Privacy Policy

Who we are

MMA Draft is operated by John Kern in Florida, United States. In this policy, “MMA Draft,” “we,” and “us” refer to that operator. John Kern is the controller of personal information processed to operate this service. Contact us at jack@mmadraft.net.

This policy covers mmadraft.net, its fantasy leagues, account services, and support communications. The service is intended for adults and is currently free, with no entry fees, wagering, cash payouts, or prizes.

Information we collect

• Account information: email address, username, display name, a password hash and salt, account creation and verification information, and account privileges. We store a password hash rather than your readable password.
• League and game information: league memberships and roles, team names, league settings, rosters, draft picks and timestamps, autodraft settings, trades, waiver claims, scores, standings, and related history.
• Communications: private messages, league draft chat, forum posts and replies, message read status, and information you send when requesting support or reporting a problem.
• Room presence: a temporary browser connection identifier and recent connection time to show who is in a draft room, plus saved join/leave notices.
• Account protection and legal records: session identifiers, email-action token hashes and expiry times, and the policy version, document fingerprints, date, and adult-eligibility confirmation recorded when you acknowledge our terms. We do not ask for your date of birth or an identity document at ordinary signup.
• Technical information: IP addresses, request times and paths, browser or device information supplied with requests, and security or error logs. Hosting and email systems may also generate delivery, bounce, complaint, and operational records.

Most account and game information comes from you or your activity. Other users may identify you in league content, messages, or reports. Our service providers supply operational and email-delivery information. Fighter names, rankings, and sporting results may come from public or licensed sports information sources.

Do not put passwords, payment details, government identifiers, health information, or other sensitive personal information in team names, chats, forum posts, or support messages.

How and why we use information

• Provide the service: create accounts, authenticate users, verify email addresses, recover passwords, operate leagues and drafts, maintain game history, and deliver requested messages. Where relevant data-protection law requires a legal basis, we rely on performing our contract with you or taking steps you request before entering it.
• Maintain a safe and reliable service: prevent abuse, enforce rules, troubleshoot faults, manage backups, resolve disputes, and protect accounts. We rely on our legitimate interests in those activities where applicable, balanced against your rights.
• Meet legal responsibilities: respond to binding legal requests and retain information where a legal obligation requires it.
• Support and requests: answer questions and handle privacy or safety reports, based on our service relationship, legitimate interests in support, or applicable legal duties.

The current service does not send marketing newsletters or use account acknowledgment as marketing consent. If we introduce optional marketing or a feature requiring consent, we will explain it and obtain that consent where required. Withdrawing optional consent will not invalidate earlier lawful processing.

Providing an email address, username, password, and required acknowledgments is necessary to register. Chat and forum participation are optional. Autodraft and scoring automate game actions under the published league rules; they are not used to make decisions about credit, employment, or comparable legal rights.

What other people can see

Use a username and team name you are comfortable sharing. League members can see the league’s managers, teams, rosters, picks, standings, game activity, and draft chat. Draft-room members can see presence and join/leave notices. Forum posts and replies are available to signed-in site users.

League names, settings, and availability can appear in league-browsing listings, including listings for private leagues. The main public demonstration league may be viewable without signing in. A private league restricts access to its league pages; it does not make its existence or listing confidential.

Private messages are shown to their sender and recipient. Existing message history may remain after league membership changes. They are not end-to-end encrypted: the operator can access stored information when needed to operate the service, investigate abuse, provide support, or meet legal duties. League commissioners do not receive site-administrator privileges merely by creating a league. Other members are not given your account email address through the ordinary member directory.

People who receive or can view content can copy it outside the service. Avoid sharing information you do not want those people to retain.

Service providers and other disclosures

We use Amazon Web Services (AWS) for hosting, infrastructure, and Amazon Simple Email Service for transactional email. These providers process the data needed to host the site, deliver account email, and protect their services. A provider used to receive and answer support email also processes the correspondence you send us.

We may disclose relevant information to professional advisers or authorities when reasonably necessary to obtain advice, comply with law or binding process, investigate fraud or abuse, protect safety or legal rights, or respond to an emergency. If ownership of the service changes, information may transfer as part of that transaction, subject to applicable law and notice of material changes.

We do not sell personal information, share it for cross-context behavioral advertising, or operate third-party advertising or behavioral analytics on this version of the site. We do not authorize a third party to track your activity across unrelated websites through advertising tools on MMA Draft.

Cookies and browser storage

We use a sign-in cookie and a browser preference for optional draft sounds. Details, lifetimes, and deletion controls are in the Cookie and Browser Storage Notice. Fonts and other page assets are served by MMA Draft.

We do not use browser “Do Not Track” or Global Privacy Control signals to disable necessary sign-in or security functions. Because we do not sell information or share it for behavioral advertising, those practices remain off whether or not a signal is present.

How long we keep information

We keep account and league information while it is needed to provide an account, maintain ongoing or historical league play, resolve disputes, prevent abuse, or meet legal duties. Retention depends on the type of record, your account status, league activity, the reason for retention, and applicable law; we do not promise that all data disappears when you leave a league.

Ordinary sign-in sessions expire after 14 days under the current production configuration. Verification links expire after 24 hours and password-reset links after one hour. Active room-presence entries expire after approximately one minute without a heartbeat; saved join/leave notices remain part of chat history. Other technical logs, support records, and acknowledgments are retained as needed for their operational, evidentiary, and legal purposes.

Backups may retain older copies after a change or deletion in the active system until those backups are rotated or securely removed. A backup is not an active user directory. Any restoration must reapply fulfilled deletion or correction requests before that restored information is returned to ordinary use. Records may be retained longer for a specific legal obligation or dispute. We will explain relevant retention limits when responding to a request.

Security

We use measures including HTTPS, password hashing, restricted application access, expiring account tokens, and access controls for stored data and backups. No website or transmission method can guarantee perfect security. Keep your password private and report suspected unauthorized access using the contact information below.

International processing

The application and its database are hosted on AWS in the United States, currently in Northern Virginia. Accessing the service from another country involves processing information in the United States, where laws may differ from those in your country. Email delivery and support may also involve processing in countries where the relevant providers operate.

AWS’s Service Terms incorporate its data-processing terms and, when applicable, Standard Contractual Clauses and UK and Swiss addenda for covered international transfers. You may contact us for information about safeguards applicable to your information or to request an available copy, subject to appropriate redactions. Using this site does not waive protections or remedies provided by applicable law.

Your choices and privacy rights

You may contact jack@mmadraft.net to request access to, a copy of, correction of, or deletion of your personal information, or to ask to close your account. The privacy-request instructions explain how. There is currently no one-click account deletion feature. Leaving a league or logging out does not delete your account.

Depending on your location and applicable law, you may also have rights to data portability, restriction of processing, objection to processing based on legitimate interests, withdrawal of consent where it is the basis for processing, an appeal of a denied request, and a complaint to your privacy regulator. EEA residents may contact their local supervisory authority; UK residents may contact the Information Commissioner’s Office. You need not contact us first to exercise a right to complain.

We verify requests using information reasonably necessary to protect your account, normally through your registered email. An authorized agent may need to show permission to act. Please do not send your password or an identity document unless a justified, secure verification process is specifically arranged. We respond within the time required by applicable law and explain any permitted extension or reason we cannot fully grant a request. We do not penalize you for exercising protected privacy rights. Some records may be retained or redacted to respect other people’s rights or a lawful retention obligation.

Adults only

MMA Draft is intended for people who are at least 18 and have reached legal adulthood where they live. It is not directed to children. If you believe a child has provided us personal information, contact jack@mmadraft.net. We will investigate and take appropriate steps, including removing information where required.

Changes to this policy

We will post an updated policy with its effective date when practices change. For material changes, we will provide a prominent site notice or account email as appropriate and seek any legally required consent before applying a new use. You can ask jack@mmadraft.net for a previous version. The acknowledgment of this policy records that it was brought to your attention; it is not blanket consent to every kind of data processing.