Privacy policy

Codeblock Limited ("Codeblock", "we", "us") is the data controller for Drafti Ligi: we decide how and why your personal data is used.

We are registered with the Personal Data Protection Commission (PDPC).

Questions about this policy or your data: support@codeblock.co.tz.

The Drafti Ligi app, this website, the web top-up page (/topup) and your account page (/account). It does not cover the services of Apple, Google, ClickPesa or the mobile networks, which have their own privacy policies.

• Phone number and sign-in codes. You sign in with your mobile number. We text you a one-time code (OTP) to prove the number is yours. Codes expire after 5 minutes and are stored only as a one-way hash; we keep a record of code requests to stop abuse.
• Profile. Your display name, avatar, language, the Tanzanian region you choose and, if you give it, your birth year.
• Terms and preferences. The version of our Terms you accepted and when you accepted it, plus your promotional-notification preference, which is off until you opt in.
• Gameplay. Your games and moves, results, ratings and rating history, clubs, leagues, tournaments, awards and leaderboard places.
• Club search. The text you enter to search for clubs is sent to our server to find clubs by name or tag.
• Chat and reports. Messages you post in spectator, club and tournament chat, reports you make or that are made about you, and moderation actions such as mutes.
• Device and sessions. Your platform, app version, language and a server-assigned device/session identifier, used for account security and session management. Push notifications are unavailable in this release. If we activate them later, we will update this policy and our store disclosures.
• Purchases and top-ups. For in-app purchases: the product, the store's transaction id, the date and the amount (never your card details). For web top-ups: the amount, the mobile network, the phone number that paid, our order reference, the payment provider's transaction id and the status. Also your coin and gem balances, their history, and the items you own.
• Chosen region. The region you choose for your profile and regional rankings. We never collect precise (GPS) location.
• Sponsor placements. When a sponsor's banner or card is shown to you or you tap it, we record that event against your account to count views and limit how often you see it.
• Technical and security logs. IP address, request logs and error reports.

The Act only allows us to use personal data for a lawful reason. Ours are:

• To run the game and your account (signing in, matchmaking, ratings, leagues, tournaments, clubs, chat, your items and purchases): necessary to perform our agreement with you, the Terms of use.
• To keep the game fair and safe (stopping cheating, fraud, spam and abuse, moderating chat, enforcing our terms, securing our systems): our legitimate interests, and yours, in a fair and safe game.
• To process payments and keep records (top-ups, refunds, accounting and tax): our agreement with you and our legal obligations.
• Push notifications are unavailable in this release. We will update our privacy information before enabling them.
• To measure sponsorships (how many people saw a placement or watched a sponsored match): our legitimate interests. Sponsors only ever receive totals, never who you are.
• To improve Drafti Ligi (fixing faults, understanding which features are used, in aggregate): our legitimate interests.
• To meet legal duties (answering lawful requests from authorities): legal obligation.

We do not sell your personal data. Sponsor content may be selected using information from your Drafti Ligi account: your chosen region, language, club membership and participation in leagues. We also use the birth year you provide to decide eligibility for adult-only sponsor placements. We withhold those placements if your birth year does not establish adult eligibility or you have not provided it. We record impressions, clicks and viewing activity to measure sponsorships and limit repeated displays. Sponsor reports contain totals and do not include individual players' phone numbers, account IDs or message contents. Automated tools filter chat and flag possible cheating, but a person reviews an account before it is banned.

Drafti Ligi is for people aged 13 and over. If you are under 13, please don't use it; if we learn that a child under 13 has an account, we will delete it.

If you are 13 to 17, you need the permission of a parent or guardian to use Drafti Ligi and to make any purchase. For players we know to be under 18, chat is limited to preset phrases and emoji (no free text). A parent or guardian can contact us to see, correct or delete their child's data.

Chat is public to everyone in the room, and anyone may read a match's spectator chat. Every message is checked automatically for offensive words in Swahili and English, links and phone numbers. You can report a message; reported messages may be hidden automatically and are reviewed by our moderators, who can see the message and the conversation around it, hide messages and mute or ban accounts.

Chat messages are deleted after 90 days, except messages under an open report, which are kept until the report is closed.

The providers below process relevant data to provide the functions listed. We are responsible for requiring appropriate protection for personal data as required by law. We may also disclose data where the law requires it:

• Hosting and cloud storage. Railway runs our application server and PostgreSQL database. Cloudflare R2 stores game artwork, skin packs and sponsor media.
• Apple and Google, who distribute the app and process in-app purchases (App Store and Google Play billing).
• Notifications. Push notifications are unavailable in this release.
• ClickPesa, which processes mobile money and card payments on our website, and the mobile network operators (M-Pesa, Mixx by Yas, Airtel Money, HaloPesa) that carry out your payment.
• Sprint SMS sends one-time sign-in codes to the phone number you provide. Resend delivers administrative and sponsor-account service emails; players sign in by SMS rather than email.
• Sponsors receive only aggregate reports (for example "12,400 views"), never your identity.
• Authorities, when the law requires it, or to protect someone's safety.
• A buyer or successor, if Codeblock's business is merged or sold, under the same protections as this policy.

Other players see your display name, avatar, region, ratings, awards, club, games and chat messages. They never see your phone number.

Some of our providers (for example hosting, cloud storage, service email, Apple and Google) store or process data outside Tanzania. We are responsible for meeting applicable transfer requirements and arranging appropriate protection as required by law. We will limit transfers to the data needed for the provider's function.

• Account and profile: while your account exists. When you ask us to delete your account you are signed out everywhere, and the account is erased after 30 days, unless you sign in again before then to cancel.
• Games: records of public games may be kept after your account is deleted, with your name removed, so your opponents' histories and ratings stay correct.
• Chat: 90 days, longer only while a report is open.
• Sign-in codes: codes expire after 5 minutes. We keep request records for anti-abuse and account-security checks. Erasing an account removes its associated sign-in-code request records.
• Payment and top-up records: as long as applicable tax and accounting law requires.
• Security logs: retained for service security and incident investigation. Hosting-provider logs follow the provider's retention settings. Account erasure removes account-linked request, device and session records in our database.

Under the Act you have the right to:

• know how your data is used (this policy);
• access your data: download a copy from your account page;
• correct it: edit your profile in the app, or ask us;
• delete it: delete your account in the app or at drafti.co.tz/account (see how to delete your account);
• object to, or ask us to restrict, uses based on our legitimate interests;
• withdraw consent at any time, without affecting what we did before;
• not to be subject to a decision based only on automated processing that significantly affects you.

To use a right, use your account page or write to support@codeblock.co.tz. We may ask you to confirm it's you (for example with a sign-in code) and will answer within the time the Act allows.

Data travels encrypted (HTTPS/TLS). Sign-in codes and session tokens are stored only as one-way hashes. Staff access is limited by role, protected with two-factor authentication and recorded in an audit log. We never see your mobile money PIN or card number: Apple, Google and ClickPesa handle those.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the Personal Data Protection Commission as the law requires.

Codeblock Limited. Email: support@codeblock.co.tz. Website: drafti.co.tz. Support: drafti.co.tz/support.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Personal Data Protection Commission (Tume ya Ulinzi wa Taarifa Binafsi) of Tanzania: www.pdpc.go.tz.

We will update this page when our practices change, and change the date at the top. If a change matters, we will tell you in the app before it takes effect.