What this site collects

Very little, and this page says exactly what. There are no accounts, no sign-up, no password and no email address anywhere in this game. The one thing you can type is a name for your seat, and this page says where it goes and how quickly it is gone.

Last updated 24 September 2026.

Who is responsible

Hoops Auction is run by one person, Armaan Ebrahim, in India. I decide what the site collects and why, so I am the controller under the GDPR and the UK GDPR, the data fiduciary under India's Digital Personal Data Protection Act, and the person to write to about anything on this page: auctionhoops@gmail.com. That address is also the grievance contact the Indian Act asks for.

What is stored on your device

This site sets no cookies of its own. It uses your browser's storage for three things, all of which exist only to make the game work the way you asked it to:

• A game at this device, in session storage, so that reloading the page does not lose ten lots of decisions: the seat names, the players bought and the prices paid. Your browser clears it when the tab closes.
• The name you typed, in local storage, so you are not asked again next time. It stays until you change it, clear it, or clear this site's storage.
• The online room you are sitting in, in session storage: its six-character code and which seat is yours, so that a refresh puts you back in your game. It is forgotten when you leave the room or close the tab.

What reaches the server

Only when you play online. A room is a temporary record of one auction: the players on offer, the bids and sealed envelopes, the result, which franchise each seat took, and the name each person chose for their seat. Your name is shown to everybody at the same table and printed in that table's sale record and final result. Leave the name blank and the room gives your seat a numbered name, such as "Player 2", instead. Please use a nickname rather than your full name. Nobody else needs it, and the game does not either.

A finished room keeps its result for 30 minutes, so that refreshing the page still shows the scoreline, then deletes everything it holds, names included. A room nobody joins deletes itself after 30 minutes too.

A room its host makes public appears on the list of games looking for players with its code, its size and its terms. That list never shows anybody's name. A shared result link carries the rosters, the score and the random seed the game was played with, and no names at all.

What the hosting sees

The site runs on Cloudflare. Like any web host, Cloudflare necessarily handles your IP address and the details of each request in order to deliver the page, block abusive traffic and keep the site up. The site's own operational logs record a sample of requests, including the address a request came from and the room it asked for (which for a room includes the name you chose). They are kept for a few days to diagnose faults and are then deleted. They are never used to identify, track or profile anybody.

Analytics

This site uses Cloudflare Web Analytics, which counts page views and where visits came from. It does not use cookies, does not fingerprint your device and does not build a profile of you. There is no way for it, or for me, to identify an individual visitor.

Photographs

The game itself shows no photographs of players. The all-time list shows 37 portraits from Wikimedia Commons, and your browser fetches them directly from Wikimedia's servers, so the Wikimedia Foundation sees that request under its own privacy policy. Every portrait is credited on that page.

Advertising

The site is set up to carry advertising from Google AdSense to cover its running costs. No advertisement is shown yet. When advertising is switched on, this is what applies.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.

• If you are in the European Economic Area, the United Kingdom or Switzerland, you will be asked through Google's certified consent message before any advertising cookie is set, and you can say no. The game works exactly the same either way.
• If you are in a US state with a privacy law, you will be offered the choice to opt out of the "sale" or "sharing" of personal information for advertising.
• Anybody can opt out of personalised advertising at Google's Ads Settings, and out of other vendors' personalised advertising at aboutads.info.

Advertisements will be served inside an isolated frame with no access to anything else on the page, including your saved game and your name. That is a deliberate design decision, described in the project's security notes.

Why each thing is used

For the GDPR and the UK GDPR, the legal bases are:

• Providing the game you asked to play (Article 6(1)(b)): your saved game, your remembered name, and the room that shows your name to the table you joined.
• Legitimate interests (Article 6(1)(f)): keeping the site secure and working, and counting visits in aggregate. None of it is used to single anybody out.
• Consent (Article 6(1)(a)): advertising cookies, once advertising runs, in the places the law requires it. Consent can be withdrawn at any time.

Children

The game is made for a general audience and is not directed at children. If you are under 13, or under the age your country sets for agreeing to things like this, play with a parent's permission and do not type your real name. A parent who believes a child has entered personal information can write to me and I will delete it, although every room deletes itself within half an hour of finishing anyway.

Where it is processed

Cloudflare serves the site from data centres around the world, so a request is handled wherever it lands, which may be outside your country. Cloudflare relies on recognised safeguards for international transfers, such as the European Commission's standard contractual clauses.

What is never collected

• No email address or contact details. There is nowhere to enter one.
• No password or account, because there are no accounts.
• No payment information. The game is free and nothing is for sale.
• No precise location. Country-level figures are all Cloudflare reports, in aggregate.
• No personal information is sold, and none is shared for targeted advertising while advertising is off.

Your rights

Wherever you live, you can ask what I hold about you, and ask for it to be corrected or deleted. In the EEA and the UK you can also object to processing, restrict it, take a copy of your data and complain to your data protection authority. In California and other US states with privacy laws you can ask to know, correct and delete, and to opt out of any sale or sharing, with no penalty for asking. In India you can ask for a summary of what is processed, for correction and erasure, and for a grievance to be resolved.

In practice there is little to ask for. Almost everything lives on your own device, and clearing this site's storage in your browser removes it immediately. What reaches the server deletes itself within half an hour of a game ending. For anything else, email auctionhoops@gmail.com and I will answer within 30 days. There are no accounts, so I may ask for the room code to find what you mean.

Changes to this page

When what the site collects changes, this page changes with it and the date at the top moves. Advertising being switched on will be one of those changes.

Contact

Questions about anything on this page can go to auctionhoops@gmail.com. The rules for using the site are in the terms of use.