Privacy Policy

1. Introduction

DrawTactics ("we," "us," or "our") operates the DrawTactics web application (the "Service"). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service.

This policy explains our data practices; using the Service does not itself give consent to optional analytics. You can decline analytics without losing access to your account or subscribed tools.

2. Information We Collect

2.1 Information You Provide

When you create an account or use our Service, we collect:

• Email Address: Used for account creation, login, and communication
• Password: If you register with email and password, your password is securely hashed and stored (we cannot see your actual password). We do not receive your Google password when you use Google sign-in.
• Payment Information: Processed by Stripe (we do not store credit card details)

2.2 Automatically Collected Information

Our hosting and service providers process technical information needed to deliver and secure the Service. Optional analytics information is collected only when you allow analytics, as explained in Section 8. Depending on these purposes, information may include:

• Device Information: Browser type, operating system, device type
• Usage Data: With analytics consent, pages visited, signup and checkout steps, broad tool actions, export outcomes, and time spent on the Service
• Network Information: IP addresses are processed when your browser connects to our service providers, including Google when analytics is allowed
• Cookies and Browser Storage: Session information, privacy preferences, and consented analytics identifiers and records (see Section 8)

2.3 Information from Third Parties

We receive information from our service providers:

• Stripe: Payment status, subscription information, billing details
• Supabase: Authentication and database services
• Google Analytics: Consent-based information about visits and product usage

2.4 Optional Google Sign-In

When Google sign-in is available, you can choose it to create a DrawTactics account or sign in to an existing account. Email and password sign-in remains available. Google sign-in is separate from optional Google Analytics and does not give consent to analytics.

• Data accessed: Through Supabase Authentication, we receive your Google account identifier, email address and email verification status, and basic profile information Google supplies, which may include your name and profile picture. The sign-in integration uses identity, email, and basic profile permissions (openid, userinfo.email, and userinfo.profile). It does not request access to Gmail messages, Google Drive files, contacts, or calendars.
• How we use it: We use this information to verify your identity, create or identify your account, and provide authenticated access to DrawTactics. Your email address is also used for account communications and subscription administration. Basic profile information may be retained in your authentication record even where the app does not display it.
• Storage and sharing: Supabase processes the Google sign-in exchange and stores your identity and profile information in your authentication record. DrawTactics stores your account ID and email in its account profile. Our Netlify-hosted server functions process authenticated account requests, and Stripe receives account and billing information needed if you subscribe. We do not send your Google profile picture or Google account identifier to Stripe for billing. Google processes your sign-in under its own privacy policy.
• Authentication tokens: The sign-in exchange involves Google authentication tokens processed through Supabase. Our app does not use those tokens to access other Google services. DrawTactics session tokens and account information are stored in browser storage to keep you signed in; temporary sign-in records are stored for the authentication flow. These session tokens authorize access to DrawTactics, rather than Gmail or Google Drive.
• Limits on use: We do not sell Google sign-in data, use it for advertising or to train AI or machine-learning models, or pass it to our football image-analysis tools. Optional analytics uses the separate consent and data practices described in Section 8; Google sign-in does not authorize sending your Google name, email address, or profile picture to analytics.
• Protection: The HTTPS/TLS encryption and access controls described in Section 7 apply to Google sign-in data. Our server functions verify your DrawTactics session before accessing your account.
• Retention and deletion: Google identity and profile information is retained with your active DrawTactics authentication record. You can request deletion by contacting jm@drawtactics.com or use an account-deletion control where provided in the app. Account deletion removes your DrawTactics authentication record, including its linked Google identity, and your DrawTactics account profile. Separate billing and analytics records are handled as described in Section 5. Deleting your DrawTactics account does not delete your Google account.
• Removing Google access: You can remove DrawTactics's connection in your Google Account's third-party connections settings. Removing that connection does not itself delete data already held by DrawTactics or necessarily end an existing DrawTactics session; sign out and request deletion or delete your account to remove the records described above. Browser storage can be cleared using your browser settings.

3. How We Use Your Information

We use the collected information for the following purposes:

Purpose	Legal Basis
Provide and maintain the Service	Contract performance
Process payments and subscriptions	Contract performance
Send service updates and notifications	Legitimate interest
Respond to support requests	Contract performance
Measure visits, signup journeys, and product usage through optional analytics to improve the Service	Consent (optional and withdrawable)
Detect and prevent fraud	Legal obligation
Comply with legal requirements	Legal obligation

4. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

4.1 Service Providers

• Stripe: Payment processing (see Stripe Privacy Policy)
• Supabase: Authentication and database hosting (see Supabase Privacy Policy)
• Netlify: Website hosting and server-side functions (see Netlify Privacy Policy)
• Google Analytics: Usage analytics when you grant consent (see Google Privacy Policy)

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

4.3 Business Transfers

If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your information becomes subject to a different Privacy Policy.

5. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained while your account is active
• Payment Records: Retained for 7 years for tax and accounting purposes
• Account Deletion: The account-deletion process removes your DrawTactics login and profile. It does not automatically erase records held separately by Google Analytics or Stripe. Payment records and any other records that must be retained under applicable law are handled separately.
• Google Analytics: User-level and event-level records are governed by the retention settings in our Google Analytics property. Those settings determine the retention interval and whether new activity renews the retention period for a user identifier. Standard aggregate reports are not subject to the same expiry. See Google's explanation of data retention; contact us for details of the settings applying to your data.
• Browser-Local Records: Privacy preferences and analytics records have the lifetimes and controls described in Section 8; account deletion does not automatically clear site data from your devices.

You can contact jm@drawtactics.com to request deletion of personal analytics data without deleting your account. Withdrawing consent stops future optional analytics collection from that browser, but does not automatically erase records already sent to Google. Erasure requests are handled separately, subject to applicable rights, identity verification, and any legal retention requirements.

6. Your Data Rights

Depending on your location, you may have the following rights:

6.1 Right to Access

You can request a copy of your personal data we hold.

6.2 Right to Rectification

You can request correction of inaccurate or incomplete data.

6.3 Right to Erasure

You can delete your account or contact us to request erasure of particular personal data, including analytics data, without closing your account. Some records may need to be retained as described in Section 5.

6.4 Right to Data Portability

Where this right applies, you can request the personal data you provided to us in a structured, commonly used, machine-readable format. Exporting a tactics board is a separate product feature, not a substitute for this right.

6.5 Right to Object

You can object to certain processing of your data.

6.6 Right to Withdraw Consent

You can withdraw analytics consent at any time through Privacy settings in Manage Membership or Section 8.3 below, without deleting your account or losing subscribed features. This does not affect the lawfulness of processing based on consent before withdrawal. To withdraw any other consent, or ask about previously collected data, contact us.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: Data transmitted over HTTPS/TLS
• Password Security: Passwords are hashed using industry-standard algorithms
• Access Controls: Limited employee access to personal data
• Secure Infrastructure: Data hosted on secure servers (Supabase)
• Regular Updates: Security patches and updates applied promptly

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Cookies and Tracking

We use cookies and browser storage for essential functions and, only with your consent, optional analytics. A cookie is a small browser record sent with relevant web requests; local storage holds site data in your browser until it is removed or expires under the site's rules.

8.1 Essential Storage and Privacy Preferences

Authentication and session storage support login and access to subscribed tools. We also store your allow/decline choice in this browser so we can respect it across pages on the same site. The preference has no automatic expiry in our code; you can change it through Privacy settings or clear it through your browser. Clearing authentication storage may sign you out, and clearing the preference may cause the consent banner to appear again.

8.2 Optional Analytics Cookies and Storage

The Google Analytics tag is loaded only after you allow analytics. Its cookies, including _ga and related _ga_ cookies, help distinguish browsers and visits. Cookie expiry depends on the Google tag's cookie settings and is separate from the server-side data retention described in Section 5. Our shared analytics setup keeps advertising consent, Google signals, and advertising personalization disabled.

With your consent, we use Google Analytics to understand visits, signup and verification steps, checkout initiation and errors, which DrawTactics tools and broad features are used, whether exports succeed or fail, and how often users return. For signed-in subscribers, a pseudonymous account identifier may be used to connect usage across sessions and devices.

This identifier is an internal account ID, not your email address, but it is not anonymous to us because it can be associated with your account. Tool events can include broad counts, such as the number of objects or shots, rather than their contents.

With consent, browser-local attribution records let us connect visits to an originating page, language, and non-personal campaign labels for up to 30 days. Signup milestone records use a pseudonymous account identifier to avoid counting the same signup or verification repeatedly for up to 7 days. Expired records are ignored and replaced on subsequent relevant visits; withdrawing analytics consent clears these records.

A separate browser-local marker remembers whether an initial save, export, or editor handoff has already been counted for an account and tool. This marker has no automatic expiry and is not removed by withdrawing consent; clearing this site's browser storage removes it. It is not read or updated for analytics while consent is denied.

Separate Supabase usage reporting is currently disabled. We are not collecting the proposed first-use, first-output, or daily-activity records in separate Supabase analytics tables. This does not disable the consent-based Google Analytics reporting described above. We will update this notice before introducing that separate collection.

Our product analytics events do not include project contents, uploaded images or videos, filenames, player names, annotation text, email addresses, passwords, or payment card details.

8.3 Managing Cookies

You can allow, decline, or later withdraw analytics consent in Manage Membership or using the control below. Your choice applies to this browser on the same site, including other open tabs using our shared consent system; it does not change the choice on another device or browser. Declining analytics does not affect login, subscriptions, or tool access. You can also clear cookies and site storage through your browser settings, but clearing authentication or other functional storage may sign you out or remove locally saved work and preferences.

Privacy settings

9. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

10. Children's Privacy

Our Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. International Data Transfers

Our service providers may process information outside your country, including in the United States, where data protection laws may differ. Using the Service is not treated as consent to international transfers. Where a transfer mechanism is required by applicable law, the relevant mechanism depends on the provider, recipient, destination, and processing terms; a provider's certification does not mean DrawTactics is itself certified.

The following provider documents explain their international-transfer arrangements. These may include recognized adequacy decisions, applicable Data Privacy Framework participation, or Standard Contractual Clauses and related UK safeguards:

• Google's data-transfer frameworks
• Supabase's privacy notice and linked data-processing terms
• Stripe's privacy policy and international-transfer information
• Netlify's privacy policy and international-transfer information

Contact jm@drawtactics.com to ask about the destinations and safeguards applying to your personal data, including how to obtain information about relevant contractual safeguards.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to say no to the sale of personal information (we do not sell data)
• Right to access your personal information
• Right to equal service and price (no discrimination)

13. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access, rectification, erasure, and data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

Data Controller: JMftbl
Contact: jm@drawtactics.com

14. Australian Privacy Rights (Privacy Act)

If you are in Australia, we comply with the Australian Privacy Principles under the Privacy Act 1988:

• Right to access and correct your personal information
• Right to make a complaint to the Office of the Australian Information Commissioner (OAIC)

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification for material changes

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: jm@drawtactics.com
• Contact Form: Contact Us