Privacy Policy

1. What we collect

• The Sleeper username, user id and league ids you enter. These identify public Sleeper profiles and leagues; they are not credentials and we never ask for your Sleeper password.
• League data fetched from Sleeper for those leagues: rosters, matchups, scores, transactions, draft picks and the display names of every owner in them. All of it is public through Sleeper’s API.
• If you create an account: your email address, how you sign in (email and password, or Google, which tells us your email address), your plan, the Sleeper username and leagues you link, the settings and choices that follow you between devices (default league, time zone, theme, watched players, pinned and hidden leagues, your contender or rebuilder call per league, watched college prospects, your own rookie tiers, and commissioner payout settings, who has paid, payout notes and orphan-team progress), when you last used the service, and how many AI runs you have used each month. Your password goes to Supabase, our sign-in provider; we do not store it. When you sign in, the AI results and push alerts already saved for that browser join your account.
• The contents of AI requests you start: the league, roster and value data needed for that analysis, plus your team name. See section 4.
• Finished AI results, saved on our servers under a random id for your browser (its "sync code") so you can reopen them and see them on your other devices. They are not linked to your name (signed in, they belong to your account); anyone you give the sync code to can see them, and Settings deletes them.
• If you turn on push alerts: your browser’s push address and keys (issued by your browser’s push service), which alerts you chose, the players you watch, your Sleeper user id, the random id for your browser, your browser’s user agent (the browser and operating system names and versions it reports), and the value each watched player had when we last alerted you. Turning alerts off deletes them.
• If you send a problem report: what you wrote, the page you were on, your Sleeper username if you entered one, a reply address if you gave one, the random id for your browser, and your browser’s user agent.
• When something breaks: the error message and where in our code it happened, the page address (without anything after a "?"), your browser’s name and version, and which version of the app was running. Not your IP address, Sleeper username or browser id. Kept for 30 days after the error was last seen, to fix bugs.
• If you join the waitlist: your email address, used only to tell you when accounts or paid plans open and about major new features. Each of those emails has a link that takes you off the list, or ask us and we remove it.
• A log of AI requests, kept for up to a year to control costs and stop abuse: when, which feature, your IP address and browser id, your Sleeper username if you entered one, your account id if you were signed in, and how many tokens it used and cost. Not the content of the request or the answer.
• Technical logs created by our hosting provider when your browser talks to our servers: IP address, browser type, pages and API routes requested, timestamps and error reports. Logs are kept for about 30 days for security and debugging.
• Usage counts, to improve the service: an anonymous random id kept in your browser’s local storage (not a cookie; it is stored apart from your Sleeper name, user id and leagues, and we don’t combine them), which pages of the app you open (with league ids taken out of the address) and a few steps you take (signing up or in, linking Sleeper, starting an AI tool: that the step happened, nothing you typed), roughly how long the app is in use (a signal every 30 seconds while its tab is open and in use), the site that linked you here (its name only, not the full address) and, when you arrive through one of our own links in a post or an ad, which post or ad it was and whether you use a phone, tablet or computer. We record this ourselves and do not store your IP address or browser details with it. Raw records are kept for 13 months, then only daily totals remain. Nothing is recorded when your browser sends Do Not Track or Global Privacy Control.
• Product analytics through PostHog (PostHog, Inc., servers in the United States), to see where the app is confusing and which features earn their keep: the same page views and steps, which buttons and links get used (with the text on the page masked), and a replay of how the pages are used in which every piece of text and everything you type is masked. It runs under an id PostHog keeps in your browser’s local storage (not a cookie). When you are signed in, your account id and plan go with it, never your email address, name or Sleeper id; league, player and user ids are taken out of page addresses before anything is sent. PostHog uses your IP address to work out a rough location (country and region) and is set not to keep the address. It processes this data for us and for nothing else. Nothing is sent when your browser sends Do Not Track or Global Privacy Control.
• Nothing else. There is no advertising tracking, no data brokers and no social-media pixels.

2. What stays in your browser

Several things the app remembers never leave your device. They live in your browser’s local storage and are deleted when you clear site data:

• Your Sleeper username and the last league you opened.
• The list of recent AI runs in the bell menu (a copy of each finished result is also saved on our servers, see section 1).
• Commissioner payout settings (buy-in, split, who has paid) and notes, pinned and hidden leagues, and similar choices, unless you are signed in: then they are also saved on your account (section 1).
• Whether you have seen the guided tour, collapsed the report card, and similar preferences.
• If you sign in: a cookie that keeps you signed in. The page’s own scripts cannot read it, and signing out removes it.
• The anonymous id used for the usage counts in section 1, and the current visit’s id (cleared when you close the tab).

3. How we use information

• To show you your leagues and run the tools you ask for.
• If you have an account: to sign you in, keep your leagues, settings and AI results with you on every device, count your monthly AI allowance, and send the emails sign-in needs (confirming your address, resetting your password).
• To cache Sleeper and Dynasty Dealer responses on our servers for a short time so pages load quickly and we stay within those providers' limits.
• To rate-limit and protect the AI features from abuse.
• To fix bugs and understand which features are used, using aggregate counts and error logs.
• To answer your support requests.
• To know which plan you have and send service notices. Link, which sells the plans, handles your payment details and sends receipts under Stripe’s privacy policy; if you ask Link to delete your payment data, it also cancels your subscription.

4. AI features and Anthropic

When you run an AI feature (lineup advice, waiver plan, trade analysis, trade ideas, weekly recap, draft advice), we send the data that feature needs to Anthropic’s API to generate the result: the relevant rosters and player names, trade values, league scoring settings, records, and owners' public display names and trading tendencies derived from the league’s history. We do not send your email address or any payment details.

Anthropic processes that data as our service provider under its commercial API terms and does not use it to train its models. We keep the generated result so you can reopen it: a copy lives in your browser, and a copy is stored on our server under a random id for your browser (its sync code; copy it into another device in Settings to see your results there), with your Sleeper user id noted if you entered one, and your account if you were signed in. Stored results are deleted after 90 days, or straight away when you clear them in the app.

5. Who we share data with

We share data only with the providers needed to run the service, each for its stated purpose:

• Sleeper — fantasy league data you ask us to read (public API) (https://sleeper.com)
• Dynasty Dealer — player and pick trade values (https://www.dynastydealer.com)
• Anthropic — AI analysis (Claude models) when you run an AI feature (https://www.anthropic.com)
• Vercel — servers, request logs and content delivery (https://vercel.com)
• Supabase — our database, and sign-in for accounts (email and password, or Google) (https://supabase.com)
• Cloudflare — our domain and network, and the bot check on the sign-up form (Turnstile), which sees your IP address and browser (https://www.cloudflare.com)
• Resend — the emails we send you (the welcome email, the Tuesday briefing and the Sunday lineup check if you turn them on, the waitlist invite) (https://resend.com)
• PostHog — product analytics: page views, steps, masked clicks and masked replays under your account id when signed in (privacy policy, section 1) (https://posthog.com)
• YouTube (Google) — the 60-second tour on the home page, only when you press play: the player loads from youtube-nocookie.com and sees your IP address and browser (https://www.youtube.com)
• Stripe (Link) — sells and bills paid plans as the merchant of record: checkout, tax, receipts, payment support and disputes. We never see your card number; we keep your plan, its status and billing dates (https://stripe.com)

6. When we would disclose data otherwise

We do not sell personal information. We would disclose data only to comply with a legal obligation, to protect the rights and safety of users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply until it is replaced.

7. How long we keep data

• Server-side caches of Sleeper and Dynasty Dealer data expire within hours to a day.
• An archive of the public Sleeper data for leagues opened in the app (league name and settings, rosters, weekly lineups and scores, transactions and draft picks, with owners identified by their Sleeper user id rather than their name) and of public NFL player data (status, weekly stats, projections and trends). We keep it to build our own statistics and improve the service, until you ask us to delete a league’s data.
• Request logs: about 30 days.
• Error reports: 30 days after the error last happened.
• Usage counts: 13 months for the page-by-page records, then only daily totals (visitors, visits, page views and time in the app) with nothing that identifies a browser.
• Product analytics (PostHog): the replays for 30 days, the events for a year. The only id on them when you are signed in is your account id, which points to nothing once the account is deleted.
• Browser storage: until you clear it or the app removes it.
• Accounts: for as long as your account is open. Deleting it in Settings removes your email address, linked Sleeper account, leagues, settings and saved AI results straight away; we may keep the monthly AI run counts, without your email, so deleting and rejoining does not reset an allowance. If your sign-in record at Supabase is not removed with it, email us and we remove it within 30 days.
• Subscription records: as long as tax and accounting law require for the payment records.
• If you have used Pro’s free trial: a one-way hash of your email address and your Sleeper user id, kept after you delete your account, only so the trial can’t be taken twice. The hash can’t be turned back into your address.

8. Your choices and rights

• Clear your browser’s site data to remove everything the app stores on your device.
• Turn on Do Not Track or Global Privacy Control in your browser and the app records no usage counts at all. Clearing site data gives you a new anonymous id.
• Email support@dynastyseer.com to ask what data we hold about you, to correct it, or to have it deleted. We answer within 30 days. If you have an account, Settings → Account deletes it straight away.
• If you are in the EU, UK, California or another place with data-protection rights, those rights (access, correction, deletion, portability, objection, and the right to complain to your regulator) apply and you can exercise them by email.
• The service is not for people under 18. If you believe someone younger has used it, contact us and we will delete what we hold.

9. Security

Data travels over HTTPS. Server access is limited to the people who operate the service. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and any regulator the law requires.

10. Where data is processed

Our servers and providers are in the United States. If you use the service from elsewhere, your data is transferred to and processed there.

11. Changes and contact

We will post changes to this policy here and, for material changes, tell you in the service or by email. Questions and requests: support@dynastyseer.com, or by post to Golden Retrieval Labs LLC, 5900 Balcones Drive, Suite 100, Austin, TX 78731.