Privacy Policy

1. What we collect

• Account info: the email address and password you sign up with. Your password is never stored in plain text — only a bcrypt hash of it.
• Username: the display name you choose. It identifies you inside the app, and it is also what appears on the global leaderboard, which lists every account that has a username unless you opt out — see section 4.
• League connections: the Sleeper usernames and league IDs you add, and which team is yours in each league.
• ESPN cookies:if you connect a private ESPN league, the espn_s2/SWID cookie pair ESPN issues after you sign in, stored encrypted at rest. Your ESPN password itself is never stored — it's submitted directly to ESPN's own login page and never saved.
• Friends: who you have sent friend requests to, who has sent them to you, and who you have accepted.
• Chat messages: the messages you write in Global chat or in direct messages with friends, including any cards you share into them (see section 5), when each was sent, and how far you have read in each conversation so we can show unread counts.
• Usage analytics:basic, aggregated page analytics via Vercel Analytics to understand how the app is used. This isn't tied to your fantasy football data.
• Verification and password-reset links: when you sign up or ask to reset your password, we generate a one-time link and email it to you. Only a hashed, single-use token is stored — never the link itself — and it expires automatically (24 hours for a verification link, 30 minutes for a password reset).

2. How we use it

Your data is used only to run the app: authenticating you, fetching your leagues' scores and rosters from Sleeper/ESPN on your behalf, and computing the cross-league analysis shown on your dashboard. We don't sell your data, and we don't use it for advertising.

3. Who we share it with

We don't share your account data with third parties, other than the infrastructure providers that run the app (hosting, database, and analytics providers) and Resend, which delivers the verification and password-reset emails described above — all of whom process your data only on our behalf to keep the app running. Requests to Sleeper and ESPN happen using your own connected credentials/cookies, the same way your browser would talk to them directly. What is visible to other users is described in the next two sections: what the global leaderboard and profiles show (which you can opt out of at any time), and what you choose to post in chat.

4. Leaderboard (opt-out)

The app has a global leaderboard, and it lists every account that has a username. If you have one, you are on it by default. Being listed shows your username, your combined win/loss record across the leagues you have connected, and the players you are rooting for and against that week. Your email address is never shown, and neither are your league or team names — those are visible only to you and to people you have accepted as friends.

You can take yourself off the global leaderboard at any time, from Settings or from the bottom of the leaderboard itself, and you can put yourself back the same way. Opting out removes you from the board going forward; it does not delete the records already calculated for you, so your season is intact if you come back. An account with no username is never listed. Pick a username you are comfortable showing publicly, or opt out.

Separately from the global board, anyone you accept as a friend can see your record on a friends-only board. That is per-person consent you give by accepting the request, so opting out of the global board does not affect it — remove the friend if you want that to stop.

This used to work the other way around: the leaderboard was off until you joined it. As of the date at the top of this policy it lists everyone with a username by default. If you had previously chosen to leave the board, that choice did not carry over and you will need to opt out again in Settings.

5. Profiles, friends, and chat

Profiles.Pressing a name on a leaderboard opens that person's profile. Anyone who can see you on a leaderboard (everyone signed in, if you are on the global board; only your friends, if you have opted out) can see your profile: your username, your season and weekly record, the players you are rooting for and against that week, and the scores in each of your matchups. Your league and team names on that page are shown only to you and your friends.

Global chat is a single public room. Anything you post there — including your username next to it — can be read by every signed-in user, whether or not they are your friend, and whether or not you are on the global leaderboard. Posting there requires a username and a verified email address.

Direct messages can only be exchanged with people you have accepted as friends, and can only be read by the two of you. If either of you removes the other as a friend, the conversation is closed to both of you; its messages are kept and become readable again if you become friends again.

Shared cards.When you share a matchup, outcome, or rooting card into a chat, a snapshot of what that card showed you at that moment is saved with the message — which can include your team names, your opponents' team names and logos, league names, scores, and player names. Your friends see the card exactly as you did. Anyone else who can read the conversation (in Global chat, that is everyone signed in) sees the scores and players, but with every team name replaced by a placeholder ("Team A", "Team B"), league names hidden, and no team logos. The original names are still stored with the message, and become visible to someone if they later become your friend.

Messages are stored in our database in readable form, the same way the rest of your account data is. They are not end-to-end encrypted. We don't read your direct messages as a matter of course, but we may access messages where needed to investigate abuse reported to us, keep the service secure, or comply with the law. Anyone who can read a message can report it. A report sends a copy of that one message — its text, any card in it, who wrote it and when, and who reported it and why — to the app's administrator, including when the message was a direct message. The copy is kept with the report even if the message is later deleted. Global chat may be moderated, which can include removing messages that break the Terms.

6. Cookies

We use one cookie to keep you signed in between visits — that's it. There are no advertising or third-party tracking cookies, and no cross-site tracking. Your ESPN espn_s2/SWID cookies (see above) aren't browser cookies at all; they're stored encrypted in our database and used server-side to talk to ESPN on your behalf. Because the only cookie we set is strictly necessary to run the app, there's nothing non-essential here to ask your consent for.

7. How long we keep it

We keep your data for as long as your account exists. Removing a single connected league or saved ESPN login deletes that specific data immediately. Chat messages are kept until you delete them (you can delete any message you wrote, at any time) or delete your account. Deleting your account (available any time in Settings) permanently removes your account, every connected league, every saved login, your friendships, and every chat message you wrote — this can't be undone. Messages other people sent you are theirs and are not removed when you delete your account.

8. Security

Passwords are hashed with bcrypt. ESPN cookies are encrypted at rest. Verification and password-reset links use single-use, short-lived tokens, and we rate-limit login, signup, and password-reset attempts to reduce abuse. We use standard safeguards to protect your data, but no method of storage or transmission is 100% secure, and we can't guarantee absolute security.

9. Your choices

You can remove any connected league or saved ESPN login, or delete your account entirely, at any time from Settings — no need to contact anyone. You can also take yourself off the global leaderboard whenever you like, which removes your username and stats from it, and put yourself back the same way. You can delete any chat message you wrote, remove any friend, and download a copy of your data — including your friends list and the messages you have sent — from Settings.

10. Changes to this policy

We may update this policy from time to time. Continued use of the app after a change means you accept the updated policy.

11. Related

See our Terms of Service for the rules that govern using the app.