Privacy Policy

v1 — September 2026

The short version: we store your email, an optional Sleeper username or ESPN league id, and the league data you ask us to sync. We never see your card details, we don't run ads or trackers, and you can delete everything yourself.

What we store

• Your account — email address, an optional display name, your theme preference, and which plan (if any) you're on.
• Your league link — an optional Sleeper username or ESPN league id, and which team in a league is yours.
• ESPN cookies, encrypted, only if you link a private league — the espn_s2 and SWID values you paste in, encrypted with a key held by the hosted service (AWS KMS), used solely to read that league from ESPN on your behalf, and removable from your Account page at any time.
• League data — rosters, matchups, results, transactions and scoring settings pulled from Sleeper's or ESPN's public, read-only APIs. This is data your league platform already publishes; we store a copy so your boards and digests work.
• What we generate — projections, matchup odds and weekly digests for your league. Digest artwork is kept for 180 days.

Passwords are handled by our identity provider (AWS Cognito) — the app never stores your password. Sign-in with Google shares only your verified email address with us.

What we never store

• No payment data. If you start a paid plan, checkout and card handling happen entirely on Stripe. We keep only a customer reference and your subscription status — never a card number.
• No ads, no trackers, no analytics scripts. There is no third-party JavaScript on this site.

Cookies

Two, both essential: a session cookie that keeps you signed in, and a CSRF token that protects forms. That's the whole list — there is no consent banner because there is nothing to consent to.

Who can see your data

Members of a league you've joined can see that league's shared boards and digests — the same information Sleeper already shows your league. Nobody outside your league sees your league data, and we do not sell or share personal data with anyone.

Deleting your data

The Delete account button on your Account page removes your account, league memberships and sessions immediately, and deletes your sign-in identity so the email address is free to register again. You can also ask us to do it by email.

If a paid plan lapses, your league data is kept for 90 days in case you come back, then the league link is removed.

Where it lives

Data is stored on Amazon Web Services in the United States, encrypted in transit and at rest, with automated backups kept for a limited period.

Changes and contact

If this policy changes in a way that matters, you'll be asked to review it at your next sign-in, and the version stamp above will change. Questions or deletion requests: support@fspn.ragealley.com.