Privacy Policy

DraftReady.AI™ ("DraftReady," "we," "our," or "us") is a digital athlete card platform that helps athletes at the high school, collegiate, semi-professional, and professional levels build shareable digital profiles, track NIL income opportunities, and connect with coaches and recruiters.

This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our web application at draftready.ai (the "App"), including when installed as a Progressive Web App (PWA) on your device.

We collect only what is necessary to provide the service. Here is a breakdown by type:

We use the information you provide for the following purposes:

• To build, display, and share your digital athlete card
• To power AI-assisted features (bio writing, pitch generation, scouting reports) using your own API key and your entered data
• To estimate NIL valuation ranges based on sport, level, and social metrics you enter — all calculations happen in your browser
• To sync your card data to our platform so coaches, scouts, and recruiters can discover your profile (only when you explicitly publish)
• To maintain your session if you create an account
• To store your uploaded photos and make them accessible via your card's public URL
• To provide offline functionality via service worker caching

We do not use your data to:

• Serve advertisements
• Build behavioral profiles for third-party advertising
• Sell or rent your personal information to any third party
• Make automated decisions with significant legal or similar effects

Your card data is stored primarily in your browser's localStorage — meaning it lives on your device and is not accessible to us unless you choose to publish or sync.

When you create an account or publish a card, data is stored in our cloud infrastructure powered by Supabase, which provides:

• Encryption at rest (AES-256)
• Encrypted connections (TLS 1.2/1.3)
• SOC 2 Type II compliant infrastructure
• Row-level security policies

No security system is perfect. We encourage you to use strong account passwords and to not enter sensitive information (such as your full address or government ID) into any card field.

DraftReady.AI integrates with the following third-party services. Each has its own privacy policy:

We do not integrate any advertising networks, tracking pixels, or behavioral analytics services.

You have the following controls over your data at any time:

• Access: All card data stored in localStorage is readable by you directly in your browser's developer tools (Application → Local Storage)
• Delete local data: Clear your browser's localStorage or site data to remove all locally stored card and income data instantly
• Unpublish your card: You can delete your public card link at any time from within the app, which removes it from our database
• Delete your account: Contact us to permanently delete your account and all associated data from our servers
• API key removal: Delete your API key from the app settings at any time — it is removed from localStorage immediately
• Photo removal: Uploaded photos can be removed from Supabase Storage by deleting them within the app or by contacting us
• Opt out of sync: Use the app without an account — all features work locally without any cloud sync

To exercise any of these rights, contact us at the address in Section 12.

If you are a parent or guardian and believe your child under 13 has provided personal information to DraftReady.AI without your consent, please contact us immediately at the address in Section 12 and we will promptly delete that information.

Athletes aged 13–17 should have a parent or guardian review this Privacy Policy. We recommend parents accompany minors when building and publishing athlete cards, particularly regarding the public-visibility nature of shared cards.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights:

• Right to Know: Request disclosure of what personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information. There is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights
• Right to Correct: Request correction of inaccurate personal information

To submit a CCPA request, contact us via the information in Section 12. We will respond within 45 days of receiving a verifiable request.

If you are located in the European Economic Area (EEA) or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to your personal data. Our lawful bases for processing are:

• Contract: Processing necessary to provide the app's features you requested (e.g., saving and sharing your card)
• Legitimate interests: Improving app performance and security
• Consent: Where we explicitly ask for your consent (e.g., optional cloud sync)

You have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to lodge a complaint with your local supervisory authority.

As our primary infrastructure is hosted in the United States, data may be transferred outside the EEA. When this occurs for Supabase-stored data, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism.

• Local data (localStorage): Retained until you clear it or uninstall the app. We have no control over or access to this data.
• Published card data: Retained until you delete your card or account. Deleted cards are removed from our database immediately.
• Account data: Retained for the life of your account. Upon account deletion request, we will remove all personal data within 30 days.
• Uploaded photos: Retained in Supabase Storage until you delete them or request account deletion.
• AI prompt data: Not retained by us. Retention by AI providers (Groq, Gemini, OpenAI) is governed by their respective privacy policies.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Display an in-app notification for users who are actively using the platform
• Where required by law, obtain your consent before applying changes

We encourage you to review this page periodically. Your continued use of DraftReady.AI after any changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please reach out: