Privacy

Bidraft is responsible for your data. For any question, write to contact@bidraft.games.

• If you host: your email address, to send you a sign-in code.
• If you join without an account: no address, only an identity tied to your browser.
• For your next games: your saved nickname, filled in for you, which you can change on your profile.
• In every room: your nickname. In every game: your bids, your team, your place and your points.
• When you ask for a sign-in code, join without an account or look for an online game: the IP address your request came from, or its network for an IPv6 address. It limits how many requests one network can make, and it is kept apart from your account.
• If you send us feedback: your message, to improve the game.

We use it to run your games and improve them, and for nothing else. We sell nothing and show no ads.

• Running your games and signing you in: it's the service you ask for.
• The waitlist: your consent, given when you enter your address. Write to contact@bidraft.games to withdraw it.

In the closed beta, an address that can't host yet goes on a waitlist. It holds:

• your email address
• the language you used
• when you signed up
• the source your link named, if it named one

It's for one email, when Bidraft opens. We delete the list 6 months after that email.

To come off it sooner, write to contact@bidraft.games.

• An account stays until you delete it.
• A guest unseen for 12 months is deleted.
• A guest who never joined or watched a room is deleted after a day.
• An address nobody confirmed is deleted a day after its last code.
• An IP address is deleted the night after a day without a request from it.
• A session ends when you sign out, after 90 days without a visit, or a year after you signed in. What is left of it is deleted the night after that year, at the latest.
• A room nobody played in is deleted after 2 hours without activity.
• A room closes a day after its last game.
• Nicknames and games stay in a closed room until their player's data is deleted.

Anyone, with or without an account, can delete their data from their profile, outside a running game.

Your account or guest identity, your sessions, your address and your nicknames go, and the open rooms you host close. Finished games keep your place and points as "Deleted player".

Feedback you sent stays, with nothing that names you.

This doesn't reach the waitlist: to come off it, write to contact@bidraft.games.

Our database is Convex, in the United States (US East).

Other services handle part of it for us:

• Cloudflare hosts the site and runs Turnstile, the check that keeps bots out.
• Cloudflare Web Analytics counts visits, with no cookie and no personal data.
• Resend sends the sign-in email.

So your data leaves the EU. Convex's data processing agreement covers the transfer with the EU's standard contractual clauses. Cloudflare and Resend rely on those clauses and on the EU-U.S. Data Privacy Framework.

TMDB serves the film and anime posters straight to your browser, so it sees your IP address when a game shows one.

Your browser keeps your session and your choice of language. While your session lasts, it keeps the nickname or address the header shows. For one visit, it also keeps the source your link named.

Under the GDPR, you can see, correct or delete your data, and object to how we use it. Write to contact@bidraft.games.

You can also complain to the CNIL, France's data protection authority, at cnil.fr.