Privacy Policy

Last updated: 6 October 2026

The short version

• You can browse without an account. We record anonymous usage events, such as page views and clicks on demos, so we can see what people find and play.
• Your browser may store a random ID that lets us tell repeat visits apart. In the EU/EEA, UK and Switzerland we only store it if you click Accept. Anyone can change this with Privacy choices in the footer.
• If you sign in, we keep your email address and your card collection.
• We don’t sell your personal information, and we don’t show ads or use advertising trackers.
• In the future we may offer game developers aggregated, de-identified statistics, such as “this demo was launched 120 times this week.” Those reports never include your email, account ID, browser ID or individual event records.
• To ask a question or make a request, use the contact form and choose “Privacy / data request.”

Who we are

DemoDraw (demodraw.gg) is run by an independent developer based in the United Arab Emirates (“DemoDraw”, “we”, “us”). We decide how the personal data described here is used, which makes us the “controller” under data protection law. You can reach us through our contact form.

DemoDraw is not affiliated with Valve Corporation or Steam. Game information and images come from Steam’s public store pages and APIs.

What we collect

1. Usage events (every visitor)

The site sends a small record to our server when you do one of these things:

• view a page (page_view)
• open a booster pack (pack_open)
• open a game card (card_click)
• click to play a demo (demo_launch)
• click through to a store page (store_click)

Each record contains:

• the event type and time
• the page path, for example /collection
• the game or pack involved
• a browser ID: either your random ID, or the shared value nostore if no ID is stored (see “Browser storage” below)
• “first-touch” information about how you first arrived:
  • the referring website. We keep only its domain, such as https://www.reddit.com, never the full link
  • any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
  • the first page you landed on
• if you are signed in, your account’s user ID. Our server attaches it after checking your sign-in.

Our events database does not store your IP address, your email or your device details, and our tracking sets no cookies.

2. Your account (only if you sign in)

Sign-in uses a “magic link”: you enter your email address and we send you a one-time sign-in link. There is no password. Our authentication provider, Supabase, stores:

• your email address
• a user ID
• sign-in timestamps
• security logs, which include IP address and browser information

3. Your collection (only if you sign in)

For each card you collect, we store the game, when you collected it, the card’s rarity, and whether you archived (hid) it. Cards are added automatically when you click to play a demo or open its store page while signed in.

4. Contact form messages

When you use the contact form, we receive your name, your email address, the topic you chose and your message. They are emailed to our inbox. Your IP address is used briefly in server memory to limit spam, and is not stored.

5. Vercel Web Analytics and Speed Insights

Our host, Vercel, gives us cookie-free aggregate statistics: page views, referrers, country, browser and device type, and page-load performance. According to Vercel, visitors are not tracked across sites, and the short-lived hash used to count visits is discarded after 24 hours. We only see totals.

6. Your country, for the consent banner

To decide whether to show the consent banner, our server checks the country that Vercel infers from your IP address. We only use the result (“banner needed: yes or no”). We don’t store your country or IP address.

7. Content loaded from Steam

Game images, screenshots and trailers are loaded directly from Steam’s servers, so your browser connects to Valve and its content-delivery providers. They can see your IP address. Links to play a demo or view a store page take you to Steam, either in your browser or in the Steam app. Valve’s own privacy policy applies there.

Browser storage (localStorage)

We don’t use advertising cookies. The site keeps a few items in your browser’s localStorage:

If you decline, or haven’t chosen yet in a region that needs consent, we still record the anonymous events described above. They carry the shared value nostore instead of a personal ID, so they can’t be linked to each other or to you. If you are signed in, events still include your user ID, as part of running your account. You can change your choice at any time with Privacy choices in the site footer. Clearing your browser’s site data also removes these items.

Why we use it

Data protection laws such as the GDPR require a “legal basis” for each use. Ours are listed in brackets.

• Running the site and your account. Sending sign-in links, saving your collection, and showing it back to you. (Performing our agreement with you.)
• Understanding and improving DemoDraw. Seeing which pages, packs and demos people use, where visitors come from, and spotting abuse or errors. (Our legitimate interest in running and improving a free service. Storing the ID in your browser in the EU/EEA, UK and Switzerland is based on your consent.)
• Aggregated demand insights for game developers (planned). We may share or sell statistics about interest in demos, such as launch counts and traffic sources per game. These would only ever be aggregated and de-identified. We would never share your email, user ID, browser ID or individual event records. (Legitimate interest; consent where required for the browser ID.)
• Answering your messages and handling takedown or privacy requests. (Legitimate interest, and our legal obligations.)
• Security and legal compliance. (Legitimate interest and legal obligation.)

We don’t sell your personal information or share it for targeted advertising. We don’t make automated decisions about you that have legal or similarly significant effects. Card rarity comes from Steam’s public review data, not from your behaviour.

Who we share it with, and where it is stored

We use these service providers to run DemoDraw. They process data on our behalf:

• Vercel Inc. (USA): website hosting and server functions, plus Web Analytics and Speed Insights. Our server functions run in Mumbai, India. Pages are delivered through Vercel’s global network.
• Supabase Inc. (USA): our database and sign-in system, hosted on Amazon Web Services in Mumbai, India. This is where events, accounts and collections are stored.
• Resend (USA): sends sign-in emails and delivers contact-form messages to our inbox.
• Our email provider: receives and stores contact-form messages.

We also keep a private offline copy of the database, including event records, on the operator’s own computer in the United Arab Emirates, for analysis and backup. It is not accessible from the internet.

We may disclose information if the law requires it, or to protect the rights, safety or security of DemoDraw, our users or others. If DemoDraw is ever transferred to a new owner, this data may move with it, and this policy will continue to apply to it.

International transfers

Your data is processed in India (storage), the United States (our providers’ parent companies, and email delivery) and the United Arab Emirates (where DemoDraw is run). These countries may not protect data in the same way as your own. Where the law requires a transfer mechanism, we rely on our providers’ data processing terms, including the European Commission’s Standard Contractual Clauses where they are offered.

How long we keep it

• Usage events are kept as a long-term record of how demos are discovered, including in our offline archive. We have no fixed deletion date yet. Over time we may aggregate older records or strip identifiers from them, for example by removing the browser ID.
• Your account and collection are kept until you ask us to delete them. Collections are designed to be permanent so cards are never lost, but you can always ask for deletion.
• Contact messages are kept as long as needed to deal with your message and any follow-up. Takedown requests may be kept longer as a record of what was removed and why.
• Provider logs (Vercel request logs, Supabase sign-in logs) are kept for the provider’s own limited retention periods.
• Browser storage stays until you clear it, decline in Privacy choices, or sign out (sign-out removes the session token).

Your rights and choices

Wherever you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy
• correct it
• delete it

You can also object to how we use it, and withdraw consent at any time. Laws in some places give you more:

• EU/EEA and UK (GDPR / UK GDPR). You have the rights of access, rectification, erasure, restriction, data portability, and objection (including to processing based on legitimate interests). You can also withdraw consent, and complain to your local data protection authority.
• California and other US states. You have the right to know, delete and correct your personal information, and to not be discriminated against for using these rights. We don’t sell or “share” personal information for targeted advertising, so there is nothing to opt out of.
• United Arab Emirates (Federal Decree-Law No. 45 of 2021, the PDPL). You have rights to information, access, correction, erasure, restriction, objection and data portability, as the law provides.

How to make a request: use the contact form, choose “Privacy / data request”, and write from the email address on your account if you have one. We may reply to that address to confirm the request is really from you. We aim to respond within 30 days.

If you ask us to delete your account, we will delete your account and your collection, and remove your user ID from event records, including in our offline archive. Events recorded without an account can only be found if you give us your browser ID (dd_sid), which is visible in your browser’s developer tools. Otherwise they can’t be traced back to you.

Children

DemoDraw is not directed at children under 13, and you must be at least 13 to use it (see our Terms). We don’t knowingly collect personal data from children under 13. If you are under the age at which you can consent to data processing where you live, ask a parent or guardian before you sign in. If you think a child under 13 has given us personal data, contact us and we will delete it.

Security

The site is served only over HTTPS. Event and analytics data can only be read and written through our server, never directly by browsers. Account data is protected by row-level security, and admin tools require an approved, signed-in account. No system is perfectly secure, but we work to protect your data.

Changes to this policy

We will update this page when our practices change, and change the “Last updated” date at the top. If a change is significant, we will make it visible on the site.

Contact

For questions or requests about your privacy, use our contact form.