. We do not send your picks, names, email, private link codes, full URLs, or advertising click IDs. We disable session recording, automatic click capture, and IP-based geolocation.
  • Optional iPhone product analytics. If you separately enable Product analytics in the app, Mixpanel receives selected action categories, fixed non-sensitive context such as app version and screen category, and SDK technical metadata such as device and operating-system type. It uses a random installation identifier for guest play; if you save or sign in to an account, it may associate subsequent events with your Draft Duel account ID. We do not send card picks, names, email, messages, private link codes, or raw URLs. Automatic event capture, session recording, and IP-based geolocation are disabled.
  • Optional iPhone ad measurement. In versions that offer Ad measurement, enabling it and allowing Apple's tracking permission lets Meta receive device identifiers, app installation and activation information, and selected actions such as creating a challenge, responding, viewing a result, finishing the Daily Draft, opening Plus, or starting checkout. Meta's SDK also processes technical information such as the device, operating system, and network address. When the subscription integration is enabled, RevenueCat sends trial and subscription events to Meta using advertising attribution identifiers. We do not include your card selections, names, email, messages, or private challenge links in the events we send.
  • Apple install attribution (SKAdNetwork). If you installed Draft Duel from an ad, iOS may tell the ad network, through Apple's SKAdNetwork, that the ad led to an install, together with a coarse number describing how far you got in your first days (for example finishing the Daily Draft, creating a challenge, or starting a trial). Apple sends this without any device identifier, account, or timing that identifies you, so it does not track you and does not need the tracking permission.
  • Purchase information. If paid features are offered, Apple and RevenueCat may provide product, entitlement, renewal, and transaction status. Draft Duel does not receive your full payment-card details or Apple Account password.
  • Support and safety information. If you contact support or report abuse, we process the message, related game identifiers, and any material you choose to provide.

2. Why we use it

We use this information to create and resolve games, keep Mirror picks sealed until reveal, show vote results, secure and recover accounts, restore eligible purchases, prevent spam and manipulation, investigate reports, answer support requests, and improve reliability.

Draft Duel does not display third-party ads inside the app. With your permission, we use optional ad measurement to understand and improve advertising for Draft Duel on Meta. We do not use your game choices for ad targeting.

3. Service providers

Draft Duel relies on service providers only where needed to run the product. These currently include Supabase for authentication and hosted game data, Apple for iOS distribution and in-app purchases, RevenueCat for purchase and entitlement status when billing is enabled, and Mixpanel for optional website and iPhone product analytics using its EU data region. Those providers process information under their own terms and privacy commitments.

If you enable iPhone ad measurement, Meta also processes advertising measurement information under its Privacy Policy. Meta may match that information with information from its services to measure and improve advertising. This choice is separate from optional website analytics.

We may also disclose limited information when required by law, to protect people or the service, or as part of a business transfer subject to appropriate safeguards.

4. Guest accounts and shared links

A guest session is still an account in the technical sense, but it is not connected to an email unless you choose to save it. Guest access can be tied to one installation; deleting the app, clearing its storage, or changing devices may make that session unrecoverable.

Challenge and matchup links use hard-to-guess codes, but they are not private vaults. Anyone who receives or forwards a link may be able to open it. Do not use a shared game for confidential, sensitive, or identifying information.

New Free challenge links are open for 24 hours, Monthly Plus links for 30 days, and links created or upgraded during a verified paid Annual Club period have no automatic expiry. Existing beta links created before this policy keep their prior behavior. Expiry stops new challenge responses; related results and limited integrity records may remain until deletion under this policy.

5. Retention and deletion

We keep account and game information while it is needed to provide the service, maintain game integrity, resolve disputes, prevent abuse, and meet legal obligations. Product events in our own game database are automatically removed after 90 days. Self-service deletion of a guest or saved account removes the Supabase Auth user and account-linked profile, games, picks, match relationships, votes, progression, device records, curiosity data, product events, and Draft Duel entitlement mirrors through database ownership rules. Apple and RevenueCat may retain store transaction records under their own requirements.

Optional website events are separate from your game account and follow Mixpanel's two-year event retention period. The browser identifier cookie has a 90-day lifetime, and your analytics preference is remembered for up to 180 days. Turning analytics off stops future collection and clears the analytics identifier; it does not erase events already received. To request access or deletion of past website analytics, copy your analytics ID from Analytics settings before turning it off and send it to our support address. See Mixpanel's retention and deletion information.

Optional iPhone product analytics follows the same Mixpanel project retention period. Turning it off stops future collection and clears its local identifier and queued events; it does not erase events already received. Before turning it off, you can copy the analytics ID from Profile → Privacy & safety and send it to support for an access or deletion request. If you used a saved account, include that in your request so we can locate any account-linked analytics events.

Deleting Draft Duel does not cancel an App Store subscription. Store subscriptions must be managed separately through Apple.

Turning off Ad measurement stops new app measurement events and requests removal of the attribution identifiers used by our RevenueCat integration. An internet connection is needed for that change to reach RevenueCat. It does not retract information already received by Meta or RevenueCat; contact us for help with a deletion request.

6. Your choices

Website analytics stays off until you choose Allow analytics. You can choose No thanks and continue playing, or change your choice using Analytics settings on the website. We do not send earlier actions when you enable analytics later.

iPhone product analytics stays off until you enable Profile → Privacy & safety → Product analytics. This choice is separate from iPhone ad measurement and Apple's tracking permission. Turning it on does not replay earlier actions, and turning it off does not affect gameplay, purchases, or Plus.

iPhone ad measurement stays off unless you choose Continue on the in-app measurement card (or enable Profile → Privacy & safety → Ad measurement) and then allow Apple's tracking permission. You can switch it off in Profile or revoke tracking permission in iPhone Settings. Declining does not affect gameplay, purchases, or restoring Plus. We do not replay game actions that happened while measurement was off.

You may stay in guest mode, save your account by email, manage each Mirror's optional name permission, manage notification permission in iOS, request access to your data, or request account deletion. An exact three-of-three Mirror response can create a private curiosity alert for the challenge owner. The responder's identity remains hidden unless the responder separately opts in for that Mirror and the owner has active Plus; ordinary game answers never imply that consent. A responder can revoke or change that per-Mirror permission from the result. A separate profile switch remains available only for older responses that used the former account-wide setting.

Guest and saved accounts can use Profile → Privacy & safety → Delete guest data or Delete account and confirm inside the app. See Delete your Draft Duel account for details. For other privacy questions, use the support path described on the Support page.

7. Age and safety

Do not use Draft Duel if you are not legally permitted to use the service where you live. Any feature described as 18+ is unavailable to minors and requires a separate eligibility and consent flow. Draft Duel does not treat ordinary game participation as consent to dating, discovery, or identity reveal.

8. Security and policy changes

We use access controls, encrypted transport, random public identifiers, and database authorization rules to protect the service. No system is perfectly secure, so report suspected misuse through the in-app support path.

We may update this policy as the service changes. The date above will change when we make a material revision, and important changes may also be shown in the app.