Privacy Policy

Last updated: August 14, 2026 · Pilot release

What we collect

Account: your email address, the username you choose, and when you joined. League activity: your teams, rosters, lineups, draft picks, queue, and feedback you submit. Sign-in security:on each sign-in we record the time, an approximate city-level location derived from your network address, and a general device label (for example "iPhone · Safari"). We do not store your IP address with your account, and we do not track your location while you use the site. Push notifications:if you enable alerts, we store the browser's opaque push endpoint, notification encryption keys, enabled alert categories, an optional expiry, and a general device label. We do not store the raw browser User-Agent for push. Error diagnostics: when production error monitoring is configured, an unexpected failure may send its exception message, stack trace, application route, release/environment, and time to our error-monitoring provider. We configure it not to collect account identity, cookies, headers, query parameters, request/response bodies, local variables, click history, or a recording of your session.

How we use it

To run your leagues (scoring, drafts, standings), to let your league-mates recognize you (your username and team are visible to members of your leagues; your email is not), and to keep accounts secure (the sign-in records help administrators confirm an account is being used by the person it was invited for). Waitlist emails are used only to contact you about joining. Push subscription data is used only to deliver alerts you enabled, currently your team's draft turn, the result of an automatic draft pick, and an Account test notification. Platform admins may separately enable generic alerts for new waitlist and feedback items. Those lock-screen alerts do not contain the signup email, feedback message, reporter identity, or originating path. Feedback you submit is visible only to you and platform admins. Your Account page shows whether an admin has seen or completed it.

What we don't do

We don't sell or rent your information, run advertising, or use third-party behavioral analytics trackers. Error monitoring is used only to diagnose failures, not to profile usage. There are no ad cookies. Our first-party cookies keep you signed in, remember which league you were viewing, remember whether you were on the NHL or the AHL side of each franchise league, identify the current device's push subscription so sign-out can detach that device only, and remember your System, Light, or Dark appearance choice on this browser. Connecting a Discord account sets one short-lived security cookie that expires ten minutes later. The appearance choice is also kept in local storage for live updates between tabs. It is not stored with your P2P account or used for tracking.

Who processes it for us

The platform runs on infrastructure providers that process data on our behalf: Vercel (hosting), Neon (database), Resend (sign-in and invitation emails), and Upstash (rate limiting and short-lived presence data), and Sentry when production error monitoring is configured. If you enable push, the push service used by your browser or operating system (for example Apple, Google, or Mozilla infrastructure) routes an encrypted notification to the device. Player statistics are licensed or public sports data and are not personal information about you.

Retention and deletion

Account data is kept while your account exists. Ask for your account and personal data to be deleted at any time via the 💬 Feedback button or your league commissioner; league history (draft picks, past lineups) may be kept in anonymized form so other members' seasons stay intact. A push category is removed when you disable it; the browser subscription is removed when its last category is disabled, when you sign out on that device, delete your account, exceed the ten-device limit (oldest first), or the provider reports that an endpoint expired. Browser permission may remain in device settings after removal, but P2P delivery stops. Error diagnostics follow the retention configured for the monitoring project and are removed there rather than stored as a P2P health-log copy.

Where data lives

Our providers store data in North American regions. By using the platform you consent to that processing.

Contact & changes

Questions or requests: the 💬 Feedback button in the header, or your league commissioner. We'll update this policy as the platform evolves. The date above tells you when. See also the Terms of Service.