Policies

DrawDown — Privacy Policy

Version 1.1

Version 1.1 — Effective [DATE OF PUBLICATION]

⚠️ DRAFT NOTICE (remove before public launch): This is a version 1 draft written in plain language and has not been reviewed by an attorney. It reflects how DrawDown is designed to handle data, but you should obtain professional review before meaningful traction, especially for GDPR/CCPA specifics. DrawDown LLC is in formation; update entity details once registered. Sections needing professional review are flagged [ATTORNEY REVIEW].

1. Introduction

This Privacy Policy explains what information DrawDown ("we," "us," "our") collects, why we collect it, how we use and protect it, and the choices you have. DrawDown is operated by DrawDown LLC (in formation) and is available at playdrawdown.com.

We designed DrawDown to collect as little personal information as reasonably possible. We do not sell your data, and we do not use advertising trackers.

2. Information we collect

Account and identity information. You sign in with Discord. Through that sign-in we receive your Discord account identifier and your verified email address. You also choose a username and provide a display name.

Date of birth. We ask for your date of birth solely to verify you meet our minimum age (13) and to record whether you are an adult (18+) for age-gated features. We use it for age-gating; we do not use it for marketing or profiling.

Content you create. Characters, artwork and images, descriptions, comments, reports, and other material you submit.

Uploaded image handling. When you upload an image, we deliberately strip location and other embedded metadata (EXIF) during processing. We do this on purpose so that, for example, GPS coordinates that phones embed in photos are discarded and never stored or shown. This is a safety measure, especially important because some of our users are minors.

Usage and technical information. We record basic application events (for example, that a signup happened, that a first character was created, that an attack was submitted) to understand how the platform is used. We use a self-hosted, cookieless analytics tool (Umami) for aggregate traffic statistics. We also process limited technical data such as IP-derived information for rate-limiting and abuse prevention.

Communications. If you contact support or file reports, we keep those communications to handle your request.

3. What we do NOT collect or do

  • We do not store passwords, because we use Discord sign-in (there is no password for us to hold).
  • We do not sell or rent your personal information.
  • We do not use third-party advertising or cross-site tracking.
  • We do not retain location metadata from your uploaded images.

4. How we use your information

We use the information above to: create and manage your account; operate gameplay (events, teams, attacks, scoring, leaderboards); display your content to other users; run anti-cheat and moderation; enforce our Terms and Community Rules; provide support; send you necessary service messages; measure and improve the platform in aggregate; and comply with legal obligations.

5. Marketing email (optional, opt-in)

We will only send you marketing or promotional email (news, event announcements, and similar) if you specifically opt in by checking the marketing box, which is unchecked by default. You can withdraw this consent at any time via your settings or an unsubscribe link. This is separate from transactional messages (such as waitlist confirmations, account-deletion confirmations, and notifications about events you are part of), which are part of operating the Service.

6. Cookies

We use cookies only for what's necessary to run the Service — primarily to keep you signed in (session authentication). Our analytics (Umami) is cookieless, which is why you won't see a cookie-consent banner for analytics tracking. [ATTORNEY REVIEW — confirm cookie/consent obligations for your target regions.]

7. How we share information

We share information only as needed to run the Service:

  • Publicly, by design: your username, display name, characters, artwork, comments, and event participation are visible to other users — that's the nature of the platform.
  • Service providers: we use third parties to host and operate DrawDown, including our server host, Cloudflare (content delivery, security, image handling, and object storage), an email provider (Resend) for transactional and opted-in email, and Discord for authentication and community notifications. These providers process data on our behalf.
  • Legal reasons: we may disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of DrawDown, our users, or the public.

We do not otherwise share your personal information.

8. Your rights and choices

You can:

  • Access and update your account information in settings.
  • Delete your account yourself at any time (see Section 9).
  • Withdraw marketing consent at any time.
  • Request a copy of your personal data, or ask questions about our handling of it, by emailing [email protected].

[ATTORNEY REVIEW] Depending on where you live (for example, the EU/UK under GDPR, or California under CCPA/CPRA), you may have additional rights, such as the right to access, correct, delete, port, or restrict processing of your personal data, and the right to lodge a complaint with a supervisory authority. We honor these rights via your settings and the privacy contact email.

9. Account deletion and data retention

You can delete your account at any time from your settings. When you request deletion:

  • Your account enters a 30-day grace period. If you log back in during this window, you'll be asked to explicitly choose whether to reactivate your account or continue with deletion — logging in does not by itself cancel the deletion. This protects against both accidental or impulsive deletion and unwanted, non-consensual reactivation.
  • After the grace period, we permanently delete your personal information. Some content may remain in anonymized form — for example, a comment thread may continue to show that a "deleted user" participated — so that other users' interactions and conversations are not broken.
  • We keep certain records where necessary — for example, our internal moderation audit log records that an action occurred and to which account identifier, but it does not store your personal details (such as your email or date of birth). This lets us keep an integrity record of moderation without retaining your personal data after deletion.
  • Backups: residual copies may persist in routine backups for a limited rotation period before being overwritten.

Underage accounts: if we learn a user is under 13, we suspend the account immediately and delete the associated personal information, consistent with our minimum-age requirement.

10. Data security

We take reasonable measures to protect your information, including encrypted connections, restricted access, stripping location metadata from images, and standard security practices. No system is perfectly secure, but we work to protect your data and to respond appropriately if an incident occurs.

11. Children

DrawDown is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, contact [email protected] and we will address it.

12. International users

[ATTORNEY REVIEW] DrawDown may be operated from and store data in the United States. If you access the Service from outside the U.S., you understand your information may be processed in the U.S. and other locations with different data-protection laws.

13. Changes to this policy

We may update this Privacy Policy. When we make material changes, we will update the version and effective date above and notify you as appropriate.

14. Contact

Privacy questions or requests: [email protected] General support: [email protected]

DrawDown — Privacy Policy v1.0. This is a pre-attorney-review draft. Not legal advice.

Community RulesPrivacy PolicyTerms of Service