Privacy Policy

Last updated: 2026/06/27

1. Controller / Who we are

CycloDraft is operated by Willem Aarts (“we”, “us”).
Contact: cyclodraft@gmail.com
Location: NL

2. Scope

This Privacy Policy explains how we collect, use, and share personal data when you use CycloDraft (the “Service”), whether accessed through our website or our mobile application distributed through the Apple App Store and Google Play Store.

3. Data we collect

  • Account data: username, email address, password (stored as a secure hash incl. salt, not in plain text).
  • Gameplay data: teams you submit, rider collection, pack openings, scores, rankings, and related in-game actions.
  • Technical data: IP address, device/browser type, device model, operating system version, app version (when using the mobile app), timestamps, and server-level access logs (retained by our infrastructure provider for security and troubleshooting).
  • Performance logs: request path, HTTP method, response time, database query count, and browser/device type (derived from user-agent string). No IP address and no account identifier is stored in these application-level logs. Retained for 90 days. Legal basis: legitimate interest (service performance monitoring and debugging).
  • Analytics data (when cookies are accepted): page views, session and interaction data, approximate location, device and browser information.
  • Advertising data (when cookies are accepted): whether you arrived from one of our adverts, whether you went on to create an account, and which pages you visited. We use this to measure advert effectiveness and to show you CycloDraft adverts on other websites and apps within Google's advertising network (remarketing). We do not display third-party adverts on CycloDraft, and we do not sell this data.

4. Why we process data (purposes)

  • To provide the Service and maintain your account.
  • To operate core gameplay (teams, scoring, rewards, and leaderboards).
  • To secure the Service, prevent abuse, and debug issues.
  • To understand usage patterns and improve the Service (analytics, only with consent where required).
  • To measure how well our adverts work and to show CycloDraft adverts to you on other websites and apps (advertising measurement and remarketing, only with consent where required).

5. Legal bases (EEA/UK GDPR)

  • Contract: to provide the Service you request (account + gameplay).
  • Legitimate interests: security, fraud prevention, and service improvement (non-intrusive, necessary processing).
  • Consent: for analytics and advertising cookies and similar technologies (e.g., Google Analytics, Google Ads), where required by law.

6. Cookies and similar technologies

We use cookies and/or similar technologies for:

  • Strictly necessary functions (e.g., login/session and security). These do not require consent in the EU/EEA.
  • Analytics (Google Analytics). In the EU/EEA, we enable analytics only after you provide consent via our cookie banner.
  • Advertising (Google Ads). Used to measure whether our adverts lead to sign-ups, and to show you CycloDraft adverts on other websites and apps within Google's network (remarketing). In the EU/EEA, we enable advertising cookies only after you provide consent via our cookie banner. We do not display third-party adverts on CycloDraft.

Analytics and advertising are separate choices — accepting one does not accept the other, and no Google script is loaded until you accept the category it belongs to.

You can change or withdraw analytics and advertising consent at any time via the Cookie Settings link in the footer of every page, or by clearing cookies in your browser. Withdrawing a category immediately deletes the cookies it set on our domain. Cookies that Google sets on its own domains cannot be deleted by us — you can manage those, and opt out of personalised advertising entirely, via Google ad settings.

7. Sharing of data

We do not sell personal data.

We share data with service providers only as needed to operate the Service, including:

  • Linode (Akamai Technologies, Inc.) — our hosting and infrastructure provider. The application runs on Ubuntu/Nginx/Gunicorn servers. All application data is stored and processed on these servers.
  • Google Analytics (Google LLC) (analytics, subject to your consent where required).
  • Google Ads (Google LLC) (advertising measurement and remarketing, subject to your consent where required).

8. International transfers

Some providers (such as Google) may process data outside your country, including outside the EU/EEA. Where required, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) offered by providers.

9. Retention

  • Account + gameplay data: retained while your account is active. You can delete your account from the My Account page. After requesting deletion, there is a 14-day grace period during which you can cancel. After the grace period, all account and gameplay data is permanently deleted.
  • Security logs: retained for a limited period for security and troubleshooting.
  • Analytics data: retained per our Google Analytics retention settings.
  • Advertising data: advertising cookies expire after 90 days; conversion data is retained per our Google Ads retention settings.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, and to withdraw consent (for analytics and advertising). You can delete your account directly from the My Account page. For other requests, contact: cyclodraft@gmail.com. We will respond within 30 days.

If you are in the EU/EEA, you have the right to lodge a complaint with your national data protection authority. For users in the Netherlands: Autoriteit Persoonsgegevens (AP).

11. Security

We apply reasonable technical and organizational measures to protect personal data (e.g., hashed passwords and access controls). No method of transmission or storage is 100% secure.

12. Children

The Service is not intended for children under 16 years of age (the minimum age for digital services under Dutch law). If you believe a child provided personal data, contact us and we will take appropriate steps.

13. Changes

We may update this policy from time to time. The “Last updated” date reflects the latest version. Your continued use of the Service means you acknowledge the updated policy.