Privacy Policy

1. The short version

• No account. You never create an FSN login. We do not ask for your name, your address or your date of birth.
• League reads transmit your League ID and, for private ESPN access, the cookies you provide to our relay. Saved ESPN cookies remain on your device unless you use League Cloud.
• Yahoo is web only. The initial iOS release offers ESPN and Sleeper. A Yahoo connection on our website stores encrypted authorization tokens on our servers.
• No advertising, no ad identifiers, no third-party analytics or tracking SDKs. The app ships none.
• We do not sell or share personal information for advertising or cross-app tracking.
• You can erase everything local from Setup → Privacy & Data → Erase Stored Data & Disconnect.

2. What is stored on your device

The app is a single page that runs in your browser, or inside a native shell on iOS. It keeps a local working copy of your league and preferences. That includes:

• Your League ID and chosen provider (ESPN or Sleeper; Yahoo on the web).
• For private ESPN leagues, the espn_s2 and SWID cookies you paste in during setup.
• The historical archive cache — past seasons already fetched, so the record book does not refetch them on every launch.
• Your preferences: selected team profile, viewed season and week, notification toggles, and dismissed walkthrough state.
• Local community stories and narrative caches saved in this browser or app installation.

These entries use keys beginning fsn., fsn_ or mffu., plus the legacy hasCompletedOnboarding flag. Erase Stored Data & Disconnect removes these entries from local and session storage, clears the app's memory-backed storage, and reloads without league or invite parameters. It first disconnects this device's alerts and, on the web, its current Yahoo session. If a network or storage operation fails, the app reports the failure and offers a retry; it does not claim erasure succeeded. This affects the current app installation or browser origin, not other browsers, devices, provider accounts or shared cloud records.

3. What leaves your device

3.1 League data reads

League reads use our relay functions at app.fantasysportsnetwork.app/api/* and, where supported, public provider endpoints. Requests carry your League ID and, for private ESPN access, your ESPN cookies in request headers. Reading through the ESPN relay does not persist those cookies in our database; saving League Cloud is a separate operation. Yahoo reads on the web use the server-held authorization described below. Our hosting provider processes request metadata, such as IP address and browser information, to operate the service.

If a public ESPN read cannot reach the normal relay, the app can try AllOrigins, Corsproxy.io or ThingProxy as public relay fallbacks. They receive the public request URL, including its League ID, and request metadata. Credentialed private-league requests do not use these fallbacks.

3.2 Yahoo authorization (website only)

When you connect Yahoo on the FSN website, Yahoo sends us an account identifier, access token, refresh token and token-expiry information. We store the tokens encrypted in Supabase, with the Yahoo identifier and update time, so we can request your fantasy data and renew expired access. We do not receive your Yahoo password.

Your browser receives an HttpOnly session cookie. Our database stores a hash of that session secret, the linked Yahoo identifier and a 30-day expiry. The OAuth state and return-path cookies used while connecting expire after ten minutes. Expired session rows are removed when encountered; expiry alone is not a scheduled deletion of every retained record.

Yahoo Log Out and successful web Erase Stored Data & Disconnect clear the current session cookie and request removal of its server session. Log Out alone does not erase locally cached league data. Neither control deletes the server's encrypted Yahoo token record or sessions on other devices. Tokens remain until you request deletion at privacy@fantasysportsnetwork.app. You can also revoke FSN's authorization in your Yahoo account settings; revocation prevents further authorized use but does not itself delete the records held by FSN.

3.3 League Cloud sync (optional)

League Cloud lets everyone in a league share one reconstructed history instead of each member rebuilding it. When you save to it, the following is written to our database (hosted by Supabase):

Writes happen only through our own server-side route, after it has verified with ESPN that the caller genuinely has access to that league. The database table has row-level security enabled with no anonymous or authenticated access policies at all: browsers never query it directly.

3.4 Push notifications (optional, off by default)

Alerts are offered only when the service supports your device. Notifications are off until you switch them on, and the permission prompt is only ever raised after you explicitly opt in. If you do turn them on, we register the device so we know where to send the alert:

• A device identifier that is the SHA-256 hash of the push address, not the address itself.
• The push address — an Apple APNs device token on iOS, or a Web Push subscription in a browser.
• The League ID and, if you have picked a profile, your team ID — used only to skip alerts for someone with no rooting interest.
• Your IANA time zone (for example America/New_York), so alerts land on your clock rather than ours.
• Which of the three weekly windows you enabled (Tuesday, Thursday, Sunday), plus the season and week the client reported.

We also keep a small ledger of which alert was sent to which device in which week, so you are never sent the same alert twice. Successfully turning notifications off in Setup removes the device's server registration and unsubscribes its push transport. A failed removal is reported and keeps the identifier needed to retry. Revoking permission in your operating system stops display of alerts but does not, by itself, delete server records or the delivery ledger.

3.5 Website signup records

For website release-update and previously submitted waitlist signups, we store your email address, the platform you chose, where the signup came from, and your browser's user-agent string. Commissioners may optionally supply a League ID and ESPN SWID; those fields are blank unless you fill them in. A welcome email is sent on first signup. Signup alone does not connect or load a league in the app.

4. Who else touches this data

We use a small number of service providers, each for one job:

These providers process data on our behalf to run the service. We do not sell personal information, we do not share it for advertising, and we do not track you across other apps or websites.

5. How long we keep things

• On your device: until you erase it, clear your browser storage, or delete the app.
• League Cloud records: until the league is removed at a member's request.
• Yahoo authorization: encrypted tokens remain until a deletion request. Browser sessions expire after 30 days or end on logout; other session rows can remain until cleanup or a deletion request.
• Notification registrations: removed after a successful in-app opt-out or deletion request. A permanently invalid address is disabled, and its row may be retained.
• Notification delivery ledger: retained separately for deduplication and operational troubleshooting; request deletion by email.
• Website signup records: retained until you request removal. They are not automatically deleted at launch.

6. Your choices

• Erase everything local: Setup → Privacy & Data → Erase Stored Data & Disconnect.
• Stop notifications: switch them off in Setup and retry any reported failure. Revoke permission in device settings to prevent display while offline.
• Never use League Cloud: it is opt-in; the app works fully without it.
• Delete server-held data: email us to request removal of League Cloud records, Yahoo authorization/session records, notification records or website signup records. We may need to verify your access to the affected league or account.

Depending on where you live you may have additional rights over your personal information — to access it, correct it, delete it, or object to its processing. Write to us and we will honour them.

7. Children

FSN is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with information, contact us and we will delete it.

8. Changes to this policy

If we change what the app collects, we update this page and move the “last updated” date at the top. Material changes will be surfaced in the app itself rather than only here.

9. Contact

FSN is an independent product. It is not affiliated with, endorsed by, or sponsored by ESPN, Sleeper, Yahoo, the NFL or the NFLPA.