Privacy policy

• Account details. Your email address and display name. If you sign in with Google, also your Google account ID and profile picture. If you use a password, we store only a salted scrypt hash of it, never the password itself.
• Sign-in sessions. A session cookie, plus the IP address and browser user agent recorded when a session starts, used to keep accounts secure. Sessions last up to 30 days and are extended while you keep using the site.
• Drafts and analyses. The champions you analyze and the results, saved to your account as draft history, and a daily count of analyses for the Free plan limit.
• Draft Notes you suggest, linked to your account.
• Messages you send us through the contact form or by email: the address to reply to, your name if you give it, and the message.
• Email links. Links that confirm your address or reset your password are stored only as a hash and expire after 3 days and 1 hour respectively.
• Screenshots. An imported screenshot is read to find champion portraits and then discarded. We don't store it.
• Payments. Stripe runs checkout. We receive your email, the pass you bought, the amount and Stripe's payment and customer IDs. We never see or store card details.
• Logs. Server logs and an audit log of account and admin actions, which can include IP addresses. Rate-limit counters are kept briefly in memory to stop abuse.

To run DraftRead: sign you in, analyze drafts, keep your history, apply plan limits, grant the passes you buy, review suggested notes, answer your messages, and protect the service from fraud and abuse.

We email you only about your account and passes: confirming your address, password resets, a confirmation when a pass starts, and a reminder a few days before a monthly or yearly pass ends. No newsletters or marketing.

We don't sell personal data, show ads, or use advertising or analytics trackers.

• Google, if you choose to sign in with Google.
• Stripe, for payments.
• Resend, which delivers the emails we send you and the messages you send through the contact form.
• OpenRouter and the AI model provider it routes to, which receive the champions in a draft to write the analysis. No account or personal details are sent.
• Google Fonts, which serves the site's fonts and receives your IP address and browser details when a page loads.
• Riot Games Data Dragon, which serves champion images and receives your IP address when they load.
• Our hosting provider, which runs the servers and database.

DraftRead uses only what it needs to work: a session cookie that keeps you signed in, and a short-lived cookie that protects Google sign-in (it expires after 10 minutes). While you sign in, your browser's session storage holds the draft you were building so it isn't lost. There are no advertising or tracking cookies, so there is nothing to opt out of.

Account data, draft history and notes stay while your account exists. When you ask us to delete your account, we delete that data, except payment records we must keep for accounting and tax law. Expired sessions and email links are purged automatically. Messages to support stay in our support inbox while they help us answer you.

You can ask for a copy of your data, a correction, or deletion of your account. Email [email protected] from the address on your account so we can confirm it's you.

If you are in the EU, UK or a region with similar laws, you can also object to or restrict processing and complain to your data protection authority.

DraftRead isn't directed at children under 13, or under the minimum age for online services where you live, and we don't knowingly collect their data.

When this policy changes, the date at the top changes too; significant changes are announced on the site. Questions: [email protected]. See also the terms of service.