Privacy policy

Last updated October 22, 2026

The short version: you can watch every run without an account. If you sign in, your name, picture and runs are public, and your email address is not. We only use your address to sign you in. We count visits to see how the site is doing, without cookies and without keeping IP addresses. We don't sell anything about you, show ads, or use outside trackers.

Draft Ranker (draftranker.io) is a free, non-commercial site for ranking Magic: The Gathering cards. This page explains what it collects, why, who can see it, and how to have it deleted.

If you don't sign in

You can watch any run without an account. Cloudflare, which hosts the site, handles each request (including your IP address) to deliver the page, and the site keeps request logs for up to 7 days to fix problems. The site also counts visits, without knowing who you are (see Site statistics). Your browser keeps the card images in its own cache so they load faster next time.

What we collect when you sign in

With Discord: your Discord account ID, username, display name and avatar, your email address, and whether Discord has verified it.
With Google: your Google account ID, name and profile picture, your email address, and whether Google has verified it.
With an emailed link: your email address and, if you type one, the name to show on your runs. For each sign-in email we send, we also record the address and your IP address, so the form can't be used to flood someone's inbox. Those records are deleted after a day.

We never see your Discord or Google password. We don't ask Discord or Google for anything else: no contacts, servers, friends, messages or files.

Your runs

For each run you start, we store its name, its settings, and every pick you make, with the time of each.

Site statistics

To see how busy and how fast the site is, it records a few facts about each request a page makes to the site's server, and about each page load:

which part of the site it was (for example "load a run" or "save a pick"), the time, how long it took, and whether it worked;
your country, as Cloudflare works it out from your connection;
how fast the page appeared and responded, and whether it was on a phone, tablet or computer.

If you're not signed in, you're counted as a code made from your IP address and browser name, scrambled with a secret key. The code changes every day, so it can't be turned back into your IP address or linked to another day, and your IP address itself isn't stored. If you are signed in, your account ID is recorded instead. These statistics are kept for 3 months, only the site's admins can see them, and they're used only to keep the site working well.

Cookies

cr_session keeps you signed in for 30 days. It is signed so it can't be forged, and scripts on the page can't read it.
cr_oauth_state lasts 10 minutes while you sign in with Discord or Google, to protect that step.

There are no advertising, analytics or tracking cookies.

What is public

Anyone, signed in or not, can see your display name and picture, your profile page, every run you start, and every pick in it. That's how watching works. If you signed up with Discord, your Discord username is shown on your profile too.

Your email address is never shown to anyone, and the site never sends it to any page, including your own.

How we use it

To sign you in and keep you signed in.
To show whose run is whose.
To join your sign-in methods into one account when they share an email address that both have verified. For example, signing in with Google after Discord finds the same runs.
To stop abuse of sign-in emails.
To see how many people use the site and how well it is working (Site statistics).

The only email we send is a sign-in link you asked for. We don't use email addresses for anything else today. If that changes, we'll update this page first.

Who else handles it

We don't sell or rent your information, and we don't share it with anyone for their own use. These services handle it on our behalf to run the site:

Cloudflare hosts the site, its database and its statistics.
Our email delivery provider sends sign-in links, so it sees the address each one goes to.

When you choose to sign in with Discord or Google, that sign-in also falls under their own privacy policies.

Google user data

Draft Ranker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting your data

We keep your account and runs until you delete them or ask us to.
You can delete any of your runs yourself, at any time: open the run and choose Delete this run.
To see what we hold about you, or to delete your whole account (your profile, sign-in methods, email addresses and runs), email privacy@draftranker.io with a link to your profile. We'll do it within 30 days.
You can also disconnect Draft Ranker from Discord (User Settings, then Authorized Apps) or from your Google account. That stops future sign-ins that way; to delete what we already hold, email us as well.

Children

Draft Ranker is not meant for children under 13. If you are under 13, please don't sign in.

Changes

If this policy changes, we'll update this page and the date at the top.

Contact

Questions or requests: privacy@draftranker.io.