Effective Date

This Privacy Policy is effective May 18, 2026 and replaces all prior versions.

Our Promise

We do not sell, rent, or share your personal information for marketing or with unaffiliated third parties. Ever. We use a small number of trusted service providers (sub-processors) to operate the Service — each is listed by name below, and each only processes data on our behalf to deliver the Service to you.

Scope

This Privacy Policy applies to OnlineDraft, LLC ("OnlineDraft," "we," "us") and the OnlineDraft web application, marketing site, and related notifications (email and SMS). By using the Service you acknowledge the practices described here. If you do not agree, please do not use the Service.

Information You Provide

When you register and use the Service, you provide: your name and email address; a password (for email/password accounts) or an OAuth identifier (for Google or Apple sign-in); optional profile details such as an avatar and time zone; group and draft data you create or upload (item lists, draft settings, partner invitations, images you choose to upload); communications you send to support (support tickets, replies); and, if you opt in to SMS turn alerts, your phone number.

Information We Collect Automatically

When you use the Service we automatically receive: log and usage data (pages visited, actions taken, timestamps); device and connection information (IP address, browser type, operating system); approximate location derived from your IP address; and error and performance data needed to diagnose issues. We use this information to operate, secure, and improve the Service.

Consent Records

When you accept these Terms or opt in to email or SMS notifications, we record the version of the terms you accepted, the timestamp, a one-way hash of your IP address, and your browser/user-agent string. We keep this record as audit evidence that you provided informed consent. We do not store your raw IP address.

How We Use Information

We use your information to: create and operate your account; run the drafts and groups you set up; send transactional notifications you have opted into (email turn alerts, SMS turn alerts, account and support messages); process payments via Stripe; provide customer support; secure the Service and prevent fraud; comply with legal obligations; and improve the Service in aggregate. We do not use your information for targeted advertising and we do not build advertising profiles.

We Do Not Sell or Share for Marketing

We do not sell your personal information. We do not share, rent, or trade your personal information with any third party for marketing or advertising purposes. We do not use your data to train external advertising or AI products. The only entities that touch your data are the sub-processors listed below — each acts as a service provider under our instructions and contractual restrictions.

Sub-Processors (Service Providers)

To deliver the Service we rely on the following providers. Each processes data only on our behalf for the stated purpose:

Amazon Web Services (AWS) — hosting, DynamoDB database, S3 storage, Lambda compute, CloudFront delivery, and AWS Cognito for authentication. Data is stored in the AWS us-east-2 region (Ohio, USA).
Twilio — SMS delivery for transactional turn alerts and verification codes. Twilio receives your phone number, message content, and delivery metadata. SMS is subject to U.S. carrier A2P 10DLC rules; STOP/HELP keywords are honored automatically.
Stripe — payment processing. Stripe collects and processes your payment card details directly; OnlineDraft never stores full card numbers. We receive only payment metadata (success/failure, last four digits, billing zip).
SendGrid (Twilio SendGrid) — delivery of transactional emails such as account, support, and turn-alert messages.
Google Analytics 4 — aggregate usage analytics on our marketing site and web application. Configured with IP anonymization where supported. No advertising features are enabled.
Sentry — error and performance monitoring. Receives error messages, stack traces, and limited request context. Configured to scrub user-identifying fields from event payloads.

SMS Messaging (Twilio)

If you opt in to SMS turn alerts, OnlineDraft will text you when it is your turn to pick in a draft, plus a one-time disclaimer and verification code when you enroll. Message frequency varies based on draft activity (typically a few texts per draft). Message and data rates may apply. You can opt out at any time by replying STOP to any message or by disabling SMS in your account settings; reply HELP for help. We never use SMS for marketing. Your phone number, the consent text you accepted, the terms version, a one-way hash of your IP, and your user-agent are stored as audit evidence at the moment of opt-in. SMS messages themselves are retained for 365 days and then automatically deleted. Mobile phone numbers and SMS opt-in consent data collected for text messaging are never shared, sold, or rented to any third parties or affiliates for marketing or promotional purposes; the only party that receives your number is our SMS delivery provider (Twilio), solely to deliver the alerts you requested. SMS turn alerts are entirely optional — you can use OnlineDraft and follow your drafts through the web dashboard or by email without ever providing a phone number.

Email

We send transactional emails for account events, support replies, group invitations, and turn alerts (only after you have opted in). You can manage notification preferences from your account settings. Some emails (such as account-security messages) are essential to the Service and cannot be turned off while you maintain an account.

Cookies and Similar Technologies

We use cookies and similar technologies for essential functionality (such as keeping you signed in) and for aggregate analytics through Google Analytics 4. We do not use advertising cookies. For more detail see our Cookies Policy. You can control cookies through your browser settings; blocking essential cookies may prevent the Service from working.

Data Retention

We retain your account information for as long as your account is active. SMS messages are retained for 365 days from delivery and then automatically deleted. Consent records (acceptance of these Terms, SMS opt-in, email opt-in) are retained indefinitely as audit evidence, even after account deletion, as required to demonstrate that consent was given. Support tickets are retained for the life of the account. Aggregate, de-identified usage statistics may be retained indefinitely.

Account Deletion

You can delete your account at any time from your account settings. Deletion removes your profile, draft and item data, partner relationships, uploaded images, and support history. Consent audit records are retained as described above. Stripe and other sub-processors retain limited records as required by their own legal obligations (for example, tax and chargeback retention requirements for payment data).

Your Privacy Rights

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws), you may have rights to: access the personal information we hold about you; request correction of inaccurate information; request deletion of your information; opt out of any sale or sharing of personal information (note: we do not sell or share for advertising); receive a copy of your information in a portable format; and not be discriminated against for exercising these rights. To exercise any of these rights, email support@onlinedraft.com from the address on your account. We will respond within the timeframe required by applicable law. We may need to verify your identity before completing your request.

Do Not Sell or Share / Do Not Track

OnlineDraft does not sell personal information and does not share personal information for cross-context behavioral advertising. We currently do not respond to Do Not Track browser signals because there is no industry standard for them, but the practices described in this Privacy Policy already match what such signals are intended to achieve.

Children's Privacy

The Service is intended for users 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided us with information, contact support@onlinedraft.com and we will delete it. Users in the European Economic Area must be at least the age required by local law (typically 16, unless lower under a member state's GDPR implementation).

International Users

OnlineDraft is operated from the United States and stores data in AWS region us-east-2 (Ohio, USA). If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may not provide the same level of data protection as your country of residence. By using the Service you consent to that transfer.

How We Protect Your Information

We use industry-standard administrative, technical, and physical safeguards to protect your information, including TLS encryption in transit, encryption at rest for stored data, strict IAM access controls within AWS, hashed and salted passwords, and continuous monitoring through AWS CloudWatch and Sentry. No system is perfectly secure, however, and we cannot guarantee absolute security. We use one-way hashing for stored IP addresses associated with consent records so that the raw IPs cannot be reconstructed.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" above shows when it was last revised. For material changes that affect your rights we will provide reasonable notice (for example, by email, in-app notice, or by requiring re-acceptance of our Terms). Continued use of the Service after the effective date of an update constitutes acceptance.

Contact

Questions about this Privacy Policy or your privacy rights? Contact OnlineDraft, LLC at support@onlinedraft.com or 427 E17th Street, #F-456, Costa Mesa, CA 92660, USA.