WIN YOUR LEAGUE — PRIVACY POLICY
Effective date: July 21, 2026
Win Your League ("the app", "we") is a fantasy-sports assistant. This policy describes exactly what data the app handles and why. We collect the minimum needed to run the product. We show no ads, we do not track you across other apps or websites, and we never sell your data.
1. Data we collect
- Account: your email address and a password-derived credential, used solely to sign you in. Authentication is provided by Supabase; Apple and Google sign-in are available and share only the identifier those providers release to us.
- Yahoo Fantasy link: if you connect Yahoo, we store the OAuth access and refresh tokens Yahoo issues (read-only fantasy scope) in a server-side vault. We never see your Yahoo password — you sign in on Yahoo's own pages.
- ESPN Fantasy link: ESPN offers no official fantasy API, so if you connect a private ESPN league you sign in on ESPN's own login page inside the app and we store the resulting session cookies (
espn_s2,SWID) in a server-side vault that only our backend can read. We never see or store your ESPN password. - Sleeper link: your public Sleeper username, stored on your device only.
- Fantasy data: league, roster, matchup, and player data fetched from the providers above to power your dashboards and recommendations.
- AI conversations: messages you send to the in-app assistant ("Ted"), together with your roster context, are processed to generate replies.
- Notifications: your notification preferences and, if you enable push, an Expo push token for your device.
- Usage metering: coarse counts of API and AI usage per account (for cost and abuse control). No advertising identifiers, no location data, no contacts, no analytics SDKs.
2. How we use it
Only to operate the product: syncing your leagues, computing recommendations, generating briefings and chat replies, and sending the notifications you opt into. Nothing else.
3. Service providers
Data is processed by the following providers, strictly to deliver app functionality: Supabase (database, authentication, storage), Google Gemini (AI text for briefings and chat), ElevenLabs (AI audio for briefings), Expo (push delivery), Cloudflare Stream (video hosting), and the sports data sources you connect or that are publicly available (Yahoo, ESPN, Sleeper, MLB Advanced Media). None of them are permitted to use your data for their own advertising.
4. Storage and security
Data is encrypted in transit (TLS) and at rest. Provider credentials (Yahoo tokens, ESPN cookies) live in server-side vaults inaccessible to other users and to the app client itself where possible; your app session is stored in your device's secure enclave.
5. Retention and deletion
We keep your data while your account is active. You can permanently delete your account and all associated data at any time in the app: Settings → Account → Delete account. Deletion removes your account, vaulted Yahoo/ESPN credentials, profiles, preferences, and logs. You may also request deletion by email.
6. Children
The app is not directed at children under 13 and we do not knowingly collect data from them.
7. Changes
If this policy changes materially, we will update this page and note it in the app.
8. Contact
Questions or requests: leewoodbury@gmail.com
Win Your League is not affiliated with, endorsed by, or sponsored by Yahoo, ESPN, Sleeper, MLB, or the NFL. All trademarks belong to their owners.