Privacy Policy

1. What we collect

• Account info: the email address and password you sign up with. Your password is never stored in plain text — only a bcrypt hash of it.
• Username: the display name you choose. It identifies you inside the app, and it is also what appears on the global leaderboard, which lists every account that has a username unless you opt out — see section 4.
• League connections: the Sleeper usernames and league IDs you add, and which team is yours in each league.
• ESPN cookies:if you connect a private ESPN league, the espn_s2/SWID cookie pair ESPN issues after you sign in, stored encrypted at rest. Your ESPN password itself is never stored — it's submitted directly to ESPN's own login page and never saved.
• Usage analytics:basic, aggregated page analytics via Vercel Analytics to understand how the app is used. This isn't tied to your fantasy football data.
• Verification and password-reset links: when you sign up or ask to reset your password, we generate a one-time link and email it to you. Only a hashed, single-use token is stored — never the link itself — and it expires automatically (24 hours for a verification link, 30 minutes for a password reset).

2. How we use it

Your data is used only to run the app: authenticating you, fetching your leagues' scores and rosters from Sleeper/ESPN on your behalf, and computing the cross-league analysis shown on your dashboard. We don't sell your data, and we don't use it for advertising.

3. Who we share it with

We don't share your account data with third parties, other than the infrastructure providers that run the app (hosting, database, and analytics providers) and Resend, which delivers the verification and password-reset emails described above — all of whom process your data only on our behalf to keep the app running. Requests to Sleeper and ESPN happen using your own connected credentials/cookies, the same way your browser would talk to them directly. The only thing visible more widely is what the global leaderboard shows to other signed-in users, described in the next section — and you can take yourself off it at any time.

4. Leaderboard (opt-out)

The app has a global leaderboard, and it lists every account that has a username. If you have one, you are on it by default. Being listed shows your username, your combined win/loss record across the leagues you have connected, and the players you are rooting for and against that week. Your email address is never shown, and neither are your league or team names — those are visible only to you and to people you have accepted as friends.

You can take yourself off the global leaderboard at any time, from Settings or from the bottom of the leaderboard itself, and you can put yourself back the same way. Opting out removes you from the board going forward; it does not delete the records already calculated for you, so your season is intact if you come back. An account with no username is never listed. Pick a username you are comfortable showing publicly, or opt out.

Separately from the global board, anyone you accept as a friend can see your record on a friends-only board. That is per-person consent you give by accepting the request, so opting out of the global board does not affect it — remove the friend if you want that to stop.

This used to work the other way around: the leaderboard was off until you joined it. As of the date at the top of this policy it lists everyone with a username by default. If you had previously chosen to leave the board, that choice did not carry over and you will need to opt out again in Settings.

5. Cookies

We use one cookie to keep you signed in between visits — that's it. There are no advertising or third-party tracking cookies, and no cross-site tracking. Your ESPN espn_s2/SWID cookies (see above) aren't browser cookies at all; they're stored encrypted in our database and used server-side to talk to ESPN on your behalf. Because the only cookie we set is strictly necessary to run the app, there's nothing non-essential here to ask your consent for.

6. How long we keep it

We keep your data for as long as your account exists. Removing a single connected league or saved ESPN login deletes that specific data immediately. Deleting your account (available any time in Settings) permanently removes your account, every connected league, and every saved login — this can't be undone.

7. Security

Passwords are hashed with bcrypt. ESPN cookies are encrypted at rest. Verification and password-reset links use single-use, short-lived tokens, and we rate-limit login, signup, and password-reset attempts to reduce abuse. We use standard safeguards to protect your data, but no method of storage or transmission is 100% secure, and we can't guarantee absolute security.

8. Your choices

You can remove any connected league or saved ESPN login, or delete your account entirely, at any time from Settings — no need to contact anyone. You can also take yourself off the global leaderboard whenever you like, which removes your username and stats from it, and put yourself back the same way.

9. Changes to this policy

We may update this policy from time to time. Continued use of the app after a change means you accept the updated policy.

10. Related

See our Terms of Service for the rules that govern using the app.