Privacy policy

Last updated: September 22, 2026

Who this covers

This Privacy Policy explains what Categories Draft 20 ("the app", "we", "us") collects, how it's used, and the choices you have. It applies to the mobile app and our website.

The data controller is Charlie Hutcherson, based in England and Wales. Contact info@categoriesdraft20.com about privacy or account requests.

We're a small, independent project. We don't sell your data, we don't run third-party ad networks, and there's currently no advertising or ad-tracking SDK in the app at all.

Information we collect

Account information: email address, a username, and a display name when you create an account.

Profile information you add: a profile photo, a short bio, and display preferences (theme, currency display, notification settings) — all optional beyond the basics needed to create an account.

Gameplay data: matches you play, items you bid on and win, your balance and results, categories you've played or favorited, and achievement/streak progress. This is the core data that makes the app work — leaderboards, rivalry history, and match results all come from it.

Social data: friend connections, challenges sent and received, and content of any reports you submit about another player.

Content you submit: community draft posts, votes, likes, comments, and reports. Comments are held for review before appearing publicly.

Device & delivery data: a push-notification token (so we can deliver match alerts), and standard technical data your device or Expo's push service provides to make delivery work (device type, OS version).

We do not currently collect precise location, contacts, payment card details, or advertising identifiers, and we don't use any tracking SDK that follows you across other apps or websites.

How we use information

To run the core game: matching you with opponents, scoring bids, tracking balances and results, and keeping leaderboards and rivalry stats accurate.

To operate your account: authentication, password resets, and syncing your profile across devices.

To communicate with you: match updates, friend/challenge notifications, and optional daily reminders — all of which you can turn off in Settings.

To keep the community safe: reviewing reports, enforcing our Terms of Service, and preventing cheating or abuse.

To improve the app: understanding aggregate, non-identifying trends like which categories are popular. We do not currently run any third-party analytics SDK — any in-app event logging today stays in developer-only debug logs and is not transmitted to an analytics vendor.

Our reasons for using your information

We process the account and gameplay information needed to provide the service you request under our contract with you. Optional notification permissions can be withdrawn in the app or device settings.

We rely on legitimate interests to prevent abuse, secure the service, moderate community content and respond to support requests. We may also process information to meet legal obligations. You can contact us to object to processing based on legitimate interests.

An email address is needed for an online account; without it you can still use guest play. We do not make decisions with legal or similarly significant effects about you through automated profiling.

Who we share it with

Other players: your username, display name, avatar, match results, and public stats are visible to other players by design — that's how leaderboards, rivalries, and match history work. You control your bio and photo.

Website hosting: Netlify processes technical request information, such as IP addresses and browser details, to serve and secure our public website. Titan handles messages sent to our support email address.

Service providers who process data on our behalf and under our instructions: Supabase (database, authentication, and backend hosting), Resend (delivery of account verification, sign-in and password-reset emails), Expo's push notification service and Apple Push Notification service for delivering iPhone notifications.

Legal reasons: if required by law, to protect the rights and safety of our users, or to investigate fraud or abuse.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

International processing

Our main Supabase database is hosted in London. Website, email and notification providers may process information in other countries, including the United States. A local database region does not mean all service data stays in the UK.

Resend stores account-email content and delivery records in the United States. Its data-processing agreement includes Standard Contractual Clauses and the UK Addendum for these transfers. Contact us for information about the safeguards relevant to your data.

How long we keep it

Resend normally retains email content and delivery logs for 30 days on our current plan, with backups retained for a further seven days. Support correspondence is kept as needed to answer your request, resolve follow-up issues or meet legal obligations; contact us to request deletion.

We keep your account and gameplay data for as long as your account is active, so match history, streaks, and leaderboards keep working correctly. If you delete your account (Settings → Delete Account), your account, profile, uploaded avatar and linked records are removed from the live service. Deleting shared match records can also remove those matches from other players' histories. Technical logs and provider backups may remain until their retention periods expire; these are not an account-recovery service.

Your rights and choices

Access & correction: most of your profile data can be viewed and edited directly in the app (Profile → Edit).

Deletion: delete your account at any time from Settings → Delete Account. Once deletion succeeds, you cannot recover the account through the app.

Notifications: turn off push notifications and daily reminders any time in Settings, or at the OS level.

Depending on the circumstances, you can request a copy of your information, correction, deletion, restriction or portability, or object to its use. You can complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

For access, export, correction or privacy requests, contact info@categoriesdraft20.com.

Children's privacy

Categories Draft 20 is not directed at children under 13, and we don't knowingly collect personal information from anyone under 13. A child's account can be removed the same way any account is: Settings → Delete Account.

Security

We rely on Supabase's authentication and database infrastructure, industry-standard encryption in transit (HTTPS/TLS), and row-level security policies that restrict who can read or write your data. No method of transmission or storage is 100% secure, but we work to protect your information appropriately for the kind of app this is.

Changes to this policy

We'll update the "last updated" date below whenever this policy changes, and post the new version here and in-app. We will explain material changes and request consent where it is required.

Last updated: September 22, 2026.