Privacy notice

What we collect

• Account identity: email address, authentication-provider user ID, and display name. If you set a password, our authentication provider (Supabase) stores only a one-way hash of it — we never see or store the password itself. If you turn on two-factor sign-in, Supabase also stores your authenticator enrollment.
• League data: memberships, roles, league names, invite codes, and draft-room history.
• Draft data: room settings, manager names, readiness, availability, queues, picks, and final rosters.
• Season Game: your teams in a season, their rosters, lineups, round scores and standings, and roster changes made by or for your team, including waiver claims, trade offers and trade votes. Player statistics come from EuroLeague's public game data and are not personal data about you.
• Classic helper: if you save your team on My Classic team, the players, their prices, the coach's club and the credits you have left, as you typed them in. Nothing is read from your official EuroLeague Fantasy account.
• Premium: which Premium features your account or your leagues have, and since when. Premium is free during the beta, and we collect no payment details.
• Room chat: the messages you send in a draft room's chat, with your display name, the time sent, and a link to your account.
• Recovery data: opaque room-session credentials, expiry and last-seen times, plus an optional recovery email.
• Feedback reports: if you use the Feedback button, the category and message you send, the page you were on, the room ID if you are in a draft room, and an email address only if you choose to give one. We use that address to thank you once and, if your report leads to a change, to tell you what changed.
• Operational data: request IDs, route, status, duration, and security events. Access tokens and room-session values are not intentionally logged.
• Usage and sign-in activity: which main actions happen and when (for example a home page view, a room created or a draft completed), linked to your account when you are signed in. For a home page view we also note which campaign link or website brought you there (for example a social media post), never the full address you came from. When you sign in we also record the time, the country that our host Vercel estimates from your IP address, and your device type, browser and operating-system family. We do not store your IP address or your full browser details.

Why and how we use it

We process this data to create private leagues, run and recover live drafts, preserve completed results, prevent abuse, spot unusual sign-ins, diagnose failures, understand how the service is used, and answer data-rights requests. We do not sell personal data or use it for targeted advertising.

• To provide the service you asked for (contract): your account, leagues, draft rooms, picks and rosters, the Season Game, chat, room recovery and the emails that come with them.
• Our legitimate interest in a safe, working service: security logs, abuse prevention, spotting unusual sign-ins, sign-in country and device type, usage events that tell us which features are used, handling feedback reports, and backups. You can object to the usage events by emailing us; it does not affect your use of the service.
• Legal obligations: keeping a minimal record of data-rights requests and answering them.

We make no automated decisions that have legal or similarly significant effects on you. Auto-managed bot teams and suggestions are game features, not decisions about you.

Storage and sharing

The web app and API are hosted by Vercel and Railway. Account and PostgreSQL draft data are hosted by Supabase. These providers process data only to operate the service. Browser storage holds account and room recovery credentials on the device; signing out removes the account session from that browser. Protected backups are stored in Cloudflare R2. GitHub Actions runs our monitoring and backup jobs, and support email is handled through Proton Mail.

Feedback reports are also filed as issues in our private GitHub repository. We decide which reports are passed to an AI assistant (Claude, by Anthropic, run through GitHub Actions) to help assess them. Please do not include sensitive personal information in a report. Anthropic processes these reports only to provide that assessment, under its commercial terms.

Season Game emails (lineup reminders, round results, waiver and trade updates) are sent through Resend, which receives your email address and the message. You can turn them off on your team page ("Email me about my team").

Some of these providers (Vercel, Railway, Supabase, Cloudflare, GitHub, Resend, Anthropic) are based in the United States or may access data from there. Our database and backups are stored in the EU, but we do not claim that all processing stays in the EU. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in the provider's data processing agreement.

Cookies and browser storage

We use two cookies. One remembers the language you choose. The other only exists when you open an old game.euroleaguedraft.com link while signed in: it carries your sign-in to the same page on www.euroleaguedraft.com, lasts at most two minutes, and is deleted as soon as it has been used. The site also keeps a few items in your browser's storage so that it works: your sign-in session, room recovery details so you can rejoin a draft, and your theme, language and alert-sound settings. We do not use advertising or tracking cookies, third-party analytics, or anything that follows you across other websites, and we store nothing in your browser for analytics. Because everything we store is needed for a feature you use, we do not show a cookie banner. Clearing this site's data in your browser removes all of it; you will then need to sign in again.

Room chat

Chat messages are visible to everyone in that draft room, including managers who join later. You can delete your own messages, and the room's commissioner can delete any message in the room; a deleted message's text is removed, not just hidden. Messages are kept with the draft room and are removed if the room is deleted. Your data export includes the messages you sent while signed in, and an account deletion request removes them, including messages in rooms you have since left. Removed text can remain in protected backups until those backups expire.

Retention and deletion

Active and completed draft records are retained while needed for league history and recovery. Anonymous room sessions expire and can be revoked; their raw credentials are stored only as hashes server-side. Operational logs follow the hosting providers' configured retention. Protected backups are kept for 30 days and then deleted. Feedback reports are kept while we need them to handle the report; you can ask us to delete yours. Sign-in activity is kept for 12 months. An account deletion request removes your sign-in records and unlinks your other usage events from your account.

Season Game teams, rosters, lineups and scores are kept while the league's season history is needed. An account deletion request removes your teams with their rosters, lineups and scores. Past standings and a champion title keep a "Deleted manager" label instead of your name, so other managers' season history stays accurate. If you uploaded stat files or made roster changes for other teams as a commissioner, those records are resolved with the league before your account is removed.

A saved Classic team is kept until you change it or your account is deleted, and is included in your data export. Premium records are removed with your account.

Signed-in users can download a machine-readable export or submit a deletion request from Account controls on the dashboard. An open request is durable and is answered within one month (up to two more months for complex requests, in which case we tell you). Commissioner deletion may require transferring or closing a shared league before account removal. If you began anonymously with a recovery email, sign in with that address first so the room can be linked to your account.

Your choices and rights

You can request access, correction, a portable export, deletion, restriction, or objection using the dashboard or by email. You may also withdraw by leaving the service. Other managers will still see the shared draft record needed to preserve an accurate room history, but account identifiers can be removed or pseudonymized where the law and shared-league integrity allow.

You can complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), which leads for this service, or in Greece the Hellenic Data Protection Authority (dpa.gr). We would appreciate the chance to fix things first.

Age

The service is for people aged 16 and over. We ask you to confirm your age when you create an account and we do not knowingly collect data from younger children. If you believe a child under 16 has an account, contact us and we will remove it.

Contact and controller

Konstantinos Sakellariou, based in the Netherlands, operates this personal project as the data controller and is the contact for privacy and data-rights questions. Email euroleaguedraftapp@proton.me.

Security and changes

We use scoped authorization, encrypted transport, hashed room-session credentials, request limits, restricted cross-origin access, and recovery testing. No internet service is risk-free. Material changes to this notice will be dated here before they take effect.