Privacy Policy

Last updated: October 19, 2026

This policy explains what information Ticket Draft ("the app", "we") collects, how it's used, and the choices you have. It applies to the app at asham-ticket-draft.ca. Questions can be sent to ashamjetstickets@gmail.com.

1. Information we collect

Account information. Your name and email address. If you create a password, it's stored only as a one-way hash, never in readable form.

Information from Google sign-in. If you sign in with Google, or link a Google account from your profile, we receive your name, the Google account's email address and its Google account ID, which we use to create or match your account and recognize you when you sign in again.

Google Calendar access. If you sign in with Google, you're also asked to let the app use your Google Calendar (see section 2). To do that, we store the access and refresh tokens Google gives us. These are encrypted before being stored.

What you do in the app. The ticket groups you belong to, the number of games you're allocated, your draft picks and trades, and the favorite teams and game wishlist you choose to save.

Technical information. A session cookie that keeps you signed in, a security token that protects your requests, your light/dark theme preference stored in your own browser, and standard server logs (such as IP address, browser type and the pages requested) used for security and troubleshooting.

2. How we use Google user data

The app requests the following Google permissions and uses them only as described:

• Basic profile and email (openid, email, profile): to sign you in and to create or match your account.
• Calendar events (https://www.googleapis.com/auth/calendar.events), used for exactly two features:
  • Conflict checking. When you open a draft, the app reads the events on your primary calendar that fall between the season's first and last game dates. For each event it looks only at the title, start time and end time, to show you which games overlap something you already have planned. This is shown only to you. Your events are processed when the page loads and are not stored by the app.
  • Adding your games. When a draft finishes, the app creates one event on your primary calendar for each game you were allocated (for example, "Winnipeg Jets vs Toronto Maple Leafs"). The app never edits or deletes any other event on your calendar.

Limited Use. Ticket Draft's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the features described above, which are visible in the app.
• Google user data is never sold, and never used or transferred for advertising, credit-worthiness or lending purposes.
• Google user data is not used to develop, improve or train generalized artificial intelligence or machine learning models.
• No person reads your calendar data, except with your consent, for security purposes, or where required by law.

3. How we use other information

To run the app: to sign you in, to run drafts for the ticket groups you belong to, and to send you the emails the app needs to work (an invitation to a group, a link to set your password, and a PDF calendar of the results when a draft finishes). We don't send marketing email and we don't use your information for advertising.

4. Who can see your information

• Other members of your ticket groups can see your name and the games you pick or trade in those groups. Groups are invite-only, so people outside a group can't see it.
• Service providers that host and run the app: Amazon Web Services (servers and storage) and Google (email delivery). They process data only to provide those services.
• When required by law, or to protect the rights, safety or security of users or the app.

We do not sell or rent your personal information to anyone.

5. How long we keep it

Account information and your draft history are kept while your account exists. Google tokens are deleted as soon as you unlink Google or your account is deleted. Calendar events read for conflict checking are never stored. Server logs are kept only as long as needed for security and troubleshooting.

6. Your choices

• Change your name, email or password from your profile page at any time.
• Unlink your Google account at any time from your profile (or disconnect Google Calendar from your dashboard). This deletes your stored Google tokens and revokes the app's access with Google.
• Revoke access from Google's side at any time at myaccount.google.com/permissions.
• Delete your account yourself from your profile page. This deletes your account and the personal information tied to it, removes you from your ticket groups and revokes the app's Google access. So that other members' results don't change, games you drafted in finished drafts stay recorded as taken by a former member, without your name. Events already added to your Google Calendar are yours and stay there unless you remove them. You can also email ashamjetstickets@gmail.com and we'll do it for you.
• Get a copy or a correction of your information by emailing the same address.

7. Security

The app is served only over HTTPS. Passwords are hashed and Google tokens are encrypted before storage, and access to the servers is restricted. No method of storage or transmission is perfectly secure, but we take reasonable steps to protect your information.

8. Children

The app is not directed at children under 13, and we don't knowingly collect personal information from them.

9. Changes to this policy

If this policy changes, the updated version will be posted on this page with a new "Last updated" date. If a change affects how Google user data is used, we'll ask for your consent again before using your data in the new way.

10. Contact

Email ashamjetstickets@gmail.com with any questions about this policy or your information.