Privacy Policy

LeagueLytics is run by Stacked Systems LLC, an Indiana company. We collect your account details, the league data we read from ESPN for the league you connect, and what you and your league’s managers enter (names, payout rules, payment notes, the emails managers leave to get reports). We use it to run the Service and to understand how it’s used. We never ask for your ESPN password (your ESPN session cookies are the one credential we hold, encrypted, to read your league), we never hold your league’s money, and we never sell personal information. You can delete everything from Settings.

Account. Your email address and password (stored hashed by our authentication provider), an optional display name, and the date you signed up.

League data from ESPN. When you connect a league, we read ESPN's fantasy football service, read through the same interface the ESPN website uses, signed in with the session cookies you give us when you connect the league: league settings, team names and logos, scores and matchups, each team’s weekly lineup and player points, waiver claims and bids, trades and draft picks, and the display name, first name and last name ESPN shows for each team’s manager. We store it so your league’s pages work without reading ESPN every time.

Your ESPN session. ESPN only shows a league’s seasons to people who were in it, so to connect a league you paste two cookies from your own browser session (espn_s2 and SWID). We check that they open the league, then keep them encrypted on our servers for as long as the league is connected, and use them solely to read that league’s data from ESPN — the first import, a nightly refresh during the season, and the weekly report pulls. They are never shown to anyone (not even you, once saved), never sent anywhere but ESPN, and never used to change anything in your ESPN account. You can replace or remove the session at any time in the league’s Settings; removing it stops the refreshes but keeps what was imported. Deleting the league or your account deletes it. We never ask for your ESPN password.

What you enter. Names you set for managers, the league name, buy-in amounts and due dates, your own payment instructions (for example a Venmo handle), payout rules, who has paid, and notes.

What managers enter. When a manager claims their team on your league page they give us an email address, which we store against that manager only after they confirm it from the email we send. When a manager taps “I paid” on the buy-in sheet we store that tap and when it happened.

Billing. If you buy Pro, Stripe collects your card details directly; we receive your Stripe customer ID, subscription status and renewal date, never the card.

Usage. Analytics events (§7) and server logs (IP address, browser, pages requested, errors) kept for a short time for security and debugging.

To build and show your league’s pages, to write and send the weekly reports and buy-in sheets, to compute payouts from your rules, to bill Pro, to answer support email, to keep the Service secure, and to understand which parts of it get used (aggregate). Our legal bases, where they apply, are performing our contract with you, our legitimate interest in running and improving the Service, and consent where we ask for it (a manager claiming their team).

Writing the reports. The short summary on top of each weekly report is written by a language model from the facts we compute (scores, margins, bids, and the manager names as they appear on your page). We send those facts to our model provider (Anthropic) for that purpose only; we do not send email addresses, payment notes or anything from the treasury. The facts shown on the report itself are computed by our code, not by the model.

Your league’s pages show information about people other than you — the managers in your league — including the names ESPN displays for them (or the names you set), their results, and in the treasury whether they’ve paid. You choose whether the pages show first names or ESPN usernames, and you can rename or merge managers. You are responsible for having a basis to share that with us and with your league; we process it on your behalf to run the Service, and we never use it to contact anyone unless they themselves claim their team.

You don’t need an account. We don’t store anything about you on the league: a report keeps a count of how many times it was opened, and an analytics event (§7) is recorded for the commissioner’s account, not yours. If you claim your team, we store the email you give us only after you confirm it from the email we send, and we use it only to send that league’s weekly reports and buy-in sheets; every such email has an unsubscribe link, and the commissioner can remove your email from Settings. If you tap “I paid”, the commissioner sees that you did.

We use these providers to run the Service. Each processes data only on our instructions and under its own privacy terms:

• Supabase — Database and authentication
• Vercel — Application hosting and delivery
• Stripe — Subscription billing and payment processing
• Resend — Email delivery (account emails, weekly reports, dues sheets)
• Anthropic — Writing the short narrative on each weekly report from the computed facts
• PostHog — Product analytics (usage measurement)
• Google Workspace — Email hosting for our support inbox and correspondence

We read league data from ESPN’s service (ESPN, Inc.), which has its own privacy policy and is not our processor; we don’t send ESPN anything about you beyond the league ID being requested. We may also disclose information if the law requires it, to protect our rights or safety, or in connection with a merger or sale of the business (we’d tell you first).

We use three kinds of cookies and browser storage: sign-in cookies that keep you signed in (strictly necessary); a small preference cookie that remembers you’ve completed setup, kept for a year; and an analytics cookie set by PostHog on our own domain, which gives your browser a random ID so we can count visits and see which parts of the product get used. We don’t use advertising cookies or third-party tracking cookies, and no other company collects information about your activity across other websites through the Service.

We use PostHog to understand how the product is used: pages viewed, buttons and links clicked (including their labels), the referring page and campaign links, browser and device type, and approximate location from your IP address. This runs on every page, including the public league pages. Analytics events are keyed to the random browser ID and, once you sign in, to your user ID and email address. We don’t use analytics for advertising. You can block it with a browser tracking blocker or by disabling cookies for our site; the Service works without it.

We don’t sell or share personal information, so there is nothing for a “Do Not Track” or Global Privacy Control signal to opt out of, and we don’t otherwise change how the Service behaves in response to those signals.

Your account and the leagues in it stay for as long as your account is active. Delete a league from its Settings and its imported data, insights, reports, treasury and claimed emails are deleted immediately and its links stop working. Delete your account from Settings and everything goes at once: any Pro subscriptions are cancelled first. Stripe keeps the payment records it is legally required to keep; server logs and analytics events age out on their providers’ schedules (PostHog: up to seven years for events; logs: days).

You can see and change your account and league data in the app, export nothing we don’t show you (everything we hold about a league is on its pages and in its treasury), and delete it as above. Depending on where you live you may have rights to access, correct, port or delete personal information, or to object to or restrict processing; email hello@leaguelytics.app and we’ll help, including if you’re a league manager rather than an account holder. We don’t discriminate against anyone for exercising their rights.

Data is encrypted in transit and at rest by our providers. Access to league data is enforced in the database itself (row-level security): a commissioner can only reach their own leagues, and public pages can only be reached through their unguessable links. No system is perfectly secure; if we learn of a breach affecting you we will tell you as the law requires.

The Service is for adults. We don’t knowingly collect personal information from anyone under 18; if you believe we have, email us and we’ll delete it.

Our providers store data in the United States. If you use the Service from elsewhere, your data is transferred to and processed in the United States.

We may update this policy. For material changes we’ll give notice in the app or by email before they take effect. The effective date at the top is the current version.

Stacked Systems LLC · hello@leaguelytics.app