Privacy

01The short version

We try to write this the way we'd explain it to a friend in a league chat. The full sections below are authoritative, but here's the gist:

• We collect what's needed to run your league: sign-in details, your fantasy-league data from Sleeper, Yahoo, or ESPN, the content you post in your clubhouse, and basic device/usage information.
• We do not sell your data to advertisers, brokers, or anyone else. There are no third-party ad trackers on Leaguebase.
• We rely on a small set of trusted vendors (Supabase, Stripe, Resend, OpenAI, Inngest, Railway, Sentry, PostHog, and Intercom) to run the service. Each is listed below with what they do.
• You can download a copy of your data or delete your account at any time from Settings → Privacy. Account deletion has a 72-hour cooling-off window so you can change your mind.
• We email you when something material changes in this policy. No silent rewrites.

02Who we are

“Leaguebase,” “we,” “us,” and “our” refer to the operator of Leaguebase, an editorial and social clubhouse for fantasy sports leagues. Leaguebase is the “data controller” for the personal information described in this policy, meaning we decide what data is collected and why.

You can reach our team at support@leaguebase.com for any privacy question, including the rights described in section 12.

03What we collect

We try to keep what we collect to what the product genuinely needs. The categories below are everything we store about you in our database.

Account information

• Email address (required): used to sign you in, deliver league invitations, and contact you about your account.
• Display name and profile photo (optional): what other members of your league see in the feed, on rosters, and in messages.
• Password hash: only if you sign up with a password. We store a salted bcrypt hash, never the password itself, and we cannot recover it.
• Magic-link verification tokens: short-lived single-use tokens we generate so you can sign in by email without a password. We delete them after use or expiry.
• Account status: whether your account is active, suspended, or has been anonymized following a deletion request.

League and team data

• League configuration: name, scoring rules, roster positions, season year and week, commissioner identity. Pulled from Sleeper or Yahoo when you connect a league.
• Team roster, transactions, scores, and matchups: synchronized from your fantasy platform so we can render your feed, run analytics (POR), and write storyline artifacts (Power Rankings, Recaps, Awards, Matchup Previews).
• League membership and roles: who's a league admin, manager, or fan in each league.
• Branding profile: if your league admin customizes the league's palette or uploads a logo, those assets are stored in our object storage.

Content you create

• Feed posts, comments, reactions, and pinned content.
• Direct messages between league members. DMs are private to the participants and are not used for advertising or training. They are visible to administrators only when investigating a report or legal request, per section 07.
• Pick'em picks, calendar event RSVPs, and poll votes.
• Uploaded media: images you attach to posts or comments. Stored in our object storage (Supabase) under a per-environment prefix.
• Editorial artifacts: published Power Rankings, Recaps, Awards, and Matchup Previews, including any edits you make to AI-assisted drafts.
• Reports and moderation actions you file or receive.

Fantasy-platform authentication

• Yahoo OAuth refresh token: if you connect a Yahoo league, the token Yahoo issues so we can keep reading your league. Encrypted at rest; never your Yahoo password.
• ESPN session cookies (espn_s2 and SWID): if you connect an ESPN league, ESPN's own read-only session cookies, which are the only way ESPN lets an app read a private league. You supply them either by pasting them yourself or with the optional Leaguebase ESPN Connector browser extension. We store them encrypted at rest and use them solely to read your league; they are never your ESPN password, and logging out of ESPN or changing your password invalidates them. This is “authentication information” and we treat it with the same care as a password hash.

Sessions and devices

• Web sign-in sessions: issued/expiry timestamps, an opaque device fingerprint string, and whether the session was created from an installed PWA. Web sessions use a secure HTTP-only cookie.
• Native mobile sessions: a short-lived signed access token plus a rotating refresh token stored in the phone's protected Keychain or Keystore. Our server stores only a one-way hash of the refresh token, along with a device label and session timestamps.
• Push notification subscriptions: for web push, the encrypted endpoint, public keys, and user agent; for the native apps, an Expo push token and device label, plus the native APNs or FCM token when Intercom support notifications are enabled. We use these only to deliver the notification categories you've enabled.
• Theme preference cookie: a tiny leaguebase_theme cookie so the app chrome renders in your chosen theme on the first paint. The marketing site uses its own theme preference for the public website toggle.

Notification preferences

Per-channel and per-category opt-in state (push, in-app, email) plus optional quiet-hours windows and your IANA timezone. We store quiet-hours timezones so we can deliver notifications in your local rhythm without asking again on every device.

Billing data

• Subscription state, billing model, period dates, and the Stripe customer/subscription references for the leagues you pay for.
• Payment records: amount, currency, status, the Stripe charge reference, and success/failure timestamps. Card numbers and bank details never touch our servers; Stripe holds them directly.
• Sugar Daddy Pass records: when you hold an account-level pass that covers multiple leagues, we store the pass state, period dates, and the count of leagues currently covered.

Operational logs

We log routine technical information, including request paths, status codes, latency, and aggregated job outcomes (e.g. sync poll outcomes per league), to keep the service healthy. These logs are retained for a limited period and are not used for advertising.

04Sleeper, Yahoo, ESPN, and your league data

Leaguebase doesn't replace your fantasy platform. It sits next to it. To render your feed, write editorial content, and run analytics, we need a copy of your league's structure (rosters, matchups, transactions, settings).

Sleeper

Sleeper's platform exposes a public, read-only API. To connect a Sleeper league we ask for your Sleeper username so we can resolve your league ID. We do not ask for your Sleeper password and we can't change anything in your Sleeper account from Leaguebase. We poll the read-only endpoints on a schedule to keep your clubhouse in sync.

Yahoo Fantasy

Yahoo requires OAuth. When you connect a Yahoo league we redirect you to Yahoo to grant access; on success Yahoo returns a refresh token that we encrypt and store so we can keep reading your league. You can revoke that token at any time from Yahoo's account settings or by disconnecting the league inside Leaguebase. We only request the scopes needed to read fantasy league data.

ESPN

ESPN offers no OAuth or official API for third-party apps, so the only way to read a private ESPN league is with the member's own ESPN session cookies (espn_s2 and SWID). When you connect an ESPN league you provide that read-only cookie pair, either by pasting the two values yourself or by installing the optional Leaguebase ESPN Connector browser extension, which reads them for you (see the next section). We encrypt the pair at rest and use it only to poll ESPN's read-only endpoints to keep your clubhouse in sync. We never receive your ESPN password and can't change anything in your ESPN account. Logging out of ESPN or changing your password invalidates the cookies, and we prompt you to reconnect if that happens.

When a league is disconnected we stop polling immediately, mark the connection as inactive, delete the stored Yahoo token or ESPN cookie pair for it, and stop writing new sync data. Existing league content (your historical artifacts, posts, calendar events) remains available to your league members under the original visibility settings unless an authorized league admin deletes it.

05The Leaguebase ESPN Connector extension

The Leaguebase ESPN Connector is an optional Chrome/Edge browser extension we publish to make connecting an ESPN league easier. It exists for a single purpose: to read your ESPN session cookies and hand them to the Leaguebase connect page when you ask it to. It is not affiliated with, endorsed by, or produced by ESPN or The Walt Disney Company.

What it accesses

• Exactly two cookies from espn.com, espn_s2 and SWID, read via the browser's chrome.cookies API, and only in direct response to you clicking “Capture from ESPN” (or opening the extension's popup, which checks whether you're signed in). It reads nothing else and touches no other site.

What it does with them

• Relays them once to the Leaguebase connect page over an origin-checked browser message, so Leaguebase can validate your league and store the pair encrypted server-side (as described in the ESPN section above).
• Stores nothing itself. The extension keeps no copy of your cookies, runs no background sync, makes no network requests of its own, contains no analytics or tracking, and loads no remote code.

The cookie pair is “authentication information.” It is transmitted only to Leaguebase over HTTPS, used solely to read your league on your behalf, never sold or shared with advertisers or data brokers, and never used for any purpose beyond this single connect function. You can remove the extension at any time from your browser's extensions page; doing so has no effect on a league you've already connected, which you can disconnect from inside Leaguebase.

06How we use your data

• To run the service: render your feed, sync your league, deliver notifications, process payments, generate editorial artifacts, and surface analytics.
• To keep the service safe: detect abuse, enforce our community standards, investigate reports, and respond to security incidents.
• To improve the product: understand which features get used, debug regressions, and evaluate the quality of editorial content. We use first-party product analytics (PostHog, US-hosted, listed in section 08) configured without ad-tech: no advertising identifiers, no cross-site tracking, no data sales. Session replays mask message content and form inputs.
• To communicate with you: transactional email about your account (sign-in links, invoices, security notices) and the in-product notifications you've opted into.
• To meet legal obligations: respond to lawful requests, defend legal claims, and comply with tax and accounting rules.

We do not use your messages, picks, or league content to train external AI models. The AI features we provide (see section 08) operate on per-request prompts and do not opt your content into anyone's training corpus.

07When we share data

We share data only in the limited situations below.

• Inside your league. Your display name, profile photo, posts, comments, reactions, picks, calendar RSVPs, and editorial bylines are visible to other members of the leagues you've joined. Direct messages are visible only to the participants.
• With sub-processors. We use the vendors listed in section 08 to operate Leaguebase. Each one only receives the data it needs to do its job.
• With law enforcement or legal authorities. When we receive a valid legal request (for example, a subpoena or court order) we'll comply, and we'll narrow the disclosure to what the request actually requires. Where legally permitted, we'll notify the affected user.
• In connection with a business transaction. If Leaguebase is acquired or merges with another business, your data may transfer to the new owner, who will be bound by terms no less protective than this policy.

We do not sell your personal information, we do not share it with advertisers, and we do not run third-party advertising pixels on this site.

08Sub-processors

The following service providers help us run Leaguebase. Each one only receives the data needed for its role.

• Railway: hosting and managed Postgres for our application servers and database.
• Supabase: object storage for uploaded media (avatars, post images, branding logos), a separate private bucket for server sync caches and privacy exports, and real-time channels for live feed updates.
• Stripe: payment processing for league subscriptions. Card details are entered into Stripe directly and are never stored on our servers; we keep only the Stripe customer and subscription references.
• Resend: delivery of transactional email (sign-in magic links, invitations, billing notices, important account messages).
• OpenAI: generation of editorial drafts (Power Rankings summaries, Weekly Recaps, Awards, news classification) and automated safety screening before user-generated text is published. League context and submitted text such as posts, comments, polls, direct messages, display names, and bios are sent only for the requested generation or moderation operation and are not used to train OpenAI's general models.
• Inngest: orchestration of background jobs (sync polls, push dispatches, editorial pipelines). Self-hosted on our infrastructure; no league data leaves our environment for orchestration.
• Expo: native app builds and over-the-air updates, plus delivery of native push notifications to Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). Expo receives the app/build metadata needed for those services and, for push delivery, the device push token and notification payload.
• PostHog: first-party product analytics, exception metadata, and sampled session replay, hosted in the US. Receives usage events (screens viewed, features used, device/browser info) tied to your account ID, never your messages, picks content, or ad identifiers. Mobile replays mask all text, inputs, and images and do not capture native logs or network telemetry. PostHog is configured without third-party ad-tech integrations and does not sell or share this data.
• Sentry: crash reporting, performance monitoring, and privacy-masked replay around a sampled error, hosted in the US. Mobile reports may be tied to your account ID so we can diagnose an issue you experienced; email, display name, typed text, and images are scrubbed or masked.
• Intercom: customer support messaging. Receives your account ID, email, display name, help conversation, limited account context, and native push token needed to answer your request and notify you of replies; it is not used for advertising.
• Yahoo Fantasy Sports: source of league data for Yahoo-connected leagues, accessed via OAuth with the minimum scopes required.
• Sleeper: source of league data for Sleeper-connected leagues, accessed via Sleeper's public read-only API with no credentials beyond your Sleeper username.
• ESPN Fantasy: source of league data for ESPN-connected leagues, accessed read-only with the ESPN session cookies you provide. Leaguebase is not affiliated with or endorsed by ESPN.
• Giphy: optional GIF picker inside the feed composer. Only the search query you type is sent; we don't share your account identity with this provider.
• Google Analytics and PostHog: optional marketing-site analytics used to measure page visits and waitlist calls to action. We do not use these tools to sell personal information or run advertising pixels.
• Push delivery services: Expo, Apple, Google, and Mozilla operate the gateways that deliver native or web notifications to your devices. We send only the notification payload and the applicable push token or endpoint; they don't receive the rest of your account data.

We'll update this list when we add or remove a sub-processor. Material changes will trigger a notice under section 16.

09Cookies and local storage

We use a small number of first-party cookies and on-device storage entries, none for advertising.

• Sign-in session cookie: issued by Auth.js once you sign in; HTTP-only and secure on production.
• leaguebase_theme: a tiny string (LIGHT, DARK, or SYSTEM) so the chrome renders in your theme on the first paint without flashing the wrong colors.
• Active-league cookie: remembers which league's feed you last visited so the sign-in landing redirect goes straight there.
• Service-worker cache: when you install Leaguebase as a PWA, a service worker caches static assets and API responses for offline reads.
• Native secure storage: the iOS and Android apps keep mobile access and refresh tokens in the operating system's protected Keychain or Keystore.
• Native preferences and cache: the mobile apps keep non-sensitive preferences and limited cached app data on the device so launches are faster and settings persist.

Our analytics (PostHog) sets a first-party cookie on our own domain so we can tell visits apart and connect your pre-signup visit to your account if you register. It is not an advertising cookie. We don't set advertising cookies and we don't embed third-party tracking pixels. Browser extensions or features outside our control (for example, OS-level analytics) are out of scope for this policy.

10Push notifications and email

Push notifications and email are opt-in per category: roster alerts, league announcements, Pick'em prompts, scheduler DMs, billing notices, moderation, feed mentions, and history-mode announces. You control the toggles per league and per channel from Settings → Account → Notifications.

You can configure quiet-hours windows in your local timezone; we won't deliver push notifications during those windows except for billing or moderation messages that are time-sensitive.

Transactional email (sign-in magic links, league invitations, billing receipts, security notices) is sent regardless of marketing-style preferences because the service can't function without those messages reaching you. We don't send marketing email today; if we ever do, it will be opt-in only.

11How long we keep data

We keep different categories of data for different periods.

• Account information: for as long as your account is active, plus a short window for backups after deletion (see below).
• League content: for as long as the league exists. When a league admin deletes a league, its content is removed from active systems within 30 days.
• Verification tokens (sign-in magic links, OAuth state): invalidated after first use or on expiry, typically within minutes.
• Operational logs: typically 30 days, longer only when needed for security investigations.
• Billing records: kept for the period required by tax and accounting law in the jurisdictions we operate in (generally 7 years).
• Backups: encrypted database backups roll off on a finite schedule (typically 30 days for daily snapshots). Deleted records continue to exist in those backups until they age out.

12Your rights and how to use them

You have control over the data we hold about you. From inside Leaguebase you can:

• See and edit your profile from Settings.
• Manage notifications from Settings → Account → Notifications.
• Disconnect a fantasy league from inside that league's integration page.
• Download a JSON export of your data from Settings → Privacy → Export my data. We assemble the export asynchronously and email you a download link when it's ready.
• Delete your account from Settings → Privacy → Delete my account. Deletion has a 72-hour cooling-off window during which you can cancel; after that we revoke web and mobile sessions, remove push registrations, anonymize your account, and remove your personal content from active systems.

Depending on where you live (notably the EEA, UK, California, and several US states with comprehensive privacy laws) you may also have the right to access, correct, port, or restrict processing of your data, and to object to certain uses. To exercise those rights, use the in-product controls above or email support@leaguebase.com from the address associated with your account.

We respond to verifiable requests within 30 days (or the shorter period your local law requires) and we never charge a fee for a first request. We may need to verify your identity before completing certain requests so we don't accidentally reveal your data to someone else.

If you believe we've mishandled your data, you can complain to your local data-protection authority. We ask you to contact us first so we can try to fix it.

13Children

Leaguebase is built for adults running and participating in fantasy sports leagues. The service is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, contact us at support@leaguebase.com and we'll delete the account and any associated personal data.

14Security

We take security seriously and apply the controls you'd expect from a modern application:

• All connections to Leaguebase use HTTPS/TLS in production.
• Passwords are stored as salted bcrypt hashes, never in plaintext.
• Native refresh tokens are stored only as one-way hashes on our servers and in the device's protected Keychain or Keystore.
• Yahoo OAuth refresh tokens and ESPN session cookies are encrypted at rest.
• Stripe handles card data directly; we never see or store full card numbers.
• Access to production systems is limited to a small number of operators on a need-to-know basis with audited access logs.
• We patch dependencies regularly and run automated security checks against our code and infrastructure.

No system is perfectly secure. If you discover a vulnerability, please report it responsibly to security@leaguebase.com. We'll respond promptly and credit you (with permission) once the issue is fixed.

15International users

Leaguebase is operated from the United States and our infrastructure is hosted there. If you use Leaguebase from outside the US (including the EEA, UK, or other regions with comprehensive data-protection laws), your information will be transferred to and processed in the US. We rely on appropriate transfer safeguards (such as the EU's standard contractual clauses where applicable) and the contractual commitments of our sub-processors.

16Changes to this policy

We'll update this policy from time to time as the product evolves. When we make material changes (for example, adding a new sub-processor or expanding a category of data we collect), we'll post a changelog entry at the top of this page and email account-holders so you have time to review before the change takes effect.

17Contact us

For privacy questions, data requests, or anything in this document that's unclear, email support@leaguebase.com. For security disclosures, use security@leaguebase.com.