Privacy policy

What stays in your browser

These are saved in your browser's local storage so the site remembers them between visits. They aren't stored on our servers:

• Your league settings (format, teams, scoring, lineup slots, projection sources).
• From Settings, if you add them: a name to greet you by, and your players-to-watch lists (player IDs per league).
• A connected league's name, IDs and settings, which team is yours, and its prize money if you enter it.
• A roster you enter by hand.
• Your Sleeper username, so you don't have to retype it.
• The dates of your first and latest counted visit, so a visit is counted once a day and once a week (see below).
• Whether you've finished or skipped the site tour, so it isn't offered again.
• A random ID from PostHog, our product analytics tool, so it can tell a returning browser from a new one (see below). It isn't linked to your name, email or account.

Clearing your browser's site data removes all of it.

If you create an account

An account is optional. If you create one, we store:

• Your email address, and if you sign in with Google, your Google account ID (not your Google password or contacts).
• Your calculator setup (the same settings listed above), so it loads on any device you sign in on.
• Sleeper leagues you save: league ID, name and settings, your Sleeper user ID, which team is yours, your strategy for that league, and its prize money if you enter it (buy-in and payouts, used only to estimate expected winnings).
• Your email preferences (the weekly report, and for each league whether you want a trade-deadline reminder and which deadline we last reminded you about), and when you created the account and last signed in.
• Only if you choose to keep your Yahoo connection on your account: your Yahoo refresh token (encrypted), and for each Yahoo league only its league key, which team is yours, the league type, strategy and prize money you chose. We use these only to read your own Yahoo leagues on your other devices, for your weekly report and to record their daily playoff odds. Remove it anytime on your account page.

Yahoo's own data (league names, settings, rosters and standings) is never saved to your account; it's read from Yahoo when needed. Sign-in codes are stored only as a one-way hash and expire after 10 minutes.

Email. We send sign-in codes when you ask for one, and the weekly league report (new accounts get it; turn it off for all leagues or one league on your account page, or with the unsubscribe link in any report). If you ask for a trade-deadline reminder for a league, we send one email a few days before that league's trades lock (turn it off on your account page). Emails are sent through Resend, our email provider, which receives your address and the email's content to deliver it.

Deleting your account. The Delete account button on your account page removes your account and everything saved with it immediately. You can also email us to ask.

Cookies

We use only cookies the site needs to work. There are no advertising or tracking cookies.

• Yahoo session (only if you connect Yahoo): your Yahoo access and refresh tokens, encrypted, so the site can load your leagues. It lasts up to 90 days and is deleted when you click Sign out of Yahoo.
• Yahoo sign-in check: a random value that protects the sign-in from forgery. It expires after 10 minutes.
• Access cookie: only while the site is in private beta, to remember that you entered the beta password.
• Account session (only if you sign in): a random token that keeps you signed in for up to 90 days. It's deleted when you sign out.
• Google sign-in check (only when you use Google): a random value that protects the sign-in from forgery. It expires after 10 minutes.

Sleeper and Yahoo leagues

When you connect a Sleeper league, our server looks up your username and league on Sleeper's public API and caches the response for a few minutes. Sleeper league data is public; no password is involved.

When you connect Yahoo, you sign in on Yahoo's own site and grant read-only access to your fantasy sports data. Your Yahoo password never reaches us. We fetch your leagues and rosters only when you ask (or, if you keep your Yahoo connection on your account, for your weekly report and daily playoff odds), use them to analyze trades, and don't store them on our servers; for leagues viewed on the site we keep only our own daily playoff-odds numbers per team, as for Sleeper leagues. You can revoke access at any time in your Yahoo account's app permissions. Fantasy data provided by Yahoo Fantasy.

Logs and service providers

The site is hosted on Vercel, which keeps standard request logs (such as IP address, browser type and the page requested) for security and troubleshooting. To protect the site from abuse, we count recent requests per IP address in memory for about a minute. Player and projection data lives in a Supabase database, which also holds the account details above for people who create one, and nothing about other visitors.

We use Vercel Web Analytics to count visits. It sets no cookies and doesn't identify you: it records the page path (without anything after the "?", so trades and league IDs in links aren't sent), the referring site, and your country, device type, browser and operating system. Visitors are counted with a short-lived hash that resets every day, so we can't follow anyone over time or across sites.

We use PostHog to understand how the site is used: which pages and buttons people use, where they get stuck, and how fast pages load. It sets no cookies. It keeps a random ID in your browser's local storage so it can tell when you come back, and for some visits it records an anonymized replay of the page (clicks, scrolling and what's on screen) so we can fix confusing spots. Everything you type is hidden from replays, and so is your email address. Events leave out anything after the "?" in page addresses, and we never tell PostHog who you are. IP addresses are discarded. If your browser is set to a European time zone, or sends a Global Privacy Control or Do Not Track signal, PostHog stores nothing in your browser and records no replays; it only counts visits with a daily hash, like Vercel above. PostHog is based in the US and stores this data there for up to a year.

We also keep daily totals of a few actions, such as how many trades were analyzed, links shared, share-link previews shown and leagues loaded, and how many browsers visited that day or week for the first time or came back. Your browser works out whether a visit is new from the dates it keeps (above) and sends only the name of what to count. These are plain counts with nothing about who did them.

For Sleeper leagues that are viewed on the site or saved to an account, we save each team's playoff odds once a day during the regular season (team numbers, percentages and that day's team rankings only, no names), to show how odds and rankings change over time. These are kept for two seasons.

If you use the feedback form, your message, the email address you give (if any; or your account email when you're signed in and leave it blank), the page you came from and your browser type are emailed to us so we can read and answer it. The site doesn't store the message; it stays in our inbox.

If you join the waitlist for a league site we can't connect yet (Yahoo, ESPN and others), we save your email address and the sites you picked, and use them only to email you once when those leagues can be connected. Ask us to remove it any time at the contact address below.

When something on the site breaks, we log the error message and the page it happened on, and email ourselves an alert, so we can fix it. Email addresses and similar details are removed from the message first, and nothing about who hit the error is kept. Error logs are deleted after 90 days.

Children

The site isn't directed to children under 13, and we don't knowingly collect information from them.

Changes and contact

If this policy changes, we'll update the date at the top. Questions? Email contact@fantasytradehero.com.