Last updated: September 24, 2026
The short version
The Draw needs very little about you. Play anonymously and everything stays on your device. Sign in and we keep your email address, your guesses and scores, and a random account id. We do not sell personal information and we do not run advertising.
What we collect
If you sign in: your email address (the account itself), your password if you set one (our authentication provider keeps only a salted hash of it), the one-time links we email you, and your plays — guesses, results, streaks, Mulligans, and days you made the cut — tied to a random account id.
If you play anonymously: nothing is sent to our servers about you beyond the guesses needed to score a round; progress is stored in your browser's local storage and can be cleared by you at any time. When you finish a round, we add one to that puzzle's anonymous tally — your score and number of guesses, nothing else: no IP address, no cookie, nothing that could tell it was you.
Analytics: when enabled, we record product events (a puzzle was viewed, a guess was made, a round was solved or picked up, a share was copied, a sign-in started or completed). Events carry the game, puzzle number, and outcome — never your email — and are linked only to the random account id when you are signed in. There is no session recording and no ad tracking.
Server logs: our hosting provider keeps standard request logs (IP address, browser, timestamps) for security and debugging, for a limited time.
Who processes it for us
POLE & Company LLC uses these providers, each under its own privacy terms: Supabase (authentication and database, hosted in the US East region), Vercel (web hosting and edge delivery), PostHog (product analytics, when enabled), and Resend (transactional and product email). When you choose a password we check it against Have I Been Pwned's Pwned Passwords list: only the first five characters of the password's SHA-1 hash are sent, never the password. We share data with them only to run The Draw. We may also disclose information when the law requires it or to protect the service and its players.
Sign-in links are transactional. If we send product email — new games, launch news — every message will identify POLE & Company LLC as the sender, include a valid postal address, carry an honest subject line, and include a working unsubscribe link; opt-outs are honored within ten business days. [Postal address — pending.]
Research panel (opt-in, 18+)
[Placeholder — pending counsel.] Signed-in adults may opt in to a research panel run by POLE & Company LLC for The Scramble Report, a separatePOLE & Company LLC research product (cross-product disclosure: what you tell the panel is used there, not in the games). Joining requires confirming you are 18 or older, accepting a versioned research consent, and acknowledging that some interviews and analysis are conducted with AI. Optional profile answers (country, region, metro or ZIP prefix, home course, and handicap, rounds, years-playing and age bands) are used to describe the panel in aggregate and to choose whom to invite. Interviews are recorded and transcribed with your consent at the time; quotes are anonymized before publication. Completed interviews may be thanked with complimentary Pass time. You can leave the panel or delete your account on your account page at any time; leaving stops new invitations and does not withdraw anonymized findings already published. [Recording-consent wording, retention period and the AI-disclosure text — pending counsel.]
Children
The Draw is a general-audience service for people 13 and older. We do not knowingly collect personal information from children under 13. If you believe we have, contact us and we will delete it.
Your choices and rights
You can play without signing in. You can clear anonymous progress by clearing your browser storage for thedrawgolfgames.com. Signed-in players can download everything we hold (profile, plays, panel opt-in, Pass) and delete their account from the account page; deletion removes the account, email, profile, opt-in and Pass, and leaves past guesses only as anonymous rows with no account attached. Depending on where you live you may have additional rights (access, correction, portability, objection); we honor them on request.
Retention and security
Account and play data are kept while the account exists. Sign-in links expire after a short window. We use encrypted connections and keep administrative access limited to the operator. No method of transmission or storage is perfectly secure.
Changes
We will post updates here with a new date. Material changes to how we use signed-in data will be announced by email.
Contact
POLE & Company LLC · [postal address — pending] · [privacy contact email — pending]. See also our Terms of Use.