What we collect, and why.

Most Draftanomics pages are public, but saved and account features keep the data needed to work. We store:

• Email address, when you subscribe to the weekly email or create an account on /signup. We also keep subscription source and dates, account dates, a salted Argon2id password verifier, and short-lived hashed email-link records needed to prevent replay. Raw passwords and raw sign-in tokens are not stored.
• An anonymous browser ID, set as an HttpOnly cookie named draftiq_uid. It owns anonymous saved features, including Franchise leagues, without putting your email in those rows. A successful account sign-in links that browser ID to your email and moves eligible saves into one account owner. Cross-device recovery is available only where the product explicitly reports that its deployed recovery path is verified. If you clear cookies before signing in, we cannot prove that a later browser owns those saves.
• Your saved draft-tool state, such as watchlists, notes, and My Board rows. Some views also use browser localStorage. Server sync is used when the feature says it is saved or available across devices. A shared-board URL contains the player IDs you choose to share.
• Your Franchise Mode state: fictional league setup, team choice, roster and contract decisions, simulated results, event ledger, save timestamps, integrity fingerprints, automatic checkpoints, and recoverable archived leagues. These are stored on our server under the anonymous or signed-in owner described above. Public portable import/export is disabled for this launch.
• Operational request and security records, including IP address, user-agent, requested path, status, request ID, and rate-limit events. We use them to run the service, investigate failures, and stop abuse. Authentication tokens and other sensitive query values are redacted from application access logs.

• No cross-site social trackers. No Meta Pixel, no TikTok pixel, no Google Analytics.
• No email or anonymous uid shared with any advertiser or affiliate.
• No data sale to anyone, ever.
• No personal identifiers we did not list above. We do not ask for your name, address, phone number, age, or location.
• No biometric, behavioral, or device-fingerprint profiles for ad-tech purposes.

The infrastructure Draftanomics runs on:

• Render hosts the API and database. They receive standard request metadata (IP, headers) and store the application database and rights-scoped local recovery artifacts in the Ohio region.
• Amazon Web Services (AWS S3) is an approved optional provider for an encrypted, versioned Franchise-only disaster-recovery copy in the Oregon (us-west-2) region. We do not describe that copy as active until an upload and isolated restore are verified. When active, it is limited to the fictional opening universe, owner-bound league saves, bounded revisions/checkpoints, integrity metadata, and the pseudonymous owner ID needed to restore access. It does not include account emails, authentication records, profiles, or Draftanomics analytics tables.
• Vercel hosts the web frontend and provides aggregate page-view counts (Vercel Analytics). It is cookieless and records no personal identifiers — page, referrer, country, device class. We cannot tie a view to you.
• Google AdSense serves the display ads that keep the site free. Google and its ad partners set their own cookies and may use them to personalise ads, and this is a use we do not control. You can turn personalised advertising off for your Google account at My Ad Center — the ads become non-personalised, not absent. We never send Google your email, your anonymous uid, or your board.
• Resend delivers our emails — account verification, recovery links, and the writing you subscribed to. They process the recipient address, message content, and delivery metadata in order to send it.
• Sentry may receive error reports when the site throws an unhandled exception. Reports may include stack traces, request path and ID, browser details, and sampled performance traces. Default PII and request-body capture are disabled, and authentication secrets are scrubbed before an event is sent.
• Affiliate partners (fantasy platforms, dynasty tools). Some outbound links on the site are affiliate/referral links. If you follow one and sign up, that platform knows you arrived from us (a standard referral tag) — but we never send them your email, your anonymous uid, or your activity on Draftanomics, and we do not embed their tracking scripts on our pages. We do not partner with any sportsbook.

• Email and account records: until you unsubscribe or ask us to delete the account data we control.
• Anonymous browser ID: the signed cookie is issued with a one-year expiry; your browser settings may remove it sooner.
• Franchise saves: active and recoverable archived leagues remain server-held until you ask us to permanently delete them. Archive in the game is reversible soft deletion, not erasure.
• Checkpoints and backups: bounded checkpoints support in-product recovery. A permanent deletion removes live rows. If the optional AWS recovery copy is active, its objects use immutable COMPLIANCE retention for at least 90 days; lifecycle rules expire current versions after 120 days and noncurrent versions 120 days after replacement, so a particular version can remain for roughly 240 days before controlled expiry.
• Operational logs and Sentry: retained only for operational, security, and debugging needs under the hosting service's configured retention.

Email privacy@draftanomics.com from the address you signed up with. We will verify the request and:

• Send you the data we have associated with your email.
• Delete it from live systems if you ask, and tell you how rolling backup expiry applies.
• Unsubscribe you from any future emails.

If you are a California or EU resident, this is your CCPA / GDPR data request channel. We do not require you to buy anything or fill out a marketing form.

Draftanomics is for users aged 13 and over. We do not knowingly collect data from children under 13. If you believe we have, email us and we will delete it immediately.

If we change what we collect, we will update this page and bump the Last updated date below. Material changes will be announced on the homepage and emailed to subscribers.