Drawdown Derby

Privacy policy

Effective October 21, 2026. Version 2026-10-21.

Autoliquidated LLC d/b/a Drawdown Derby, a Texas limited liability company ("Derby," "we," "us," or "our"), operates this website and game and is responsible for the personal information described here. This Policy covers accounts, gameplay, purchases, waitlist and beta invitations, support, and our communications. Contact hello@drawdownderby.com for privacy questions or requests.

1. Information we collect and its sources

Account and authentication information. You provide an email address, display name, and confirmation that you are at least 18 and accept the Terms. Clerk manages authentication and sessions, including sign-in methods and security information. Derby receives the account identifiers and information needed to recognize you and stores its member identifier, email, display name, account timestamps, age confirmation, and accepted Terms version. Optional passwords are handled by Clerk; Derby's game database does not store your password. If you connect Discord, the account identifiers and authorized profile information used for that connection come from Discord and Clerk.

Gameplay and transactions. We collect records created through play: horses, names, lineage, ownership, care, training, equipment, entries, results, virtual tickets, rewards, $Vibebond credits and debits, inventory, and related timestamps and identifiers. Social features create crew, profile, achievement, and historical records. We also keep transaction and moderation records needed to investigate errors or abuse.

Payments. Stripe collects payment and billing information during checkout. We receive order and payment identifiers, purchased items, amounts, currency, status, and information about refunds or disputes needed to deliver and support the purchase. We do not receive or store full payment-card numbers or card security codes. Stripe handles payment information under its own notice as well as its service arrangements with us.

Waitlist and messages. If you join the waitlist, Clerk stores your email and invitation status for beta and launch access. We use that list for access invitations and launch notices, not unrelated advertising. Support emails and bug reports contain the information you choose to send, such as your account email, problem description, device details, and screenshots. Do not include passwords, sign-in codes, full card numbers, or another person's private information. We do not automatically capture your screen when you open a reporting link.

Sponsorship inquiries. We collect the company name, contact email, optional contact name, sponsorship interests, and message you submit to respond to your inquiry. We store the inquiry and its delivery status, and send an internal email notification through Resend. We also store a hashed network identifier to limit spam. Submitting this form does not add you to a marketing list.

Technical information. Our hosting and authentication providers process IP addresses, request details, browser and device information, timestamps, session and security events, and delivery records needed to operate and protect the service. Clerk sends authentication and waitlist invitation emails. Resend delivers other configured service emails, including purchase receipts, account notices, and sponsorship inquiry notifications. These providers process delivery status and related message metadata.

2. Purposes of processing

We use information to create and secure accounts, authenticate requests, operate gameplay and social features, preserve progress and official results, maintain the virtual ledger, deliver purchases, reconcile refunds, answer support requests, investigate bugs and abuse, send requested invitations and service notices, comply with legal obligations, and establish or defend claims. Age and agreement records document the declarations collected at sign-up.

Where a law requires a legal basis, we rely as applicable on performing our agreement with you, complying with legal obligations, our legitimate interests in a secure and functioning service subject to your rights, or consent for processing that requires it. Consent can be withdrawn for that processing without affecting its lawfulness before withdrawal. Providing data required for an account, transaction, or support investigation is necessary for us to perform that action.

We do not sell, rent, or trade personal information, use it for cross-context behavioral advertising, or use advertising trackers. We do not run a separate advertising or behavioral analytics service. Operational logs and game records remain necessary for the service. Gameplay formulas and fraud controls are used to run the game, not to make employment, credit, insurance, or similar eligibility decisions about you.

Display names, horse and crew names, horse appearances and lineage, race entries and results, rankings, achievements, and Hall of Fame or historical records can appear to other players or on public game pages. Screenshots, broadcasts, and shared links can expose that displayed information beyond the game. Your account email, authentication credentials, and payment details are not public profile fields. Do not put private information into a name or other field intended for display.

A support or bug report is sent to the operator and relevant service providers; it is not automatically published as a public post. We may use a report to investigate and correct the issue, sharing only information reasonably needed for that purpose. Third-party communities, including Discord, have their own privacy rules and audiences.

4. Service providers and other disclosures

We use Cloudflare for hosting, application infrastructure, network protection, logging, and inbound email routing; Clerk for identity, sessions, waitlist records, and authentication or invitation emails; Stripe for payments and payment disputes; and Resend for configured outbound service mail. They receive the categories of information needed for those functions. Providers may also process limited information for their own security, fraud prevention, and legal obligations under their notices.

We may disclose information to professional advisers, authorities, or other parties when reasonably necessary to meet a legal obligation, protect users or systems, investigate fraud, or exercise or defend legal rights. A merger, acquisition, financing, or sale of assets may involve disclosure under appropriate confidentiality protections and transfer to a successor, subject to applicable law and notice where required. This does not authorize an unrelated advertising use contrary to this Policy.

Provider notices: Cloudflare, Clerk, Stripe, and Resend. Links to third-party sites do not place their independent services under this Policy.

5. Cookies and browser storage

Authentication cookies and session storage support sign-in and security. Browser storage also remembers sound and narration choices, store selections, and certain pending-action identifiers used to recover from interruptions without duplicating an action. Older browsers can retain legacy stable identifiers. These are functional uses, not advertising identifiers.

You can clear or restrict cookies and local or session storage through browser settings. Doing so can sign you out, reset preferences, or remove a local pending-action record; it does not by itself delete your server account or transaction history. Blocking required storage can prevent features from working. We do not sell or share data for targeted advertising, so there is no such activity to opt out of through an advertising preference signal.

6. Retention and deletion

We retain account and gameplay information while it is needed to provide the service and address account support. Payment, virtual-ledger, consent, security, and dispute records can remain after closure when needed for legal or accounting obligations, fraud prevention, a pending claim, or establishing what occurred. Retention depends on the record's purpose, applicable obligations, and whether an investigation or dispute remains open; we do not promise immediate deletion of every record.

Waitlist information is retained to manage requested invitations until it is no longer needed or you request removal, subject to any required limited record. Support correspondence is retained as needed to resolve and document the issue. Information no longer needed is deleted or de-identified as appropriate. Backups can retain residual copies until their normal replacement, subject to safeguards and restricted use. Non-identifying race history and aggregate records may remain; a deletion request will be assessed for removal or anonymization of identifying details in historical records.

7. Privacy requests and choices

Request access, a copy, correction, or deletion by emailing hello@drawdownderby.com. You can use the same address to request account closure or waitlist removal. You need not create a new account to make a request. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent, or an authorized representative. We do not discriminate against you for exercising a protected right.

We verify identity and authority before disclosing or changing protected records, using only information reasonably needed for verification. An account session alone may not be sufficient for a sensitive request. We aim to respond within 30 days and meet the deadline required by the law applicable to the request; we will explain any permitted extension or refusal. Some records must be retained for legal obligations, security, or others' rights. We will explain an applicable exception rather than promise deletion we cannot perform.

To appeal a denial, reply to our decision or email the same address with "Privacy appeal" and the reason for your appeal. We will review and provide a written response within the applicable legal deadline. You may also complain to your local data-protection authority or, for Texas matters, the Texas Attorney General. These procedures do not limit mandatory privacy rights.

Service emails needed for sign-in, security, receipts, or a requested transaction are distinct from optional announcements. Ask to leave the waitlist or unsubscribe from optional messages where offered; closing an account does not prevent a legally required notice. Changing browser storage settings does not unsubscribe an email address.

8. Adults only

The service is restricted to adults 18 and older and is not directed to children. We do not knowingly accept underage accounts. An age declaration does not independently verify age. If you believe an underage person has provided information, contact us so we can investigate, restrict access, and delete information as appropriate, retaining only what law or a legitimate security obligation requires.

9. Security and international processing

We use reasonable administrative, technical, and organizational safeguards, including encrypted transport, access restrictions, and dedicated authentication services. No system is completely secure. Protect your email and sign-in methods and report suspected unauthorized access promptly. We provide legally required notices if a personal-data breach affects you.

Derby operates from the United States. Providers can process information in the United States and other countries whose laws differ from yours. Where applicable law requires safeguards for an international transfer, those requirements apply to that transfer. Contact us with questions about processing or applicable safeguards; this Policy does not assert that all provider data stays in one country.

10. Updates and contact

We identify updates by the effective date and version above and give notice of material changes through the site or account communications as appropriate. We obtain consent where required before using information for a new purpose that requires it. A revised notice does not by itself authorize an incompatible use of information already collected.

Privacy contact: hello@drawdownderby.com. Operator: Autoliquidated LLC d/b/a Drawdown Derby, Texas. See the Terms of use for gameplay and purchase conditions and the Contact page for support.