Privacy Policy

1. Who we are

Elite 8 Draft Board ("the app") is a fantasy football draft board published by Cyngetik Labs. It is available on the web at elite8.cyngetiklabs.com and as an Android application (com.elite8.draftboard). This policy covers both.

For any privacy question, or to request deletion of your data, contact nfl@cyngetiklabs.com. We aim to respond within 30 days.

2. Using the app without signing in

The app is free to install, and the free draft board — any number of teams, player names typed in by hand, CSV export — works on a single device without ever signing in. The rest of the app (the searchable NFL player list, the auction, snake and linear draft engines, timers, draft rooms, chat and trades) is unlocked by a one-time purchase attached to the account you sign in with. Keeping the player list updated for each new NFL season is a separate yearly purchase, which does not auto-renew. Either way, when you draft on a single device, nothing about that draft is sent to us. It lives in local storage on that one device, and it does not leave it — the Android app switches off the phone's automatic backup, so not even Google Drive receives a copy. See section 3.

What drafting without an account cannot do, by nature rather than by restriction: the draft cannot appear on another device, you cannot join a shared draft room, and the unlock cannot follow you anywhere — all three need an identity that outlives a single device, which is what an account provides.

3. What is stored on your device

Whether or not you sign in, the app keeps the following in local storage on your device:

The app does not use cookies or any advertising or tracking storage. You can erase all of the above by clearing the app's storage — in a browser, clear site data; on Android, Settings → Apps → Elite 8 Draft Board → Storage → Clear data.

4. What your account stores

If you choose to create an account, we store the following. This is the complete list.

We do not use your email address for marketing. We do not send newsletters, and there is no mailing list. The only email the app can generate is one you ask for: an address verification message when you sign up, or a password reset when you request one.

5. What you share in a draft room

Shared draft rooms require an account and are entirely optional. When you create or join one, the following is stored in a Google Firebase Realtime Database so the other people in your league can see it:

• The full draft board — team names, every pick, prices, budgets, and the pick log including the time of each pick.
• Your username and display name, shown to everyone else in the room.
• Your chat messages, with your name and the time they were sent.
• Your account ID, so the room knows which team is yours.
• Room settings — the room code, whether the league is listed publicly, and whether it has been locked.

Your email address is not shared with other players in a draft room.

We do not read your draft rooms, and chat is not screened before it is sent. We do read what gets reported to us: reporting a message sends us a copy of it, along with who sent it and which room it was in, so that we can act on it. Reports are kept for up to 12 months so we can act on repeat behaviour, and they outlive the deletion of the reporting or reported account.

6. Third-party services

The app talks to a small number of outside services. Each necessarily receives your device's IP address, because that is how the internet works.

These companies handle the data they receive under their own privacy policies: Sleeper, Firebase and Google.

7. What we never collect

To be specific, rather than vague. The app contains:

• No analytics of any kind — no Google Analytics, no Firebase Analytics, no product analytics SDK.
• No advertising — no ad networks, no ad identifiers, no ad tracking.
• No crash or performance reporting — no Crashlytics, no Sentry, no equivalent.
• No payment details. Everything sold in the app is sold through Google Play, and Google handles the entire transaction — we never see, receive, or store your card number, billing address, or any other payment information. All we learn is what an account has bought.
• No automatic subscriptions. Nothing renews itself and nothing is charged without you choosing it at the time. The unlock is a one-time purchase. The yearly roster pass is also bought one time, for one season — it does not auto-renew, and when it runs out nothing is charged; the app simply stops downloading new player data until you choose to buy the next season.
• No location, camera, microphone, contacts, photos, or files. The Android app requests internet access, a standard permission to check whether the device currently has a network connection, and Google Play's billing permission — the one that lets Google's own purchase window open inside the app for the unlock. A fourth, generated automatically by Android itself for any app built for recent Android versions, is not something the app asks for or a person is ever asked to grant. None of these are sensitive permissions.
• No phone number, postal address, date of birth, or real name. We ask for an email address and a username. That is all.
• No sale or sharing of personal information, in any sense, including as those terms are defined by California law. We do not sell your data, and we have no advertising partners to share it with.

8. CSV export

Exporting your draft writes a spreadsheet file containing your team names and picks to your own device's downloads. That file is never uploaded anywhere. What you do with it afterwards is up to you.

9. Keeping and deleting your data

On your device. Data stays until you clear the app's storage, as described in section 3. That is entirely under your control and does not involve us.

Your account. We keep your account information for as long as your account exists. Delete the account and it goes with it.

Draft rooms. A draft room's board and chat stay stored so a league can resume a draft later. The host of a draft can delete it outright from the My Drafts list, which removes the board, the chat history, the public listing, and every player's access. Players who are not the host can leave a draft, which removes them and their membership from it.

Deleting your account

In the app, open 👤 Account → Delete my account. This permanently and immediately:

• removes your profile and releases your username for anyone else to claim;
• deletes your list of drafts and removes you from every draft you had joined;
• deletes every chat message you sent in those drafts;
• replaces your name with "Former player" on any draft you were hosting, and in the public list.

It cannot be undone.

Two honest limits. Drafts you host are not deleted, because other people may still be using them — delete those first from My Drafts if you want them gone. And a draft board is stored as a single document that any player's device rewrites whenever they make a pick; we clear your name from it, but a leaguemate whose app is holding an older copy can write it back. Leaving a draft also deletes the messages you sent in it, so nothing is stranded in rooms you are no longer part of.

Abuse reports are one exception: if you reported someone, or were reported, that report is kept for up to 12 months so we can act on repeat behaviour. It survives account deletion.

The record of your purchase is the other. When a purchase unlocks the app, that is stored once against your account's internal ID — just the ID, when it was unlocked, and on which platform. It is written once, never edited, and kept after deletion because it is the only record that the purchase happened. Once the account is gone, that ID no longer identifies anyone.

If you would rather not do it yourself, or you have lost access to your account, email nfl@cyngetiklabs.com from the address on the account and we will delete it for you. We aim to complete deletion requests within 30 days.

10. Children's privacy

The app is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Shared draft rooms include a chat feature that is not screened before messages are sent. Other players can type whatever they like. Every player can report a message or hide another player, and a league's host can delete messages and remove players — but parents and guardians should take the nature of live chat into account, and should note that the single-device guest mode works fully without an account or any contact with other users.

If you believe a child under 13 has provided us with personal information, contact nfl@cyngetiklabs.com and we will delete it.

11. Your rights

Everyone

You can see and change your username and display name in the app at any time, and delete your entire account yourself as described above. If you play as a guest, none of your data reaches us at all.

If you are in the UK, EU, or Switzerland (UK GDPR / GDPR)

You have the right to access your personal data, to have it corrected or erased, to restrict or object to how it is processed, and to receive it in a portable format. You also have the right to lodge a complaint with your local data protection authority.

Our lawful basis is performance of a contract for the account data in section 4 — we cannot provide an account-based service without it — and your consent for the draft room contents in section 5, given by choosing to open or join a shared room. You can withdraw that consent by leaving the room, and you can end the contract by deleting your account.

If you are in California (CCPA / CPRA)

You have the right to know what personal information we collect and why, to request its deletion, to request correction of inaccurate information, and not to be discriminated against for exercising any of these rights.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. The categories we collect are identifiers (email address, username, account ID) and internet or other electronic network activity (the draft and chat content you create). We do not collect any category of sensitive personal information.

12. International transfers

Account and draft room data is stored on Google's servers, which are primarily located in the United States. Google maintains its own safeguards for international data transfers, described in the Firebase and Google privacy policies linked in section 6.

13. Security

All communication between the app and the services in section 6 is encrypted in transit using HTTPS. Passwords are hashed and stored by Google, never by us. Access to the database requires a signed-in account, and server-side rules restrict what any account is allowed to read or write — your profile and draft list are readable only by you.

We would rather be straight with you than reassuring: while a league is unlocked, its room code is the only thing protecting it. Anyone signed in who has the code can join the room, and joining is what grants access to its board and chat — which means anyone who does appears in your player list, where you can see and remove them. Locking the league restricts access to the players already in it. No system is perfectly secure, and you should not store sensitive personal information in a draft room.

14. Changes to this policy

If we change this policy we will update the effective date at the top of this page. If a change materially affects how your information is handled, we will make that clear in the app as well. Continuing to use the app after a change means you accept the updated policy.