Privacy policy

Draw It Up™: Football Strategy

What the PC game collects

Nothing that identifies you when you play the Story, Free play, Challenges or a Duel on one computer. The PC game has no ads, no analytics and no tracking. Your progress, settings and playbooks are saved on your own computer.

Steam

The game is sold and run through Steam, which Valve Corporation operates. Valve handles your purchase, your Steam account, achievements, and Steam Cloud, which keeps a copy of your save file so you can pick up on another computer (if you have Steam Cloud turned on). Valve's privacy policy covers that information.

We never see your payment details. Valve gives us sales and usage reports made of totals, not information about individual players.

Past daily puzzles

The game's Challenges screen downloads past daily puzzles from our server. These downloads send nothing about you or how you play. Like any internet request, they show your IP address to our hosting provider, Cloudflare, which delivers them for us. We don't keep IP addresses, and our host's short-term technical logs, which we use only to fix problems, are deleted automatically within 7 days. If you don't open Challenges, the game doesn't make these requests.

Sharing plays

When you share a play, the game copies a play code or saves a file on your computer. It doesn't upload anything; you decide where it goes.

Online play

Online play on PC isn't available yet. When it arrives, it will use the same anonymous account and server as the phone app (without ads, purchases or notifications), and we'll update this section before it does. Until then, the PC game collects none of it. The phone app is covered in the next section.

Draw It Up™: Football Strategy app

Who it's for

The app is for players 13 and older (14 and older in Canada), and it's available in the United States, Australia, Canada, New Zealand, Singapore and Hong Kong. Its first screen asks for your birth year (and your birth month, only if the year alone doesn't settle it). If you're under 13 (under 14 in Canada), the app turns you away on your phone and sends nothing to us. The app isn't directed at children.

What stays on your phone

The app keeps these on your phone: your birth year from the age screen, the country you were in when you answered it and the last country our server reported (two letters each, so the app knows which age rule and ad settings apply), your account's sign-in id and secret, a copy of your team, your practice record, the play you're drawing (until it's in), what you've bought, which ways you can sign in (just which), how many times you've opened the app and when you first did, when it last asked you for a rating, whether you've seen the welcome card, the last screen you were on (kept two minutes, so the app can reopen there after a crash), an ad's one-time code until our server confirms it, and the record of your ad consent choices, kept by Google's consent form. The app keeps a copy of your Playbook (with any changes not yet sent) and Head to Head's default deck on your phone, so you can play offline, and whether you've turned the sound off or muted an opponent's emotes stays on your phone and is never sent. Your Challenges results (each day's best and how many tries, for each team on this phone) stay on your phone too: they're never sent, and they don't come with your team to a new phone. Uninstalling the app erases all of it. Your practice record and your settings stay on this phone too: they don't come with your team when you sign in on another phone. Nothing from a Google or Apple sign-in stays on your phone, and the app doesn't store your recovery code.

What our server keeps

Your account is anonymous: a random id, plus a secret that stays on your phone (our server keeps only a scrambled copy of it). The app never asks for your name, email address, phone number, contacts, photos, files, microphone, camera or precise location. To run the game, our server keeps:

• your birth year (and month, if the age screen asked for it), to apply the age rules and the rule for ads to players under 16;
• the country your account was made in, as two letters worked out from your IP address at sign-up (we don't store the IP address);
• when your account was made and last used, and your friend code;
• your team's name, abbreviation and look (its kits, field, chalk, touchdown celebration and name banner), and every name you've submitted, with whether it was accepted;
• the plays you draw and their results (with which version of the game engine scored them), your games with friends, your Duel rating, record and matches (including ghost matches, below), and your Endless runs (score, timeouts, rounds, each round's play, and when the score last went up);
• Head to Head: your rating, record and trophies, each match (both teams, Quick or with a friend, the winner and the score, and every snap: each side's call, your play, your throw and the result), your invites to friends and theirs to you, your saved game plan decks and playbook plays, and your XP by formation and coverage;
• your Playbook: each play you save (its name, its formation, the play it started from and the play itself), when it was saved and last changed, and the share code it came from if you added it from someone's share. When you delete a play, a short record of it (its id, formation and when) stays so the delete reaches your other phones. Play names go through our own name filter on our server, with no outside service; a name that doesn't pass becomes a plain one, like "Gun Trips · Snag";
• plays you share: each share's code, what it holds (one play, a formation's plays or your whole Playbook), its title, and a copy of those plays as they were when you shared them, with when it was made. Deleting a share wipes it from our server;
• Game Winning Drive: how many skips you used each day;
• Arena: your Arena rating (used only to find you fair opponents, and never shown in the app), your wins, losses and trophies, the cards you've earned with their levels and statistics, your lineup and the formations you bring, your season results, and every Arena match you play, including each play you drew and how it turned out;
• friend challenges: when you challenge a friend to a drive, both drives' plays and their results, so our server can decide who won;
• your roster: your players' nicknames, which only you see, and their jersey numbers, plus when you renamed a player (no names, just the times, for the daily limit);
• your play activity: your Career XP (each grant, what it was for and when) and level, each season's points and tier and whether you own its Premium Pass, your finish in the Duel each season, your players' Head to Head levels and the XP you haven't given out yet, the Game Balls you won and opened each day, the day you last claimed the Daily Gift, and how far each arena set has come;
• your friends and friend requests, the teams you've blocked, and name reports you make or that are made about your team's name;
• flags on plays or accounts that look unfair, for a person to review (not an automatic penalty);
• your purchases (No ads, looks and kits, Endless and Challenges, and each season's Premium Pass, which is sold during its season and isn't a subscription). On Android: the product, Google Play's purchase token and order number, and its status. On iPhone: the product, Apple's original transaction id (and a scrambled copy of it), the transaction id as the order number, its status, whether it was a sandbox (test) purchase, and when it was bought and checked. Never your card or bank details;
• your phone's notification address, if you allow notifications;
• a record of each rewarded ad you watch, to try on a look, to use an Endless timeout or to get more Game Winning Drive skips: a random number for the ask, the look or game (and, for a timeout, the play it was for), and Unity's offer id;
• for the one free Endless game a day: a scrambled (SHA-256) copy of your phone's id for our app (Android's ANDROID_ID, or Apple's identifierForVendor on iPhone) with the date. The app sends the id only with the free-game check, so reinstalling can't replay the day's free game. The scrambled copy isn't linked to your account, isn't used for ads, and is deleted after two days;
• if you sign in, what's described under "Signing in";
• when you search for a friend by name, what you type is part of that request's address, which our server's logs keep for up to 7 days to help us fix problems. Then it's deleted.

Signing in (optional)

Signing in is optional and never needed to play. In Settings → Account (or "Have an account? Sign in" when you first start), you can use Sign in with Apple (on iPhone) or Sign in with Google (on Android, and on iPhone where offered), or get a recovery code. Then a new phone, a reinstall or your other phone gets your team back.

• For each way you sign in, our server keeps only a scrambled copy of Google's or Apple's id for you in this app, made with a secret key only our server holds, or a scrambled copy of your recovery code, with when it was linked and last used. These copies can't be turned back into your Google or Apple account or your code.
• We never keep the email address, name or photo a sign-in can carry. We keep no Google token.
• With Apple, we keep one token: Apple's refresh token, encrypted. We use it only to tell Apple to cancel it when you delete your account or unlink Apple, as Apple asks apps to do. If Apple doesn't confirm that, we try again for up to seven days, with the token still encrypted, and then delete it.
• If you stop using your Apple ID with our app (in your Apple ID settings), or delete your Apple ID, Apple tells our server, and we remove that Apple link and its token. Your team stays on your phone.
• If the account you sign in with already has a different team, you choose: play as that team, or keep the one on this phone. We never merge two teams. If the team on this phone isn't saved any other way, we delete it only after you confirm, or after you get a recovery code for it first.
• Your recovery code is shown once. We keep only its scrambled copy, so we can't show it again; New code replaces it.
• To check that a sign-in is fresh and meant for your phone, our server gives the app a random one-time number, deleted once it's used or after ten minutes. A sign-in waiting on your choice is held for five minutes, then deleted.
• Signing in on a new phone signs the old phone out (it says your team is on another phone) and stops notifications to it. To stop hopping between teams, we note each time a sign-in moves to a different team, for a day.
• Sign out (Settings → Account) makes this phone forget your team: we change your account's secret and stop notifications to this phone. Your team stays on our server for when you sign in again. The phone keeps only your birth year.
• Unlink removes a way at once (never the last one), and for Apple cancels its token with Apple. Deleting your account removes them all.

What we never keep

Your IP address (Cloudflare sees it on every request; we don't store it), your phone's advertising ID (the ad software reads it on your phone; it never reaches our server; on iPhone it's Apple's advertising identifier, below), your phone's id for our app itself (only its scrambled copy, for two days), anything from a Google sign-in except a scrambled copy of its id, and anything from an Apple sign-in except that scrambled copy and Apple's encrypted refresh token (see "Signing in"), so never an email address, name or photo, and your recovery code itself. The app sends its version number with each request so our server can tell when it's too old to play; that isn't kept either. The app has no analytics or crash reporting of our own.

Challenges keeps nothing about you on our server: your results stay on your phone, and our server only fetches past puzzles from the Daily (daily.drawitupgame.com, our own site) without saying who's playing. If the app asks you to rate it, that's Google Play's or the App Store's own rating sheet, and nothing about it is sent to us. A deletion request on this website that doesn't match exactly one team isn't kept at all.

What other players see

Your team's name, abbreviation and look (its kits, field, chalk, touchdown celebration and name banner), its Duel rank and record, its place in The Masterminds (the Duel's top 500 teams), its best Endless score and rounds cleared on the Endless leaderboard (a game still going counts, marked as still playing), and the plays you drew against them once a round is over. Anyone who has your friend code can find your team and send you a friend request; you become friends only if you accept it.

Beside your team's name: your Career level, title and border, your season pass badge, and your finish in each season's Duel, for good (and your place, like "S1 #137", if you made the top 500).

In Head to Head: the team you play sees the levels your players play at and their jersey numbers, with each player's real name; your nicknames for your players are never shown to anyone else. Your team shows on Head to Head's leaderboards (the global board, your country's board and your friends' boards) with its name, look, trophies and arena; your country itself is never shown, and a team you've blocked doesn't see you there. Emotes are preset reactions: there's no chat and nothing typed. Your decks are never shown to anyone else. Your Playbook is yours alone unless you share from it. In a match, the other side sees the plays you run, not your book.

Ghost matches: when no live opponent is near their rank, a player may face a recording of another team's Duel plays from its last 30 days of finished matches, round by round, under that team's name and marked as a ghost. Your team can be someone's ghost in the same way. It doesn't change your rating or record, and you can't turn it off yet.

Sharing plays: when you share a play, a formation's plays or your whole Playbook, you get a code and a link (drawitupgame.com/p/...). Anyone with them can see, in the app, a copy of those plays (their names, formations and routes) as they were when you shared them, and add them to their own Playbook. Your team's name isn't part of a share. Deleting the share wipes it from our server, and its code and link stop working. Plays someone already added are their own copies and stay in their Playbook.

Arena: the team you play sees your team's name, look and Arena record, and your plays in each round once that round is over. Your team's name, look, trophies and arena also appear on Arena's leaderboards (worldwide, your country's and your friends'); your country itself is never shown, and a team you've blocked doesn't see you there. When you finish an Arena match, your plays from it may be offered later to another player near your level as a recorded opponent: they play the same rounds against your plays, shown under your team's name and the date you played. That is never offered to your friends or to a team blocked either way, and it never changes your trophies or rating.

Friend challenges: your friend sees your drive once they've played theirs, and your plays once the challenge is over.

Beat my play links (drawitupgame.com/beat/...) carry only a round's random id, or a Challenge's date and score, and nothing about you. The message you share also shows your score and the down and distance. Whoever opens the link in the app sees your team's name and look, and your score and 100 runs on that round, but never the play you drew.

Services we use

• Cloudflare runs our server and stores its data, in the United States (the database is kept in eastern North America). It sees the IP address and technical details of every request (Cloudflare's privacy policy).
• Anthropic: its Claude AI checks each new team name (and, for a reported name, the reasons chosen) before other players see it. It gets only the name and abbreviation, nothing that identifies you, and under its commercial terms it doesn't use them to train its models.
• Google Play handles purchases on Android. We never see your card or bank details; our server checks each purchase, and any refund, with Google.
• Apple handles purchases on iPhone, through the App Store, as payment processor. We never see your card or bank details; our server checks each purchase with Apple's App Store Server API, and Apple tells our server when a purchase is refunded.
• Firebase Cloud Messaging (Google) delivers notifications if you allow them. It gets your phone's notification address and the words of each notification, which can include another team's name. On iPhone, Firebase hands them to Apple's push notification service, which delivers them to your phone.
• Unity Ads (Unity Technologies) shows ads in the app, on Android and iPhone. Unity's software in the app collects its own information under Unity's privacy policy, including your phone's advertising ID, IP address (and the approximate location it shows), device and app details, the ads you see and tap, and technical diagnostics; Unity also lists identifiers and purchase history among what it handles, though the app sends Unity nothing about you or your purchases. We don't send Unity anything about you for ads. On iPhone, the advertising ID is Apple's advertising identifier (IDFA): Unity's software reads it only if you allow tracking at Apple's prompt, and that counts as tracking for third-party advertising and analytics. Players under 16 and players in Canada are never asked and never tracked, and saying no keeps ads that don't use your personal information. Google's consent form (see "Ads and your choices") still runs on both phones.
• Google AdMob: versions of the app before 1.4, on Android and iPhone, include Google AdMob's software, which may collect the data Google describes in its privacy policy. 1.4 and later use Unity Ads instead.
• Google (Sign in with Google, on Android or iPhone), only if you choose it: Google signs you in on your phone and gives the app a signed token for this app. Our server checks it against Google's public keys, keeps only the scrambled id and then drops the token. We send Google nothing about you, but Google knows you signed in to this app, under its own privacy policy.
• Apple (Sign in with Apple, on iPhone), only if you choose it: the same as Google's. Our server also sends Apple the one-time code from the sign-in to get Apple's refresh token. It keeps that token encrypted and sends it back to Apple only to cancel it when you delete your account or unlink Apple. Apple tells our server if you stop using your Apple ID with the app.

We don't sell your information. Beyond the services listed here, no other company gets it.

Ads and your choices

Ads in the app come from Unity Ads, on Android and iPhone. Unity's software runs on your phone and collects its own information, as described under "Services we use".

• A full-screen ad can show when you leave a result screen, at most once every three minutes. None show in your first launch, in the first three breaks of any later launch, or during an Endless run. The No ads purchase removes full-screen ads.
• A rewarded ad shows only if you choose to watch one: to try on a look, to use one of Endless's timeouts (at most three a game) if you haven't bought the unlock, or to get three more Game Winning Drive skips after the day's three free ones. Players with the unlock never watch an ad for a timeout, and players with No ads have no limit on skips.
• Where the law requires it, Google's consent form asks before ads based on your personal information are shown. The app passes your answer to Unity before Unity starts. If you say no, you see ads that don't use it. Privacy choices at the bottom of the home screen lets you change your answer. A Unity ad also has a data privacy icon where you can opt out of ads based on your information, and you can limit them in your phone's settings (on Android: Settings, then Google, then Ads).
• On iPhone, after Google's consent form, Apple's tracking prompt asks whether the app may track you for ads. It's shown only if you can get personalized ads: not if your birth year makes you under 16, and not in Canada, where you're never tracked. If you say no, you still see ads, just not personalized ones. You can change your answer in Settings, then Privacy & Security, then Tracking.
• If your birth year makes you under 16, the app tells the ad company so (Unity is told to show you only ads that don't use a profile of you), and you only see ads that don't use a profile of you.
• In Canada, the app shows only ads that don't use your personal information (non-personalized ads).
• On Android and iPhone, Unity's age limit blocks ads for games and apps rated 17+.

Notifications

The app asks the first time you open Play a friend. If you say no, nothing is sent. If you say yes, we use notifications only for the game (your turn, a friend request, a game over), and you can turn them off at any time in your phone's settings.

How long we keep it

• Your account, team, plays, games, Endless runs, Duel and Head to Head records, roster, Career and season records, friends, blocks, reports, purchases, notification address, rewarded ads, your Playbook (and the short records of deleted plays), plays you've shared and Game Winning Drive skips: until you delete your account.
• A live Duel's state: until it ends. A live Head to Head match's state: ten minutes after it ends. A live Arena match's state: ten minutes after it ends.
• Your Arena record, cards, lineup, season results and recorded plays: until you delete your account (a recorded play also stops being offered to other players after a set number have played it). The Arena matches you played: they stay after you delete your account, no longer pointing to your team.
• A friend challenge (both drives' plays and results): until either of you deletes your account, which deletes it for both.
• Your sign-in links (the scrambled ids or code) and Apple's encrypted token: until you unlink one, make a new code, stop using your Apple ID with the app, or delete your account. A cancel Apple hasn't confirmed: up to seven more days, then deleted.
• A sign-in's one-time number: until it's used, or ten minutes. A sign-in waiting on your choice: five minutes. The note that a sign-in moved to another team: a day.
• The free Endless game's check (a scrambled phone id and a date, linked to no account): two days.
• The code and name in a deletion request made on this website that matches a team: until it's carried out (14 days later) or the team's owner keeps the team.
• A deletion request that doesn't match exactly one team isn't stored.
• Our server's technical logs (each request's details, which can include an IP address and the location it suggests, and our server's own error messages): 7 days, used only to fix problems and protect the service.

Deleting your account

In the app: Team screen → Delete account → Delete for good. It's deleted straight away (finish or concede a live Duel first).

Without the app: use drawitupgame.com/delete with your team's friend code or name. The team's owner is told in the app and can keep the team; otherwise it's deleted 14 days later.

Deleting removes your account, team, every name you submitted, your friends, blocks, reports, plays, Endless runs (and your place on its leaderboard), Duel record, your Head to Head rating, record, trophies, decks, playbook and invites, your roster's nicknames and numbers, your players' XP and levels, your Game Balls and Daily Gift, and arena sets, your Career XP and level, your season pass standing, Premium Pass record and season finishes, purchase records, notification address, rewarded ads, your Playbook and the plays you've shared (their codes and links stop working), your Game Winning Drive skips, your Arena record, cards, lineup, season results and recorded plays (no one is offered your recorded plays again), your friend challenges (for both of you), and every way you signed in. If you signed in with Apple, we also tell Apple to cancel its token. Google has nothing of ours to cancel. Other players' history of games against you stays, Arena matches you played among them, shown as "Deleted team" and linked to no one, so their records still add up. Plays other players already added to their Playbooks from your shares are their own copies and stay with them. Purchases stay with your Google Play or App Store account: Restore purchases brings them back on a new team.