Privacy Policy

The Fantasy War Room is a fantasy football analytics tool. It stores the things it needs to do that job — your rankings, your league links, your draft — and it does not sell them, does not use them to advertise to you, and does not load any third-party tracking or analytics code. There is no advertising network, no tracking pixel, and no session-recording tool in this app.

We do keep count of which features get used — which pages get opened, which panels get looked at, which buttons get pressed — so we can tell what is worth building and what is quietly broken. That is measured by our own code into our own database, never by an outside company, and it is described in section 3.

The three parts most worth reading are section 2 (your data is not for sale — the whole promise, in plain terms), section 5 (the ESPN credentials you may choose to give us) and section 6 (league data is shared with your leaguemates by design, and some trade records outlive your account).

Concretely, all of the following are things we do not do, with anyone, for any amount of money:

• Sell, rent, trade, or license your personal information to anyone — no advertisers, no data brokers, no “partners”, no analytics resellers.
• “Share” your personal information for cross-context behavioural advertising in the sense that California's CCPA/CPRA regulates. The opt-out those laws require would have nothing to opt out of here, because the practice does not exist.
• Exchange your data for services, discounts, or API access — “we didn't charge money for it” is still a sale, and we don't do that either.
• Build advertising profiles from your leagues, rankings, uploads, or behaviour. There is no ad system for such a profile to feed.

The one derived use we do make of user activity is described in section 6: completed trades observed in linked leagues feed an aggregate, de-identified evidence base that makes the app’s own trade engine more realistic. That data improves the product you are using. It is not packaged, licensed, or offered to anyone else.

How we make money instead: today, nothing — the app is free during beta. If that changes, the model will be the one in section 8: you pay for the product. You are the customer here, not the inventory.

If this promise ever had to change — for example under a merger or acquisition — the change would apply only after we update this policy, notify signed-in users in the app, and give you a real chance to delete your account first. It would never apply retroactively to data collected while this promise stood.

Account. Sign-in is handled by Google Firebase Authentication, using your Google, Apple or X account. We receive and store a user id, your email address, and your display name and photo URL if the provider you chose supplies them. We never receive or store your password — the provider authenticates you and tells us only who you are. Two things are worth knowing about the address we end up holding. Apple lets you hide your real one behind a private relay address ending @privaterelay.appleid.com; that is what we store, and mail sent to it still reaches you. And some providers release no address at all, in which case the account is created with an internal placeholder that reaches no mailbox and is never used to contact you.

Things you create in the app.

• Your league settings (team count, scoring, starting lineup, draft slot).
• Player projection/ranking files you upload, and the player pool built from them.
• Your own rankings and the state of any in-progress ranking session, including its undo history.
• Drafts you link or run manually, and every pick in them.
• Leagues you link, and identifiers for them on their platform.
• Trade feedback you give us — which proposed trades you would accept or reject. This trains the acceptance model, and it is one of the few places your judgement becomes part of the product.

Data we fetch on your behalf. When you link a league or a draft, we retrieve that league’s public or credentialed data from its platform: rosters, matchups, scores, transactions and trades, draft picks. When a draft is live, a server-side poller reads picks on a timer so that everyone watching that draft is served by a single connection to the platform rather than one per person.

Operational data. Per-user counts of expensive actions (league analyses, trade-finder runs, imports) to enforce usage limits; and ordinary server logs, which include IP address, timestamps, requested paths and error details. Logs exist to keep the service running and to debug failures.

Product usage. Which pages you open, which features render with real content, which actions you press, and when. Each record carries your account's internal id — not your name or email — plus a random id for the browser tab, which your browser throws away when the tab closes. It is written to our own database by our own code; no outside analytics company is involved and nothing leaves our servers. We use it to answer one question: what do people actually use? Records are kept for about 120 days and then deleted.

What this deliberately does not record: your browser's user-agent, your screen size, anything derived from your IP address, and any free text you type — with one exception. Searches in the player and guide boxes store the words you searched for, because "everyone is looking up the same three rookies" is genuinely useful; those are stripped of anything that looks like an email address, a long run of digits or a URL, cut to 64 characters, and never linked to anything but your internal id. Search boxes that could contain something about a person or a private league record only that a search happened, never the words.

Local browser storage. Interface preferences — theme, which board you last used, which panels you collapsed, your active league, privacy mode — are stored in your browser under keys beginning fwr-. They never reach our servers and clearing your browser storage erases them.

One cookie that matters: a session cookie issued after you sign in, minted by Firebase, which tells our servers who you are. It is HTTP-only (JavaScript on the page cannot read it), marked Secure in production, restricted with SameSite, and expires after a fixed period. Signing out clears it.

There are no advertising cookies and no analytics cookies. There is no advertising at all, and the product-usage measurement described in section 3 uses no cookie: it keeps a random id for the browser tab in sessionStorage, which is never sent with a request and which your browser discards when you close the tab.

ESPN has no public API for private leagues. The only way any tool can read your ESPN league is with two values from your own browser session, espn_s2 and SWID. Linking an ESPN league is therefore optional, and nothing else in the app depends on it — Sleeper leagues need no credentials at all.

How we handle them. They are encrypted before they are written to the database, using envelope encryption with a key held in Google Cloud KMS; the key does not live in our database or our configuration, and the stored value is ciphertext. They are decrypted only in memory, only to make a request to ESPN on your behalf, and only for the account that supplied them. They are never returned to the browser, never written to logs, never shared with another user, and never copied to another account.

How to revoke them. On the Leagues page, “Delete credentials” removes the stored values immediately; your ESPN leagues stay listed and simply stop updating until you enter them again. Unlinking your last ESPN league deletes them too. Note that unlinking just one of several ESPN leagues does not — the stored values are per-account, not per-league, so removing them then would break your other leagues.

Deleting them here stops us from using them. It does not invalidate the session itself, because only ESPN can do that — so to be thorough, also log out everywhere in your ESPN account settings.

Your own data is yours. Rankings, uploads, settings, drafts and trade feedback are visible to your account only.

League data is shared within your league, on purpose. A league’s computed analysis — standings, power ratings, playoff odds, trade history — is cached once per league and served to members of that league who use the app, rather than recomputed per person. This is what keeps us from hammering the platforms. The practical consequence: league-level information you can see is information your leaguemates who use the app can also see. For a public Sleeper league that is the same information anyone could already read from the platform. For a private ESPN league it is not, so access to a cached ESPN analysis is restricted to accounts that have demonstrated access to that league. We never expose your private rankings, your board, or your trade feedback to anyone.

Trade records are retained as an evidence base. Completed trades observed in linked leagues are appended to a corpus used to measure what real managers actually accept — that measurement is why the trade engine proposes plausible trades instead of lopsided ones. These records describe transactions (which players moved between which roster slots, when), are used in aggregate, and are not deleted when you unlink a league or close your account, because removing individual rows retroactively would corrupt a fitted model. If you want your leagues excluded from this, tell us before you link them.

Share links. Some season tools produce a shareable URL. Anyone holding that URL can see what it points at. Treat it as public.

• Google Cloud — hosting, database, file storage and key management. Our infrastructure provider; your data is stored on their services.
• Google Firebase Authentication — sign-in. They process your email and authentication events.
• Apple — sign-in only, and only if you choose that button. Signing in with Apple tells Apple that you authorised this app; nothing about your leagues, rankings, trades or drafts is ever sent to them.
• X — sign-in only, and only if you choose that button. Signing in with X tells X that you authorised this app; nothing about your leagues, rankings, trades or drafts is ever sent to them. Choose a different sign-in button and no request reaches X at all.
• Fantasy platforms (Sleeper, ESPN, and later Yahoo) — we request your league data from them. For Sleeper this uses public read-only endpoints. For ESPN it uses the credentials you supplied, at your direction.
• Public football data sources — league-independent statistics (snap counts, targets, carries, yards, touchdowns) and market value data. These are requests for data; no information about you is sent to them.
• Sleeper’s image CDN — player headshots are loaded by your browser directly from sleepercdn.com, which means your IP address and the page you were on reach Sleeper, as with any image on any website. Nothing about your account or your rankings is sent. If you would rather not, blocking that host degrades cleanly: the app draws its own initials-on-team-colour badge instead, and nothing else changes.

Notably not: we do not send your data to an AI model as part of serving your requests. The app’s language-model integration is confined to offline work — model calibration and writing explanatory text — and no code path that serves a request reaches it. Your rankings and your league are not prompts.

That list is exhaustive. There is no one else — no advertisers, no data brokers, no analytics vendors — because your data is not for sale, full stop. Section 2 is the whole promise.

The app is free to use, and paid plans are optional. If you buy one, the payment is handled entirely by Stripe on Stripe’s own pages. Your card details never reach this app: we do not run any payment code in your browser, no card field ever appears on our site, and we never see or store your card number.

What we do store for a purchase, and all we store:

• A Stripe customer identifier — an opaque reference, useless without Stripe's own credentials.
• What you bought, what it cost, which season it covers, and when it expires.
• Stripe's identifiers for the checkout and the payment, so a refund can be traced to a purchase.

We do not store your card brand or last four digits, your billing address, or anything else from the payment. Stripe holds those, under its own privacy policy, as the payment processor of record.

We keep your account data while your account exists. You can delete individual items — uploads, rankings, linked leagues, drafts — at any time in the app. ESPN credentials are stored per account, not per league, so they are removed by “Delete credentials” on the Leagues page or by unlinking your last ESPN league — exactly as section 5 describes — not by unlinking one league among several.

To delete your account entirely, email us and we will remove your account and its associated records. Two honest exceptions: aggregate trade records as described in section 6, and ordinary server logs, which age out on a rolling schedule and may briefly outlive the account. Backups are retained for disaster recovery and expire on their own schedule.

Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Email us and we will honour them; we do not require you to invoke a specific statute to be taken seriously. If you are in the EU/UK or California, you have these rights by law and we will not charge you for exercising them.

California residents also have the right to opt out of the sale or sharing of personal information. As section 2 explains, we do not sell or share personal information in the first place, so there is nothing to opt out of — no “Do Not Sell Or Share My Personal Information” link is required because the practice it would switch off does not exist here. We also do not discriminate against anyone for exercising a privacy right.

Sign-in is delegated to Firebase. Session cookies are HTTP-only. Platform credentials are encrypted at rest with a KMS-held key. Traffic is served over HTTPS. The database is not publicly reachable. Access to production is limited to the operator of the service.

No system is perfectly secure, and this one is operated by a very small team. If you find a vulnerability, please report it to the address below rather than disclosing it publicly, and we will fix it and credit you if you would like.

This service is not directed to children. Do not use it if you are under 13. If we learn that we hold data from a child under 13, we will delete it.

The service is operated from the United States and data is stored on Google Cloud infrastructure in the United States. If you use the app from elsewhere, you are sending your data to the United States.

If we change how data is handled in a way that matters, we will update the date at the top of this page and, for material changes, tell signed-in users in the app. Continuing to use the service after a change means you accept the updated policy.