Privacy Policy

What we collect

• Your email address. It is the only way to sign in: we email you a one-time code. It is also where league email — digests, invitations, trade notifications — is sent.
• Your name and team name. Shown to the other members of any league you join, on the standings, the auction room and the trade screens. Both are whatever you type; neither has to be your legal name.
• What you do in a league. Bids, the participants you own, trades, nominations, standings snapshots and your autodraft instructions. This is the game itself, and other members of your league can see it.
• A device push token, if you turn on notifications in the app. It identifies a device to the push service, not a person, and is deleted when you sign out everywhere, delete the account, or turn notifications off.
• Crash and error reports, via Sentry, when something goes wrong. These carry technical context (the page or route, a stack trace, your user id) so a bug can be found. Credentials are scrubbed before the report is sent.
• Ordinary server logs, including IP addresses, kept to keep the service up and to enforce the rate limits that stop someone spraying sign-in codes at other people's addresses.
• Feedback you send through the in-app widget, along with the screen you sent it from and your app version. A copy is filed as an issue in our private code repository so it can be fixed.

We do not collect your location, contacts, photos, calendar, health data, or advertising identifiers. The app asks for no such permission.

What we do not do

• No advertising. There are no ads, no ad SDKs, and no ad identifiers.
• No tracking. Nothing here follows you across other apps or websites, and no analytics or attribution SDK is embedded. The website's only cookies are the one that keeps you signed in and the two its sign-in library needs to complete a sign-in; there are no advertising or analytics cookies.
• No sale of data. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
• No real-money gambling. The auction budget is play money. Nothing is wagered, deposited or paid out, and the service takes no payment at all.

Who else sees it

Other members of a league you join see your name, your team name and everything you do in that league. Beyond that, data reaches only the services that run the product:

• Hosting and database (Railway, Supabase) — where the application and its database run.
• Email delivery (Resend) — sign-in codes, invitations and league email.
• Error monitoring (Sentry) — crash and error reports.
• Push notifications (Expo, and through it Apple and Google) — the device token and the text of a notification you have opted into.
• AI commentary (Anthropic) — league facts such as team names, scores and standings are sent to generate the match commentary and the draft recap. Your email address is not.
• Sports data providers — these send us results; we send them nothing about you.

We will also disclose information if the law requires it. Otherwise it stays with the services above.

How long it is kept

Account and league data is kept while your account exists. Sign-in codes expire within minutes. A session expires within 30 days of its last use; in the mobile app it also cannot be renewed for more than 180 days without signing in again. Error reports and server logs age out on the retention the respective service is configured with.

Deleting your account

You can delete your account yourself — in the app, or on the account page of the website. No email to us, no waiting.

If you have never joined a league, the account is erased outright. If you have, we keep the rows your leagues are made of — the bids and the roster that are half of everybody else's season — with you stripped out of them: your address is replaced with an unusable placeholder, your name becomes “Deleted manager”, your team name is cleared, your sign-in codes and device tokens are deleted, and pending trades and invitations are cancelled. The account cannot be signed into again.

One exception: deletion is refused while a league you are in has a draft actually under way, because leaving mid-draft strands a seat other people are bidding against. That refusal lifts when the draft finishes, and in any case a week after it started.

Your sessions

Signing in creates a session — a cookie in a browser, a token in the app. You can end every session on every device at once from the account page, which also removes your device push tokens. Deleting your account does the same thing permanently.

Children

The service is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, email us and we will delete it.

Changes

If this policy changes, the date at the top changes with it. Material changes will also be mentioned in the app.