HOOPSREDRAFT

Privacy

This page explains what Hoops Redraft collects on the website and in its iOS and Android apps, why, and who receives it.

Who runs this

Hoops Redraft is operated by SHABU PTY LTD, ABN 78 605 154 345. It is a fan project and is not affiliated with, endorsed by, or connected to the National Basketball Association, the National Basketball Players Association, any team, or any player.

Your game is not collected

Your run — the club you took over, every pick you made, every season you played — is stored in your own browser and never sent anywhere, except the final record of a challenge run you choose to play (see Challenges below). Nobody else can see the run itself, including us. Clearing your browser data deletes it, and there is no copy.

If the game breaks

If something goes wrong while you are playing, the game sends a short report so it can be fixed: the error itself, roughly where in the game it happened (for example, mid-draft rather than at setup), which version of the game you were running, and the size of your browser window. That is all it contains. It does not include your run, anything you typed, or anything else that would identify you: there is no cookie and no ID. As with every request to this site, our host Netlify sees the internet address your browser connects from; we do not add anything to that. Reports are read from server logs to find and fix bugs and are not kept in a database.

How you got here

When the page opens, before you touch anything and whether or not you ever play, the game sends one short note recording two things, the web address you arrived on and which site sent you here, plus four small facts about the arrival itself, described below. The web address is the whole thing, including any tracking tags on the end of the link you clicked — the extra bits after a question mark that some links carry. Those tags are the reason this note exists: they are how a visit that came from an ad we paid for is told apart from a visit from someone who was given the link by a friend, and without them there is no way to know whether paying for the ad brought anybody. If there is no site to name — you typed the address in, opened a bookmark, or your browser chose not to say — that part is sent empty, which is itself the answer rather than a gap.

The four small facts are: whether a saved run was already waiting in this browser; roughly how many times this browser has visited, as one of four answers (a first visit, a second, the third to fifth, or the sixth or later — never the exact count), taken from the visit count described under installing the app below; whether the page opened inside another app's own built-in browser on an iPhone, such as the one inside X or Instagram; and your browser's own word for how the page was reached — a new visit, a reload, or a step back or forward through your history — so that reloading the page is not counted as arriving from an ad a second time.

That is all it contains. It carries no name, no account, nothing you typed, and no identifier beyond the same one-per-visit code every other note described on this page carries — the random one generated in your browser's memory when the page opens and gone when the tab closes. It carries no run code, because it is sent before a run can exist. It carries nothing about who you are. It goes to the same dashboard as the notes below, is not shared with any third party, and is deleted when this beta ends, along with the rest of them. As with every request to this site, our host Netlify sees the internet address your browser connects from; we do not add anything to that.

Two parts of the web address are never sent in this note: anything after a #, and the code in a challenge link. A challenge link looks like hoopsredraft.com/c/ followed by a random code; the note carries only /c/, so the challenge part of a link is never part of this note.

Once that note has been sent, the game takes the tracking tags back off the address in your browser's address bar, without reloading the page. They have done their one job by then, and left in place every reload, reopened tab or copy of the address would have been counted as another visit from the ad.

How you play, in outline

During this beta, the game also sends a short note at a few fixed moments in a run — choosing an era or a club, actually starting a run once a club is taken, reaching each summer's trade window and leaving it, finishing a draft or free agency, finishing a season, finishing a run, pressing one of the buttons on a finished run's summary to play again, leaving mid-run, and ending a run early, whether by abandoning it or by swapping it for a different club — so we can see where players get stuck or stop playing. Where it applies, the note carries a number or two, and sometimes a club: which decade and exact year you started in, which club you took over, how many seasons you chose to play, whether contracts are turned on, which season number and which part of the run (draft, free agency, a season in progress, and so on) you had just finished or were on, for a run that ended early whether you abandoned it or swapped it for a different club, for a run that has just started which way it was started (from the setup screen, by swapping clubs, or from one of the summary's play-again buttons), for a play-again button which of the three you pressed, and, for a finished run, the letter grade it ended on. A run that ended during the draft itself carries five more facts, and only that run does: how many picks you had made so far, which pick the draft had reached, how many picks that draft holds in total, whether it was your turn to pick right when the run ended, and how many seconds the draft had been open on your screen (counted from when you opened it, or resumed it, and never past an hour) — so we can tell whether people give up waiting for their first turn or after taking it. Those are counts, a position, a yes-or-no and a length of time, never who you picked: the note says “two picks made, pick 31 of 87, not your turn, open for 95 seconds”, and never a player’s name. That is all a gameplay note contains. It does not include your roster, your picks, anything you typed, or anything else that would identify you.

The trade window has two notes of its own, for one reason: we currently have no idea whether anybody uses it, and we would rather find that out from counts than guess. The first is sent once each summer, at the moment the game works out whether there is anything to show you, and it carries five things: whether the trade screen actually appeared or was skipped because nothing came up, how many rival clubs rang you with an offer, how many players were on the trading block, whether this run has contracts turned on (with contracts off there are no trades at all, so a skipped window means something different), and which summer of the run it was. The second is sent once when you leave that screen for the draft, and carries seven counts and the summer number: how many calls you accepted, how many you turned down, how many offers you made in total, how many of those the other club said yes to, whether you used the search box to look through the league at all, how many of your offers were for a player who was not on the trading block, and how many of those landed. Zeroes across the board is the answer we most want to be able to see — it means the screen was shown and nothing on it was worth doing. The search box itself sends nothing: what you type is never sent anywhere, and the note says only that you searched, never what for.

Both are counts and three yes-or-nos, and nothing else. Neither note names a player, on either side of a trade, and neither names a club — not the one that rang you, not the one you dealt with, not your own. If you close the tab or abandon the run while the trade screen is open, the second note is not sent at all; that is already covered by the leaving-mid-run and ended-early notes described above, which say which part of the run you were on, and sending a “finished with the trade screen” note for a screen you did not finish with would count the same person twice. Each of these two notes is sent at most once per summer, and reloading the page or coming back to a saved run does not send them again.

Each note also carries two random codes, and neither is a cookie or identifies you. One is for the visit, generated fresh in your browser's memory each time you open the page. It is gone from your browser the moment the tab closes, and it only tells one visitor's notes apart from another's — including the arrival note described just above, which shares that same code, so a visit that arrived from an ad can be followed as far as whether that visitor ever started a run. The other is for the run you are currently playing, or about to: choosing an era, a club or a run length generates it the moment you make that first choice, before a run actually exists yet, held only in your browser's memory at that point — the same as the visit code, so if you back out of setup without starting a run it goes nowhere further and is gone with the tab too. The moment you do start a run, unlike the visit code, it is saved alongside your run in your own browser, the same save the game already writes to keep your progress, rather than held only in memory from then on — because it has to survive the same reload or closed tab your run itself survives. It identifies the run, not you: two people can never share one, one person playing two runs gets two, and it carries none of your roster, your picks, or anything about who is playing. It is sent with every note about that run, including the era, club and run-length notes sent before the run itself began, so all of them — and the run's own later notes — can be told apart from another visitor's or an earlier run's, and so a run that continued after a reload can be told apart from one that was actually abandoned, rather than counting an ordinary reload as someone quitting. It is deleted the moment the run itself is: abandoning it, starting over, or starting a new run all clear it along with the rest of the save. If you play more than once without reloading the page, each run gets its own fresh code, so their notes can still be told apart from one another. These notes are stored on our own dashboard, not shared with any third party, for as long as this beta runs, after which they are deleted. As with every request to this site, our host Netlify sees the internet address your browser connects from; we do not add anything to that.

One last thing can ride on a note, and only if you put it there yourself. If you open the game with ?test=1 on the end of the web address, every note that tab sends carries a test marker, and our dashboard then leaves that whole visit out of its figures. It exists so we can play the game ourselves to check it works without our own games counting as somebody playing. It is a plain yes, nothing more — it is not an identifier, it is not a cookie, it says nothing about you or your device, and it changes nothing else the game sends. It lasts as long as that tab does: it survives a reload and moving between pages, and it is gone when you close the tab. Nothing turns it on by itself, so if you have never typed it, no note of yours has ever carried it.

If you install it as an app

You can put Hoops Redraft on your phone's home screen or your computer, so it opens in its own window like an app. On an iPhone that means following Apple's own Add to Home Screen steps, which the game can show you; on Android, and on a computer running Chrome or Edge, the game's Install button opens your browser's own install dialog. Nothing is installed unless you do that.

So that it can open with no signal, the game keeps a copy of its own files in your browser — its page, its code, its styling and its player data — using a service worker, which is a small part of the site your browser holds on to for exactly this. That copy is the game's files and nothing else: nothing about you or your run is in it. Whenever you have a connection the game loads fresh from this site and refreshes the copy; the copy is only used when the connection fails. Now and then, when the game comes back onto your screen, it also asks this site for its front page to see whether a newer version is out, so it can offer to reload; that request carries nothing about you. Clearing your browser's data for this site removes the copy.

The game also remembers five small facts in your browser's local storage, next to your saved run: how many separate visits you have made (and when the latest one began, so opening a second tab is not counted as coming back), whether you have ever finished a run, whether you have already answered the suggestion to install (so it is not shown again), whether the installed app has been opened before, and whether you have answered the note on the season review, shown only inside another app's built-in browser on an iPhone, suggesting you play in Safari instead (so it is not shown again either). They stay on your device and are not sent anywhere as they are. The one thing drawn from them that does leave is the rough band the visit count falls in — first, second, third to fifth, or sixth or later — on the arrival note described at the top of this page.

It sends a short install note, to the same dashboard as the notes above and carrying the same one-per-visit code, at these moments: when its suggestion to install actually comes into view on your screen (from v232 it waits until the suggestion is really visible, rather than counting one the page put somewhere you never looked); when you accept or turn down that suggestion (on an iPhone, accepting means you opened the steps — the game cannot see whether you followed them); when your browser reports the app was installed (Android and computers only — iPhones never report this); and each time the page opens as the installed app. A note carries only: the kind of device, as one of three words (iPhone or iPad, Android, or computer); which way of installing your device was offered (the browser's dialog, the iPhone steps, or the iPhone steps for a page open inside another app); why the suggestion appeared (you finished a run, you came back for another visit, or you pressed the footer link); for a turned-down suggestion, whether it was the game's suggestion or your browser's dialog you closed; and, when the installed app opens, a yes-or-no saying whether this is the first time it has opened on this device. That is all it contains. It carries no run code and nothing about who you are. As with every request to this site, our host Netlify sees the internet address your browser connects from; we do not add anything to that.

The Android app on Google Play

The website links to the Hoops Redraft app on Google Play. There is no App Store link. Three links, and only one is on screen at a time: one on the home screen before a run starts, one in the footer while a run is under way, and one on the summary screen at the end of a run. All three are ordinary links to the same listing, play.google.com. Pressing one opens that listing in a new tab. Nothing from Google is loaded into this page — no script, no image, no frame — on open, while you play, or when you press the link. If you never press one, Google hears nothing about you from us. The web game stays here either way; the link does not replace it.

Pressing one sends this game one short note, to the same dashboard as the notes above and carrying the same one-per-visit code: that the link was pressed, and which of the three places it was. A run's own code rides along too whenever a run is open. Pressing the home-screen link, before a run starts, carries no run code. The note does not say whether you went on to install the app, and it carries nothing about who you are. Once you are on Google Play you have left this site, and everything from there is between you and Google, under their privacy policy, not this one.

In the Hoops Redraft app

The Hoops Redraft app, on iOS and Android, sends the same gameplay notes described above, to the same dashboard. Every note also says whether the phone is iOS or Android, and which version of the app sent it.

When the app opens, before you play, it sends two short notes. One says whether a saved run was waiting, and which visit this is, as one of four answers: 1, 2, 3-5, or 6+. It never sends the exact count. The other says whether this is the first open on that phone. Neither note includes a web address, or the name of a site that sent you. The exact visit count stays on the phone. Only that band is sent.

A session is one launch. Coming back after 30 minutes or more away starts a new session. The session code and each run code are random and made fresh. They are not a cookie, and they do not identify you. The session code is not written into your saved run. A run code is saved only with that run, on the phone, the same as on the website, and it is deleted when the run is. A note still waiting in the queue carries its codes with it. They go when that note is sent or dropped.

The app plays with no signal, so a note waits on the phone instead of going out at once. The queue holds at most 300 notes, and only notes from the past week. When the phone is back online, those notes are sent to the same dashboard, and nowhere else. A note older than a week is dropped and not sent.

Our gameplay notes do not include a device ID, an advertising ID, an install ID, your location, or anything you type. Your saved run stays on the phone. The separate services used for ads, purchases and crash reports are described below.

A test or development build marks every note as test, and so does any other build that is not the store release. Those notes are left out of the numbers. As with every request to this site, our host Netlify sees the internet address the phone connects from. We do not add anything to that. The notes sit on our own dashboard and are not shared with any third party. We use them to understand how the game is played and improve it; test notes are excluded from player totals. Because these notes have no name, email or account attached, we cannot locate one person's gameplay history from their contact details.

Ads in the iOS and Android apps

The native apps use Google AdMob for banner ads and full-screen ads at breaks between seasons. Google's Mobile Ads SDK can collect the phone's internet address (and an approximate location inferred from it), advertising and other device identifiers, ad views and interactions, app interactions, crash logs and performance information. Google uses this information for advertising, analytics and protecting against fraud, and may share it with its advertising partners. These services are in the native apps; they do not run on this website.

Where Google's consent service requires it, its form appears before ads are requested. About → Privacy choices reopens that form when Google makes it available. You can also control tracking permission in iOS Settings and reset or delete your advertising ID in Android Settings. You do not need to allow tracking to play. Google's handling and retention of this data are explained in its privacy policy.

Remove Ads purchases

Remove Ads is an optional, one-time purchase in the native apps. Apple or Google processes the payment; the app does not receive your card or payment details. RevenueCat checks purchases and restores and tells the app whether ads have been removed. It receives a randomly generated anonymous app user ID, store receipts or purchase tokens, purchase history and entitlement information. We use its purchase dashboard for analytics. We do not supply your name, email, Apple ID or Google account to RevenueCat, or use purchase history for advertising across other apps. Its privacy policy explains how it handles and retains this information.

Native crash reports

Release builds use Sentry to help us fix crashes and errors. A report contains the error, phone model and operating system, app version and build, and a short trail of app activity. Our configuration removes user details, request headers and cookies, and console breadcrumbs. It disables screenshots, screen recordings, session replay and performance tracing. Sentry processes these reports for us under its privacy policy. Like other online services, its servers receive the internet address used to connect; we do not attach a player account to a report.

These native services send data over encrypted HTTPS connections. For privacy questions or requests concerning purchase or crash data, contact support@hoopsredraft.com. We will help identify which records can be located and handle requests with our service providers. Google ad-data controls are described above. Deleting the app removes local game data; it does not itself erase purchase records held by Apple, Google or RevenueCat.

If you tip

There are three "buy me a coffee" buttons, and only one is ever on screen at a time: one between sign-up and the footer text before you start a run, a second lower in the footer once a run is under way, and a third, more prominent one on the summary screen at the end of a run. Starting a run swaps the first button for the second; finishing a run swaps whichever of those is showing for the third. All three are plain outbound links to the same place, a Stripe payment page at buy.stripe.com, where any tip is actually made.

Nothing third-party runs on this site at all. No payment widget, no script and no embedded frame from Stripe or anyone else is part of any page here, and none is fetched when a page opens, while you play, or when you press one of those three buttons. The buttons are ordinary links, and the only thing pressing one does in this page is open that Stripe page in a new tab. If you never press one, Stripe never hears about you from us.

Once you are on that page you have left this site, and everything from there — the amount, the payment method, anything you type — is between you and Stripe, under their own privacy policy, not this one. Any cookies or other identifiers set there are theirs and are set on their site, not here. No card details ever reach this site, at any point. Stripe still leaves you on its own thank-you page afterwards rather than sending you back here, so your browser never comes back to this site and nothing about the payment travels through it. Tips go to SHABU PTY LTD, the company named above, not to an individual.

This site is now told that a payment happened, which it previously was not. That message does not come from you or from your browser: it goes from Stripe's servers to ours, separately and after the fact, and it is the only reason the game can tell a button that earns tips from one that only earns taps. What it results in is one more note on the same dashboard as everything above, recording that a tip was completed and which of the three buttons led to it. That is the whole of it. It does not carry your name, your email address, your country, the payment method, or the amount — none of those are asked for, read or stored, and the amount in particular is left out on purpose, since counting completed tips is what the question needed and knowing what each one was worth is not. It is also the one note on this page that does not carry the one-per-visit code, because by the time it is sent your visit is over and that code no longer exists. In its place it is filed under a scrambled, one-way version of Stripe's own reference for the payment — scrambled before it leaves our server precisely so that nobody holding it, including us, can turn it back into the payment or into you. It is there only so that if Stripe sends the same message twice, which it does when a delivery is retried, one tip is not counted as two.

Making that possible means the link itself carries one extra thing, so it should be said plainly: pressing a button adds a short reference code to the address it opens, and Stripe hands that code back to us afterwards. The code says which of the three buttons you pressed and, if a run was open at the time, that run's own code — the same throwaway per-run code described in the gameplay section above, which is what lets a completed tip be tied back to the run that prompted it. It is built from those two things and nothing else: it contains no name, no address, no device identifier, and nothing that would identify you on Stripe's page or anywhere else. It exists only in that link, is not stored on your device, and is gone when the tab is.

Clicking any of the three sends this game one short note, to the same dashboard the notes above go to and carrying the same one-per-visit code every note carries: the fact that it was clicked, which of the three buttons you used, and nothing else. A run's own code, described above, rides along too whenever one is open at that moment — including on the summary screen, where the run has just finished but its code is still held the same way the gameplay notes above hold it, right up until you start a new one. Clicking the first button, before a run starts, is the one case that carries no run code, honestly, rather than inventing one it does not have. It carries nothing about who you are. Whether you went on to actually tip is not part of this note and never was — that is the separate note from Stripe described above, which arrives later, only if a payment completes, and is just as anonymous.

Challenges, if you send or accept one

You can challenge a friend: you pick a setup and send them a link, you both play it, and you each see the other's final record. Nothing here happens unless you press the button to create a challenge, accept one, or play a stranger.

Creating or accepting a challenge (or playing a stranger) sends this to our server, and it is kept there:

It never sends your roster, your picks, your season-by-season history, your email address, or anything you typed other than that optional name. As with every request to this site, our host Netlify sees the internet address your browser connects from; we do not add anything to that.

The link itself is an ordinary web address, and its random code is part of it: hoopsredraft.com/c/ followed by the code. So when you open a challenge link, your browser's request for the page carries that code to our host, Netlify, the same way every web address you open reaches the site it names, and Netlify may keep it in its ordinary server logs. The game then replaces the address in your browser's address bar with the plain home address, so a reload, a bookmark or a copy of the page does not carry the code, and the code is not in the address when you leave for another site.

Anyone who has the link can open the challenge and take the second place. That is the point of it. A challenge is not listed or searchable and is not linked from anywhere else, and its code is random, so it cannot be found by guessing. A player sees the other player's record only once they have posted their own. Someone with only the link never sees a record.

If you choose Play a stranger, your challenge may be given to another player who also chose it. They see only the scenario and, once they have finished too, your final record — never anything that identifies you. A stranger's challenge is the same kind of record as above, without a name (none is ever asked for or stored), plus a short marker that lists it as open until another player takes it or 7 days pass. To avoid matching you with your own game, the press also sends the codes of the challenges this browser already holds. If you end a stranger game you started before finishing it, it is deleted.

If nobody accepts a challenge within 30 days, it lapses and can no longer be accepted. Every challenge, played or not, is deleted 90 days after it was created. A daily clean-up does this.

To remove one sooner, press Delete this challenge on its screen. It deletes the whole record at once, for both players. Or email support@hoopsredraft.com.

Your browser keeps its own copy of each challenge you have created or accepted, under the name nba-redraft-challenges-v1: the challenge code, your player code, the setup, the day it was created and your record. If you have typed a name for a challenge, your browser also remembers the last one under nba-redraft-challenge-name-v1, only to fill the box in next time; clearing your browser data removes it. The challenge copy is dropped when you delete the challenge, when the challenge is found to be gone, or 90 days after it was created. Clearing your browser data removes it too. Without it you can no longer open the challenge as yourself.

Your email address, if you give it

The only thing this form stores is an email address, and only if you type one into the sign-up form. The form also carries a hidden field that only automated spam scripts fill in. If it is filled in we ignore the submission.

Typing an address does not put it on the mailing list straight away. It is stored with Resend but starts opted out of this game's list, so nothing can be sent to it, and an email is sent to that same address with two links: one to confirm it, one for whoever the address actually belongs to, if it was someone else who typed it, to say so and be taken off. Opting in or out here applies to this game's list alone and changes nothing about any other list we run. Both links are unique to that address and to what they do, so one cannot be edited into the other or reused for a different address, and both stop working after 7 days. Nothing else is sent until the confirm link is used, and an address that is never confirmed is never mailed.

Getting off the list, or removed entirely

The confirmation email's second link is not called "unsubscribe" on purpose: nothing is subscribed yet at that point, so the word would be wrong. It exists mainly for someone whose address was typed in by somebody else, and using it opts the address out of this game's list and removes it from that list, the same day, so nothing further is sent. It does not erase the stored address, for the reason given above. Once you are confirmed, to opt out, to have your address deleted rather than only opted out, or to ask what is held about you, email support@hoopsredraft.com and it will be done. If you are not happy with how we handle a request, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Cookies

None. This site sets none of its own, and nothing third-party runs here that could set any — pressing a "buy me a coffee" button opens the payment page in a new tab rather than loading anything into this one, so whatever Stripe sets is set on Stripe's own site, not here.

Your run — the club you took over, your picks, your seasons — is stored locally in your browser, which is not a cookie, and never leaves your device, apart from the final record of a challenge run described under Challenges. The one other part of it that does leave is the run's own id, described in the gameplay notes section above: it starts out held only in your browser's memory, the same as the visit code, until a run actually begins — at which point it is saved alongside your run and is sent with each gameplay note while that run is in progress, then deleted along with it. Nothing here, including the crash reports, the arrival note, the gameplay notes, the install notes, the tip-link note, the Play-link note and the completed-tip note described above, sets a cookie or any other identifier that would let us recognise you on a later visit. The offline copy of the game's files and the five facts the game remembers about installing and visiting, described under installing it as an app above, are kept in your browser the same way your run is: they tell the game on your device what it has already done, and do not tell anyone which device, or which person, it is. The rough visit band the arrival note carries says how often a browser has been back, in one of four broad answers shared by everybody in the same band, not which browser it is. The tracking tags in the arrival note are part of the link you clicked to get here, not something stored on your device; the game takes them off the address bar as soon as that note is sent, and nothing about them survives the tab closing. The reference code added to a "buy me a coffee" link works the same way — it is part of the address that opens, put there as you press the button, and it is not written to your device or kept after the tab closes.

A challenge you create or accept keeps a random code for that challenge in your browser. It is sent only to the challenge server and only about that one challenge: when you open, play or delete it, or when the game re-sends a final record it could not send earlier. It is never sent with any of the notes above, and it does not identify you. Two challenges hold two unrelated codes, and nothing joins them up into one person.

Changes

If the site or the app starts collecting anything else, this page will say so before it does.

Last updated 7 October 2026.