For the website drafticon.com and the app app.drafticon.com · Last updated: 22 August 2026
In short: DraftIcon is a private, free fan project. We set no cookies, currently use no analytics or advertising services, and process as little data as possible. Without an account, your game data stays entirely on your device. Here is what happens in detail.
Leonhard Pleschberger, Vienna, Austria
Contact for privacy requests: icon@drafticon.com
The website is hosted by Netlify, Inc. (512 2nd Street, San Francisco, CA 94107, USA). When you visit, Netlify processes technically necessary connection data (IP address, time, page requested, browser identifier) in server logs to deliver the site and protect it from attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. Netlify keeps these logs only for a short time.
All fonts are served from our own server. No connection to Google Fonts or any other font service is made.
The website shows photos of NFL players and, during the season, the current game week. Your browser loads this content directly from Sleeper (Blitz Studios, Inc., USA; servers sleepercdn.com and api.sleeper.app), which means Sleeper receives your IP address. The legal basis is our legitimate interest in presenting the content (Art. 6(1)(f) GDPR). If you prefer to avoid this, you can block external content in your browser; the site remains usable without the photos.
The website sets no cookies. Your language choice (German or English) is remembered in your device's local storage (localStorage) and is not transmitted to us. The interactive pack opening on the start page runs entirely in your browser.
We currently use no analytics tools and no advertising. Should we introduce audience measurement later, it will be cookieless and without sharing data with third parties, and this policy will be updated accordingly.
In the instant duel on one device, names, avatars and scores are stored exclusively in your browser's local storage. This data never leaves your device and can be deleted at any time in the app or via your browser settings.
To play online with friends you sign in with your e-mail address. You receive a login link by e-mail; there is no password. We process:
The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR). Your display name, handle, avatar and game results are visible to the friends you are connected with; that is the point of the game. Other users never see your e-mail address.
This data is stored in a database at Supabase, Inc. (970 Toa Payoh North, Singapore). The database is hosted on Amazon Web Services servers in the Frankfurt (Germany) region, so the data stays within the EU. A data processing agreement is in place with Supabase.
Login links are sent by Supabase's authentication service. They serve login only; we do not send newsletters.
To prevent automated sign-ups we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Turnstile processes technical characteristics of your browser and your IP address to distinguish humans from bots. The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
Schedules, projections and live points of NFL players are loaded by the app directly from Sleeper (Blitz Studios, Inc., USA; api.sleeper.app), so Sleeper receives your IP address. Player photos are loaded through our own server, so no connection between your browser and Sleeper is made for them. The legal basis is our legitimate interest in providing the game content (Art. 6(1)(f) GDPR).
Push notifications are only sent if you explicitly enable them in the app (consent, Art. 6(1)(a) GDPR). For this we store the push address generated by your browser together with its keys in our database. Delivery runs through the push service of your browser vendor (Apple, Google or Mozilla). You can switch push off at any time in the app or in your browser settings; the stored push address is then removed.
The app sets no cookies. Your login is kept as a session token in the browser's local storage (technically necessary). The app also stores game states and settings locally so it works offline.
The app is also hosted by Netlify (see section 2). Some functions (push delivery, news, image proxy) run as server functions at Netlify.
We keep account data for as long as your account exists. You can have your account deleted at any time; we then remove your profile data, push addresses and connections. Game results may be retained in anonymised form (without reference to you). You delete local browser data yourself via the app or your browser settings.
You have the right to access the data stored about you, and to rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent (for example for push) at any time. Please use the contact address above. You may also lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at).
If features or service providers change, we update this policy. The current version is always available at this address.