DRAFT — not yet reviewed by a lawyer. This describes, accurately, what the software actually stores and sends. That is the part an engineer can get right and most privacy policies get wrong. It is not legal advice and it should be reviewed before the site takes a single real subscriber.
Privacy Policy
Last updated 15 August 2026
The short version
We store what you give us and what you do on this site, so that your bet log, your fantasy leagues and your settings are there when you sign in from another device. We do not sell it, we do not share it with advertisers, and you can download or delete all of it at any time from the account panel.
What we store
| Your email address | To identify your account and contact you about it. |
|---|---|
| Your password | Not stored. What is stored is a one-way scramble (scrypt) of it. Nobody here — including us — can read your password out of it, which is also why we can never send it to you. A forgotten password gets replaced, never recovered. |
| Your bet log | The bets you enter yourself on the My Bets page. |
| Your fantasy leagues | League identifiers and any rankings you paste in. |
| Your bankroll settings | The two numbers you type for unit sizing. |
| Your recent searches | Player names you search for, most recent 100, so the site is useful across devices. You can clear these on their own at any time, separately from the rest. |
| Session cookie | One cookie that keeps you signed in. It is marked HttpOnly, so page scripts cannot read it, and it carries no information about you beyond a random token. |
What we do not store
- Your sportsbook passwords. We never ask for them and there is nowhere to enter one. A DraftKings or FanDuel login can move real money and cannot be scoped or revoked by us.
- Card numbers. Payments, when they exist, go through Stripe's own hosted page. Card details never reach our server.
- Advertising or tracking cookies. There are none. No analytics tags, no pixels, no third-party scripts.
- Your location. We do not ask for it or infer it.
Who else sees it
Two parties, both because they have to be involved:
- Stripe, if you subscribe — they handle the payment and hold the card details we deliberately never see.
- Yahoo, only if you connect a Yahoo fantasy league, and only to read that league. You approve it on Yahoo's own screen and can revoke it from your Yahoo account at any time.
Nobody else. We do not sell data, and there is no advertising relationship to sell it into.
Your controls
- Download everything. One button in the account panel returns everything we hold about you as a JSON file.
- Delete everything. One button removes your account and every record attached to it. It cannot be undone. It removes you from the live site immediately; see How long below for the one place a copy lingers.
- Clear search history on its own, without deleting the rest.
- Change your password, which also signs out every other device.
How it is kept
On our own server. Passwords as scrypt verifiers, session tokens hashed, the database file readable only by the account that runs the site. Sign-in is refused over an unencrypted connection.
No system is perfectly secure and we will not pretend otherwise. If we ever discover a breach affecting your data, we will tell you.
How long
Until you delete it. Sessions expire after 30 days of not being used. Search history keeps only the most recent 100 entries.
Backups are the exception, and we would rather say so than let you find out. The site takes a weekly backup and keeps the six most recent, so a copy of your data can survive in an offline archive for up to about six weeks after you delete your account. Those archives are never read to serve the site, are never shared, and age out on their own — but for that window the honest answer to "is it all gone?" is "from the site, yes; from the last few backups, not yet." Backups exist so that a failed disk doesn't erase the records of everyone who did not ask to be deleted, which is why we keep them rather than skipping your data to make this paragraph shorter.
Age
This site is for people 21 and over. We do not knowingly create accounts for anyone younger.
Contact
[Add a real contact address before launch.]