Privacy Policy

This Privacy Policy explains how Draft Democracy (“we”, “us”), operated by Gordon Fischer LLC (District of Columbia, USA), handles your information when you use the Draft Democracy application and website (the “Service”).

What we collect

Account information from your sign-in provider

We use OAuth sign-in. When you create an account through one of our supported providers (currently Google), we receive your name, email address, and profile image from that provider. We do not receive or store your password. We may add additional providers in the future and will update this list when we do.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

App data you create

We store the content you create or interact with in the Service: leagues, seasons, proposals, votes, comments, and league memberships. This information is associated with your account so the Service can function.

Session and technical data

When you sign in, we record your IP address, user agent (browser and device type), and session timestamps. We use this to keep you signed in, prevent abuse, and debug problems. Each record in the Service is also tagged with creation and update timestamps.

Cookies

We use a small number of cookies: an authentication session cookie, a preference cookie that remembers your light/dark theme choice, and an analytics cookie set by PostHog that recognizes you across visits, as described under “Analytics” below. We do not use advertising cookies, and we do not allow third-party advertising trackers.

We recognize the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, no additional action is required when we receive a GPC signal. We do not allow third-party advertising trackers regardless of any signal.

Analytics

We use PostHog to understand how the Service is used. PostHog records the pages you visit, the referrer that brought you here, actions you take in the app (such as creating a proposal or casting a vote), where on a page people click and how far they scroll, and technical details like your browser, device type, operating system, and approximate location derived from your IP address. It also records errors so we can fix them.

This analytics data is not anonymous. When you are signed in, we send PostHog your account ID, email address, and name, so the activity above is linked to your account rather than to an anonymous visitor. We do this so we can understand real usage patterns and follow up on problems you report. We do not record video-style replays of your screen.

PostHog data is processed by PostHog, Inc. in the United States in accordance with their Privacy Policy. We use it only to operate and improve the Service. We do not use it for advertising, and we do not sell or share it.

Analytics requests from your browser reach PostHog through a subdomain of this site, which is operated on PostHog’s behalf by Cloudflare. Cloudflare therefore handles this traffic in transit, and may do so from data centers in more than one country. It does not receive your sign-in session, and it is not given access to the analytics data for its own purposes.

How we use your data

• To run the Service: authentication, leagues, voting, comments.
• To prevent abuse and keep accounts secure.
• To debug problems and improve features.
• To provide aggregated insights about how the Service is used and to highlight popular content.
• To respond to support, privacy, or legal requests you send to us.

We do not use your data for advertising today, and we do not sell your data. We have no current plans to do either. If our practices ever change in this regard, we will update this Privacy Policy and notify active users with a reasonable opportunity to opt out or delete their account before the change takes effect.

Who we share data with

We share data only with the service providers we need to run the Service, including:

• Our hosting provider, which serves the application.
• Our database provider, which stores your account and app data.
• The OAuth provider you choose to sign in with (currently Google).
• PostHog, our analytics provider, which receives the usage data and account details described above.
• Cloudflare, which carries analytics traffic from your browser to PostHog.

We may also disclose data when we are required to by law — for example, in response to a valid subpoena or other lawful request. We do not share data with marketing partners or data brokers.

We have not sold or shared personal information with third parties for advertising or commercial purposes in the past 12 months. As described in “How we use your data” above, we have no current plans to do so, and we will provide advance notice and an opt-out path before any material change.

Where your data is stored

Draft Democracy is operated from the United States and your data is processed and stored there. We are not specifically targeting users outside the United States, but if you sign up from another country your data will be processed in the U.S. We extend the core privacy rights described below — access, correction, deletion, and export — to all users regardless of where they live.

Legal basis for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, the legal bases on which we rely to process your personal data under the GDPR and UK GDPR are:

• Performance of a contract — for the data we need to operate your account and provide the Service to you.
• Legitimate interests — in protecting the Service from abuse, securing accounts, debugging, and improving features. We balance these interests against your rights and freedoms before relying on this basis.
• Consent — where we ask for it, such as before introducing new categories of data collection. You can withdraw consent at any time.
• Legal obligation — when we respond to lawful requests or comply with applicable law.

Children

Draft Democracy is intended for users 13 years of age and older. We do not knowingly collect information from children under 13. If we learn that an account belongs to someone under 13, we will delete the account and its data.

Your rights

You can ask us to access, correct, export, or delete the personal data associated with your account. To exercise any of these rights, email privacy@draftdemocracy.com.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

If we decline a request you make under applicable state privacy law, you may appeal that decision by emailing privacy@draftdemocracy.com. We will respond in writing within a reasonable time.

Account deletion

You can delete your account at any time from your account Settings. If you have trouble, email privacy@draftdemocracy.com from the address on your account.

When you delete your account:

• Your login credentials, sessions, and league memberships are permanently deleted from our active database, and your profile (name, email, and avatar) is irreversibly anonymized.
• Your proposals and comments remain in the leagues you participated in so the league record stays intact, but they are shown as [Deleted] and can no longer be traced to you; comment text is cleared. Votes you cast in seasons that have finished voting are kept as anonymous historical record, while votes in seasons still open are removed.
• Any feedback you submitted and the votes you cast on the feedback board are kept as an anonymous product record, shown as [Deleted] and no longer traceable to you; the text of your feedback comments is cleared.
• If you admin a league with other active members, you must transfer ownership to another member before we delete your account. If you are the only member of a league, we will delete the league along with your account.
• Your usage history in PostHog, our analytics provider, is not deleted automatically. If you want it removed as well, email privacy@draftdemocracy.com and we will delete it.
• Your data may persist for a short time in encrypted backup snapshots used for disaster recovery. We do not access or restore from those backups except to recover from a system failure, and the data ages out as backups rotate.

Retention

We keep your account data for as long as your account is active. When you delete your account, we remove it from our active database immediately as described above; encrypted backup copies age out as backups rotate. We do not retain copies of deleted account data for marketing, and analytics history is deleted on request as described above.

Security

We use standard security practices: encryption in transit (HTTPS), authentication tokens issued by reputable OAuth providers, and scoped database access. No system is 100% secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If a change materially affects how we use your data, we will make a reasonable effort to notify active users.

Contact

Questions about this policy or your data? Email privacy@draftdemocracy.com. You can also review our Terms of Service.