Privacy policy
Last updated 15 October 2026 · Bahasa Melayu
Draft Party is a free, fan-made anime party game. It is run by Muhammad Zain Raza, an individual developer based in Malaysia, called "I" or "me" below. I am the "data controller" for the information described here. This policy covers the website at draftparty.me (also reachable at draft-party.anime-draft-party.workers.dev) and the Draft Party app on Google Play, which runs the same game. Contact: play@draftparty.me.
- You can play as a guest, with no account and no sign-up. Accounts are optional.
- No ads and no tracking. The only analytics is a cookieless visitor count (Cloudflare Web Analytics) that doesn't identify you or follow you to other sites. The only cookies are the ones that keep signed-in players signed in.
- I don't sell your data or share it with anyone for advertising.
What stays on your device
To get you back into your seat after a refresh, the game keeps a random player ID, a secret token and your nickname in your browser's storage (the app's storage on Android). It also keeps your settings (look, sound, effects) and your Daily Draft results and streak. This never leaves your device except as described below. Clearing the site's data, or the app's storage, or uninstalling the app deletes it.
What the server receives, and why
| What | When | Why | How long it's kept |
|---|---|---|---|
| Nickname, player ID, your moves in the game | When you make or join an online party | So the other players see you and the game can run | Deleted automatically about 3 hours after the party goes quiet, or as soon as everyone has left |
| Nickname, Daily Draft score, and a one-way hash of your device token (not the token itself) | When you submit a Daily Draft | To show the daily leaderboard and your rank. Your team is sent so the server can check the score, then thrown away. | Kept so past leaderboards still work. Ask me and I'll delete yours. |
| Star rating, optional comments, game mode, app version, minutes played | Only if you send feedback | To improve the game | Kept until I delete it. It isn't linked to your player ID, nickname or account. |
| IP address and basic request details | Every time the game talks to the server | To deliver the game and to block abuse (rate limits) | Not stored in my database, except as described for sign-in sessions below. My host's short technical logs keep request details for a few days. |
| Accounts: your email address, and your Google account ID if you sign in with Google | Only if you sign in | To recognise your account and contact you about it (never marketing) | Until you delete your account |
| Email codes: the 6-digit sign-in code (stored only as a one-way hash) | When you ask for a code | To check the email is yours | 5 minutes; deleted as soon as it's used |
| Email codes: a one-way hash of your email, with how many codes were sent and how many wrong codes were tried | When you ask for a code or enter one | To stop code guessing and email spam (limits per email per day) | 2 days |
| Accounts: the devices you sync with your account (the same one-way hash of each device's token, up to 10) | When you tap "Sync this device" | So your progress can follow you to other devices | Until you delete your account |
| Accounts: your synced progress: nickname, Daily Draft results for the last 60 days, the days you played (for streaks), and your look, sound and effects settings | When something changes on a synced device | So your streak, results and settings are the same on all your devices | Until you delete your account |
| Accounts: sign-in sessions: a random session ID (in a cookie), plus the IP address and browser type of each sign-in | While you're signed in | To keep you signed in and protect your account | Until you sign out, or 30 days after you last played |
Your nickname is whatever you type. The game gives you a random one, so you never need to use your real name.
Signing in with Google
If you choose to sign in with Google, Google tells me your Google account ID, email address, name and profile picture. I keep only the account ID and email. I don't keep your name or picture, and I throw away the access tokens Google sends, because the game never uses your Google account for anything else. Google's own privacy policy covers your Google account.
Why I'm allowed to use it
- Running the game and your account is necessary to give you the service you asked for (for the EU and UK: contract, GDPR Art. 6(1)(b)).
- Security logs, rate limits and blocking abuse are in my legitimate interest in keeping the game safe (GDPR Art. 6(1)(f)).
- For Malaysia: I process your account data with your consent when you choose to sign in, and because it's needed to provide your account.
Who else is involved, and where your data is
- Cloudflare hosts the game, the online parties, the database and email forwarding, on servers around the world including the United States, and processes the requests above, including your IP address. Cloudflare's privacy policy.
- Cloudflare Web Analytics counts page visits (page address, referring site, browser type, country and load speed) to show me how the game is used. It uses no cookies or browser storage, doesn't build a profile of you, and doesn't track you across sites.
- Google runs "Sign in with Google" if you use it. Google's privacy policy.
- Resend (United States) sends sign-in code emails if you use them; it sees your email address and the code. Resend's privacy policy.
- Cloudflare Turnstile checks that a real person, not a bot, is asking for an email code. It runs only on that form and sees your IP address and basic browser details. Turnstile's privacy addendum.
- AniList (website only): character data comes from AniList, and on the website the character pictures load from AniList's image servers, which see your IP address. The Google Play app doesn't load these pictures. AniList's terms and privacy.
- Google Play, if you install the app there, handles the download under Google's own policies.
So your data may be stored outside your country. For EU and UK users, these providers are bound by data processing terms including the European Commission's Standard Contractual Clauses. For Malaysian users, the transfer is needed to provide the service you asked for.
Inside the game, the other players in your party see your nickname and moves, and the Daily Draft leaderboard shows nicknames and scores to everyone. Nobody else sees your email. I only hand data to anyone else if the law requires it.
Children
Anyone can play as a guest. You must be 13 or older to create an account, and the game asks for your year of birth first (it isn't stored). If you're under 18, please check with a parent or guardian before creating an account. If I learn that an account belongs to someone under 13, I'll delete it. Draft Party isn't directed at children under 13.
Cookies and browser storage
Signed-in players get essential cookies that keep them signed in: the sign-in session itself and a short-lived copy (5 minutes) that saves a database lookup. A third, short-lived cookie (5 minutes) is used during Google sign-in to stop forged sign-ins. Browser storage keeps your game settings and progress. There are no advertising or tracking cookies, so there's nothing to opt out of. Cloudflare Web Analytics counts visits without cookies or browser storage.
Security, and if something goes wrong
Everything between the game and the server is encrypted (HTTPS and secure WebSockets). Sign-in cookies can't be read by scripts, there are no passwords to steal, and joining, sign-in and feedback are rate-limited. If a security breach is likely to put you at risk, I'll tell you by email and in the game, and report it to the authorities when the law requires (for example within 72 hours to Malaysia's Personal Data Protection Commissioner).
Your rights
- You can see, download (in a standard file), correct or delete your data, object to or limit how it's used, and withdraw your consent.
- Delete everything on your device by clearing the site's data or the app's storage. Delete your account in Settings → Account, or follow draftparty.me/delete-account.
- For anything else, email play@draftparty.me. For a leaderboard entry, tell me your nickname and the Daily Draft number or date. I reply within 21 days and don't charge. To protect your account, I'll ask you to write from the email address on your account.
- You can complain to me first. You can also complain to Malaysia's Personal Data Protection Commissioner (pdp.gov.my), the UK Information Commissioner (ico.org.uk), or your country's data protection authority.
United States, including California
I don't sell or share personal information, and I don't use it for targeted advertising, so there is nothing to opt out of under the California Consumer Privacy Act or similar state laws. If your browser sends a Global Privacy Control signal, it's respected automatically, because nothing it would stop happens here. You can use the rights above (to know, delete or correct your data) by emailing play@draftparty.me, and I won't treat you differently for using them.
Changes
If this policy changes, I'll update the date at the top. Big changes will also be announced in the game.
Contact
Email play@draftparty.me. You can also open an issue at github.com/MZRMRB/draft-party/issues, or use Send feedback on the game's home screen (feedback is anonymous, so add how to reach you if you want a reply). Terms of use.
Ringkasan dalam Bahasa Melayu
Draft Party ialah permainan parti anime percuma yang dikendalikan oleh Muhammad Zain Raza, seorang pembangun individu di Malaysia. Anda boleh bermain sebagai tetamu tanpa akaun. Permainan ini menyimpan ID pemain rawak, token rahsia dan nama samaran dalam storan pelayar anda. Jika anda bermain dalam talian, menghantar skor Draf Harian atau maklum balas, pelayan menerima maklumat yang diterangkan dalam jadual di atas. Akaun adalah pilihan: jika anda log masuk (dengan Google atau kod e-mel), kami menyimpan alamat e-mel anda (dan ID akaun Google jika anda menggunakan Google) sahaja (bukan nama sebenar atau gambar anda), peranti yang anda simpan ke akaun, dan sesi log masuk (termasuk alamat IP dan jenis pelayar) selama 30 hari paling lama. Data disimpan bersama Cloudflare, di luar Malaysia (termasuk Amerika Syarikat). Tiada iklan dan tiada penjejakan; hanya kiraan pelawat tanpa kuki (Cloudflare Web Analytics). Anda mesti berumur 13 tahun ke atas untuk membuat akaun. Anda boleh melihat, membetulkan atau memadam data anda: padam akaun di Tetapan → Akaun, atau e-mel play@draftparty.me. Kami membalas dalam masa 21 hari. Anda juga boleh membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi (pdp.gov.my). Versi bahasa Inggeris di atas ialah versi penuh.