Privacy Policy

Overview

Drafted Racing ("we", "our", or "the app") is a team management tool for Zwift racing leagues. This policy explains what data we collect, how we use it, and your rights regarding your personal information.

Data We Collect

Account Information

• Email address (for authentication)
• Name (as provided during sign-up or from Google OAuth)
• Zwift ID (your unique Zwift identifier)

Cycling Performance Data

• FTP (Functional Threshold Power)
• Weight and W/kg (watts per kilogram)
• Height
• Gender (used to work out your women's racing category)
• zMAP (2-minute power)
• Racing category (A, B, C, D, E)
• vELO rating and rider phenotype (e.g. Sprinter, Climber) from ZwiftRacing.app
• Race availability preferences
• Equipment details you choose to add (trainer and power meter make/model, dual-recording setup)

We fetch performance data from your public ZwiftRacing.app profile. If you connect your Zwift account, we read your power, weight, height and category from Zwift directly instead — but we keep using ZwiftRacing.app as well, for your vELO rating, phenotype and race history. Connecting adds a source; it does not replace one. See "Connecting your Zwift account" below.

Usage Data

• Team membership and role (captain, rider)
• Race lineup selections
• Loan requests between teams
• Weekly availability hours (the recurring times you mark yourself available for racing)

Verification Videos

If your club uses weight and height verification, you can submit links to videos of your weigh-in or height measurement. We store the links you provide, together with the verification outcome and, if a submission is rejected, the reason given. These links are visible only to you and to your team's captains and club commissioners, who use them solely to verify your racing category.

How We Use Your Data

• To authenticate you and manage your account
• To display your rider profile to team captains and commissioners
• To manage team rosters and race lineups
• To facilitate loan requests between teams
• To sync your performance data from ZwiftRacing.app, and — if you have connected your Zwift account — from Zwift directly as well
• To show your team captains and club admins the weekly hours you have marked yourself available, so they can plan race line-ups

Third-Party Services

We use the following third-party services:

• Google OAuth - For sign-in authentication. We receive your email, name, and profile picture from Google.
• ZwiftRacing.app - We fetch your public performance data (FTP, weight, power metrics) from your ZwiftRacing profile. This is a third-party site, separate from Zwift itself, and needs no action from you.
• Zwift (official API) - Separate from ZwiftRacing.app, and used only if you choose to connect your Zwift account. It lets us read your racing data from Zwift directly, alongside what we already fetch from ZwiftRacing.app. See the section below.
• Resend - For sending authentication emails (magic links). We do not track email opens or clicks.
• Upstash - Hosts the short-lived tokens behind magic-link sign-in and session storage. It sees your email address only as part of delivering that sign-in, and its storage is encrypted at rest.
• Hotjar - For diagnosing bugs and errors: when something goes wrong, a session replay lets us see the steps that led there and that an error appeared (its text, like all text, is suppressed), so we can reproduce the problem ourselves and fix it — sometimes in code, sometimes by improving the design that led people into it. We do not use it for marketing or profiling. Recordings are pseudonymous: Hotjar sets a browser cookie to tell a returning browser from a new one, which under GDPR is still personal data, so we describe it here rather than calling it anonymous.
  All text is suppressed before it leaves your browser. Rider names, weights, email addresses and anything you type appear in a recording as ******* — we see the shape of the page and the path you took through it, not its contents. We never send Hotjar your name, email address, or any account identifier, so Hotjar cannot connect a recording to you. Hotjar is also switched off entirely on invite and registration pages, so join links are never recorded.

Connecting your Zwift account

You can optionally connect your Zwift account from your profile page. This is entirely your choice — the app works without it, and nothing is read from Zwift unless you connect. Connecting is separate from ZwiftRacing.app, which we use by default and which requires no action from you.

What we read from Zwift

• Your Zwift name and gender
• Your weight and height
• Your power metrics — zFTP, zMAP, FTP, your racing category, and your power curve (your best power over a range of durations)

We only read what we need to keep your rider profile current for racing. We never post anything to Zwift on your behalf, and we don't read your messages or social connections.

Zwift also notifies us when you finish a ride or make progress in a workout, so we can refresh your stats promptly. We store those notifications — they identify the ride, not its content — and we don't read the ride's route, map, or who you rode with.

How the connection is stored

Connecting uses Zwift's own sign-in page — we never see or store your Zwift password. Zwift gives us access tokens instead, and we hold those encrypted at rest.

Disconnecting

Connecting your Zwift account is based on your consent, and you can withdraw it at any time by disconnecting from your profile page. Withdrawing does not affect anything we lawfully did with the data beforehand.

When you disconnect, we delete the stored tokens and ask Zwift to stop sending us your data, and your profile goes back to being updated from ZwiftRacing.app. Some things deliberately remain: the performance data already on your rider profile (it is the roster information your team races with), the ride notifications we had already received, your Zwift identifier, and the record of the consent you gave and withdrew — we have to keep that last one as proof of what you agreed to.

Deleting your account is what removes all of it, including the Zwift identifier. We keep the identifier up to that point so we can ask Zwift to stop processing your data on our behalf, then erase it. See Data Retention below.

Zwift is based in the United States, so connecting your account means your data is handled there. Zwift is a separate data controller — it decides how it uses your data, and handles it under their own privacy policy.

Who can see your rider data

Your rider profile — including your weight, height, power figures and category — is visible to other members of the clubs you belong to. It is not public: people outside your clubs cannot see it, and we do not sell or share it with advertisers.

Weight and height are used by your team captain to verify your racing category.

Race events. If you take part in a race event run through our events platform, your race results — your name, club, finishing position, times, power, and watts per kilogram — are visible to other participants of that event, including riders and organizers from other clubs. The organizers of an event can additionally view the weight logged for the race, alongside your verification status, solely to check results for fairness (for example, weight manipulation) — that information is shown only in the organizer's vetting view.

If you set your weekly availability hours, team captains and admins in your club can see whether you are free at a given race time, so they can plan line-ups and know who to ask about borrowing you for a race. They see a yes or no for that race time — not the hours you entered. They can also see how long ago you last updated your availability (for example “last updated 3 days ago”), so they know who still needs to respond. They are not shown what you changed, nor the time of day. Other riders cannot see any of this.

Data Storage & Security

Your data is stored in a PostgreSQL database hosted on a secure server. We use industry-standard security practices including encrypted connections (HTTPS) and secure session management.

Your Rights

You have the right to:

• Access - Request a copy of your personal data
• Correction - Request correction of inaccurate data
• Deletion - Request deletion of your account and data
• Portability - Request your data in a portable format

Access, portability and deletion are self-service: your profile page has an “Export my data” download and a “Delete my account” action, both immediate. Your profile page also has an “Edit my profile” action for correcting your own name, racing details and Discord username, and for pausing your racing — setting yourself inactive hides you from team selection and loan requests in every league until you set yourself available again. For other corrections — including your email address, which we use to identify your account — or anything else you cannot do from your profile, contact your team captain or league commissioner, or email privacy@draftedracing.com.

Cookies

Essential cookies keep you signed in and manage your session. The site does not work without them.

Analytics cookies are set by Hotjar (_hjSessionUser_*, which lasts 365 days, and _hjSession_*, which lasts 30 minutes). They let Hotjar tell a returning browser from a new one so a session replay holds together. They are tied to the browser, not to your account: we never pass your name, email or account id to Hotjar, so it cannot connect a recording to you by name.

We do not use advertising cookies, and we do not sell or share your data with advertisers.

We do not show a cookie consent banner. Our analytics are configured to collect as little as possible: all on-screen text is suppressed, no account identifier is ever sent, the recordings are used only to diagnose bugs and errors on this site, and the data is never sold or shared. The Hotjar cookies do, however, identify your browser across visits, which is why we describe them as pseudonymous rather than anonymous. If you would prefer not to be included at all, most browsers can block these cookies, and any “do not track” or tracker-blocking extension will stop them being set.

Data Retention

We retain your data for as long as your account is active or as needed to provide services. Deleting your account removes your personal data immediately, in one operation — not after a waiting period — except where we are required to retain it for legal purposes. One follow-up runs afterwards: if you connected your Zwift account, a short-lived background job tells Zwift to stop sending us your activity notifications.

Changes to This Policy

We may update this privacy policy from time to time. We will notify users of any material changes by updating the "Last updated" date at the top of this page.

Data Controller & Contact

Drafted Racing is the data controller for the personal data described in this policy. For any question about this policy or your personal data — including exercising the rights above — email privacy@draftedracing.com. Day-to-day roster questions are usually quickest through your league commissioner or team captain.