Privacy Policy

• Account information: Email address, name, and password (or authentication via Google OAuth).
• Fantasy platform credentials: ESPN session cookies (SWID, espn_s2) or Yahoo OAuth tokens used to access your fantasy league data. Sleeper uses a public API and requires only your username. MFL has no OAuth option, so we store your MFL username and password. All platform credentials are stored encrypted at rest and are never returned in API responses.
• Auction Cipher browser extension (optional): We publish a Chrome extension that fills in your ESPN cookies for you so you do not have to look them up by hand. It reads only your ESPN SWID and espn_s2 cookies, only when you click the button on our add-league page, and it sends them only to us for the sign-in you asked for. It reads no other site and no other cookie. Installing it is entirely optional. You can always enter your ESPN cookies manually instead, and you can remove the extension at any time from your browser.
• League data: Auction draft results, league settings, team and manager names, and related statistics imported from ESPN, Yahoo, Sleeper, and MFL, and any settings you edit.
• League data you upload yourself: If your league is on a platform we do not connect to, you can create a league manually and upload its draft history from a CSV template we provide. That file contains whatever you put in it, which normally includes the names your league mates use as managers and team names. For a league on a connected platform whose draft happened offline, you can enter that season’s prices yourself; every member of that league sees them. Upload only information you are comfortable sharing with us, and see section 5 for how to remove it.
• Content you create: Custom player rankings you upload, strategies, target and avoid tags, position notes, keeper lists, and valuation inputs you save in your workspace.

• Device and browser information: Your browser’s user-agent string (browser type, operating system, and device type) and a device category (mobile, desktop, or tablet) are logged when you log in, along with a timestamp, to help us understand how the Service is accessed and to support account security. Our administrators can view this login history.
• Basic analytics: Anonymized, aggregate usage data collected via Vercel Analytics (e.g., page views, device type). No personal information or individual browsing behavior is tracked.

We use one cookie, to keep you signed in. We also use your browser’s local storage for your theme choice, tour and notice dismissals, and workspace view state, and we cache data locally in your browser to improve performance. These are essential for the Service to function. You can disable cookies in your browser settings, but this may affect your ability to use the Service.

We do NOT collect or track:

• IP addresses in our database. IP addresses are used in memory for rate limiting, appear in short-lived server access logs held by our hosting provider, and may be processed by our error-monitoring provider for diagnostics. We do not store them in our database or use them to profile you.
• Detailed individual browsing behavior or usage analytics beyond aggregate page views, your login history, and error reports.
• Tracking cookies for advertising purposes.
• Location data.

• Public auction values: The auction draft data from leagues synced to the Service feeds our public Auction Values and Market Analysis pages as anonymized aggregates. A cohort is published only when it holds at least ten leagues, and no league, manager, or user is identified. The demo league is excluded.
• Shared league records: A fantasy league is one record in the Service. If a league mate also adds your league, they see the same draft results and league settings, including the team and manager names your platform reports, and a league settings edit either of you makes applies to both. Your workspace (strategies, tags, notes, and Market page choices) stays private to you.
• The demo league: The public demo is a copy of a real league’s auction history with the manager and team names replaced. The prices are real.
• Contact form: When you write to us through the contact form, your message, its category, and your name and email address are delivered to our support inbox through our email provider, with your address set as the reply-to.
• Administrative access: Our administrators can see each account’s email address, name, leagues, login history, and a masked payment reference; can edit or delete an account or send it a password reset; and can join any league to inspect its data when supporting you. Administrative access is limited to operating and supporting the Service.

• ESPN and Yahoo: To retrieve your fantasy league data via their APIs using the credentials you provide.
• Sleeper: To retrieve your fantasy league data via its public API (username only, no credentials).
• MFL: To retrieve your fantasy league data via its API using the username and password you provide. MFL has no OAuth option, so your password is sent to MFL only to authenticate and is stored encrypted at rest.

Leagues you create and upload manually involve no fantasy platform at all. We hold no credentials for them and send nothing about them to any platform. Prices you enter for an offline season of a connected league are stored with that league and sent to no platform.

• Railway: Cloud hosting (United States) for our database and backend services.
• Vercel: Hosting (United States) for our website and frontend.
• Vercel Analytics: Basic website analytics (device type and aggregate page views only, no personal tracking).
• Sentry: Error-monitoring service that captures application errors and exceptions to help us diagnose and fix issues. Sentry may collect technical information such as stack traces, browser type, and IP addresses solely for error-reporting purposes. Error reports from our servers carry your account id number so we can trace a problem to an account, and the website sends a small sample of page-load timings for performance monitoring.
• Stripe: Payment processing (United States) for one-time league purchases. Stripe receives your payment information directly, including your billing address, which is collected to calculate sales tax where we are required to charge it. We do not store credit-card numbers. We keep Stripe’s customer, checkout, and payment identifiers and the payment event records Stripe sends us, which include the billing name, email, and address Stripe collected.
• Brevo: Email service provider for transactional emails.

These providers are bound by data-protection obligations and may use your information only to provide services to us.

We incorporate player rankings and projections from FantasyPros and player-identity and bye-week data from nflverse. These are inbound data sources. We do not send your personal information to them. See our Data Sources page for details.

We may disclose your information if required by law or in response to valid legal requests (subpoenas, court orders, etc.).

Your data is stored on servers in the United States.

• Active accounts: We retain your data while your account is active.
• Deleted accounts: When you delete your account, your account, credentials, workspace, and login history are permanently removed from our database. League draft records, including team and manager names, remain because leagues are shared with other members (see section 3.0). Payment records are retained for accounting. Data may persist briefly in automated backups before being rotated out.

We implement reasonable security measures to protect your information, including encrypted connections (HTTPS/SSL), encryption of platform credentials at rest, and industry-standard authentication and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

You may authorize another person or entity to submit requests on your behalf where permitted by law. We may require verification of the agent’s authority.