For the website drafticon.com and the apps app.drafticon.com and pl.drafticon.com · Last updated: 1 September 2026
In short: DraftIcon is a private, free fan project. We set no cookies, use no advertising services, and process as little data as possible. Visitors are counted with our own cookieless counter that stores neither your IP address nor your browser identifier. Without an account, your game data stays entirely on your device. Here is what happens in detail.
Leonhard Pleschberger, Vienna, Austria
Contact for privacy requests: icon@drafticon.com
The website is hosted by Netlify, Inc. (512 2nd Street, San Francisco, CA 94107, USA). When you visit, Netlify processes technically necessary connection data (IP address, time, page requested, browser identifier) in server logs to deliver the site and protect it from attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. Netlify keeps these logs only for a short time.
All fonts are served from our own server. No connection to Google Fonts or any other font service is made.
The NFL pages show photos of NFL players and, during the season, the current game week. Your browser loads this content directly from Sleeper (Blitz Studios, Inc., USA; servers sleepercdn.com and api.sleeper.app), which means Sleeper receives your IP address. The legal basis is our legitimate interest in presenting the content (Art. 6(1)(f) GDPR). If you prefer to avoid this, you can block external content in your browser; the site remains usable without the photos.
The Premier League pages show when the next gameweek kicks off. Your browser loads the kickoff times exclusively from our own addresses; our server forwards the request to the Premier League's public fantasy API. Your browser makes no connection to the Premier League, and the Premier League does not receive your IP address. The Premier League pages show no player photos; the cards use drawn jerseys.
The website sets no cookies. Your language choice (German or English) is remembered in your device's local storage (localStorage) and is not transmitted to us. The interactive pack opening on the start page runs entirely in your browser.
To see whether the website is visited, which buttons lead into the app and how far down a page is read, we count page views, clicks on the app links and the quarters of a page reached ourselves: without cookies and without any third-party analytics service. Your browser sends a small event (page, language, event name) to our own server. The server adds the country of origin (derived from the IP address), the device class (mobile or desktop) and a visitor value computed from a secret, the date, the IP address and the browser identifier. Your IP address and browser identifier are never stored; the computed value is only stable within the same day and cannot be attributed to anyone from midnight on. The counts are stored in our database at Supabase in Frankfurt (see section 3). The legal basis is our legitimate interest in data-minimising audience measurement (Art. 6(1)(f) GDPR).
We use no advertising and share no data for advertising purposes.
DraftIcon exists as an NFL edition (app.drafticon.com) and as the Premier League edition DraftIcon PL (pl.drafticon.com). Everything below applies to both; you play them with one shared account, and the data lives in the same database.
In the instant duel on one device, names, avatars and scores are stored exclusively in your browser's local storage. This data never leaves your device and can be deleted at any time in the app or via your browser settings.
An account requires you to be at least 16 years old. Below that age the game remains playable without one: the instant duel on a single device, described above, needs no sign-in and stores nothing about the people playing it.
To play online with friends you sign in with your e-mail address (login link, no password) or with your Google account. We process:
The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR). Your player name, team name, avatar and game results are visible to the friends you are connected with; that is the point of the game. Other users never see your e-mail address.
How your name comes about and where it appears: newly created accounts start with a neutral name (such as "Player 4821" and "playerab12cd"). Accounts created before that change carry a player name derived from the first part of your e-mail address. After your first online draft the app asks once for both names and points out at that moment that the team name appears in the rankings. In the worldwide rankings and those for your country a name is shown only if you have deliberately chosen or confirmed it; until then it stays masked. This is data protection by default (Art. 25(2) GDPR): no name is published without you doing something.
This data is stored in a database at Supabase, Inc. (970 Toa Payoh North, Singapore). The database is hosted on Amazon Web Services servers in the Frankfurt (Germany) region, so the data stays within the EU. A data processing agreement is in place with Supabase.
Login links are triggered by Supabase's authentication service and delivered through the European e-mail provider Acumbamail S.L. (Albacete, Spain) from the sender address noreply@notify.drafticon.com. Acumbamail processes your e-mail address on our behalf for this delivery. The mails serve login only; we do not send newsletters.
If you sign in with Google, the sign-in runs through Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We receive your e-mail address from Google to create or match your account; Google learns that you sign in to DraftIcon and processes the sign-in under its own privacy policy. Signing in with Google is optional; the e-mail login is always available as an alternative. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR).
To prevent automated sign-ups we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Turnstile processes technical characteristics of your browser and your IP address to distinguish humans from bots. The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
Schedules, projections and live points of NFL players are loaded by the app directly from Sleeper (Blitz Studios, Inc., USA; api.sleeper.app), so Sleeper receives your IP address. Player photos are loaded through our own server, so no connection between your browser and Sleeper is made for them. The legal basis is our legitimate interest in providing the game content (Art. 6(1)(f) GDPR).
Schedules, projections and live points of Premier League players are loaded by the PL edition exclusively through our own server, which fetches them from the Premier League's public fantasy API. Your browser only connects to our addresses; the Premier League does not receive your IP address.
The cookieless counter from section 2 also counts individual events in the apps (for example app start or a finished draft). If you are signed in, your account ID may be stored with the event so we can tell active players from one-time visitors; the IP address and browser identifier are not stored here either. The legal basis is our legitimate interest in data-minimising usage measurement (Art. 6(1)(f) GDPR).
Push notifications are only sent if you explicitly enable them in the app (consent, Art. 6(1)(a) GDPR). For this we store the push address generated by your browser together with its keys in our database. Delivery runs through the push service of your browser vendor (Apple, Google or Mozilla). You can switch push off at any time in the app or in your browser settings; the stored push address is then removed.
The app sets no cookies. Your login is kept as a session token in the browser's local storage (technically necessary). The app also keeps game states and settings on your device, so they survive a reload and do not have to be fetched from the server every time.
The apps are also hosted by Netlify (see section 2). Some functions (push delivery, news, image proxy, the counter, Premier League data) run as server functions at Netlify.
We keep account data for as long as your account exists. You can have your account deleted at any time; we then remove your profile data, push addresses and connections. Game results may be retained in anonymised form (without reference to you). You delete local browser data yourself via the app or your browser settings.
You have the right to access the data stored about you, and to rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent (for example for push) at any time. Please use the contact address above. You may also lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at).
If features or service providers change, we update this policy. The current version is always available at this address.