Privacy Policy

Fantasy Heartbeat ("we," "us," "our") is a fantasy football intelligence service covering dynasty, redraft, and guillotine formats. We connect to your fantasy leagues to show you rankings, player intelligence, trade analysis, and waiver/survival recommendations. This policy covers the Fantasy Heartbeat website, app, and the Fantasy Heartbeat Draft Bridge browser extension. For any privacy question, contact support@fantasyheartbeat.com or use our contact form.

We collect only what we need to run the service:

• Account information. Your email address and an internal account identifier. You can sign in with Google, with an email and password, or with an emailed magic link. If you choose Google sign-in, we receive your basic Google profile (email address, name, and avatar) to create your account — we never receive your Google password.
• League connections. The platform you connect (Sleeper, FleaFlicker, Yahoo, or ESPN), the league ID(s) you provide, and the league, roster, and transaction data we sync from those platforms to power your views. For platforms that require authorization (such as Yahoo OAuth tokens or ESPN connection tokens), those authorization tokens are stored AES-256 encrypted at rest and are used only to read your league on your behalf. We never ask for or store your password for a connected platform.
• Draft Bridge data. When you open a supported ESPN, Yahoo, or Sleeper draft room with our browser extension installed, it reads only the draft information rendered on that page: the draft or league identifier, fantasy-team display names, your draft seat, roster settings, player names and teams, completed picks, and—during salary-cap drafts—the displayed nominee, bids, and budgets. It then opens or reconnects the matching Fantasy Heartbeat draft board in the same browser and transfers snapshots only between those local tabs. It does not read cookies, passwords, authentication tokens, or browsing history; inspect pages outside the supported fantasy-football hosts; intercept network traffic; submit picks or bids; or send draft-room snapshots to our servers.
• Subscription & billing data. If you subscribe to Pro, payment is handled by Stripe. We never see or store your full card number — we store only your Stripe customer and subscription identifiers, plan, status, and billing-period dates.
• Support messages. If you contact us, we keep your message and the email address you use so we can reply and maintain a support history.
• Email updates (optional). If you sign up for our free email updates, we store your email address and signup source. You can unsubscribe at any time via the unsubscribe link in any email or by contacting us directly.
• Usage & diagnostics. Which pages and features you use (for example, connecting a league or running a trade analysis). When you are signed in, these product events are linked to your account so we can measure active usage; the event details are limited to a fixed safe allowlist and never include your personal content. We also keep short-lived counters to enforce rate limits and prevent abuse, plus error telemetry that helps us fix bugs. Error reports are stripped of personal data before they leave our servers (see Section 4).
• Technical data. Standard request metadata such as IP address, device, and browser type, collected by our hosting provider when you load the site.

We do not sell or share your personal information (as "sell" and "share" are defined under the California CCPA/CPRA), and we do not run third-party advertising networks on the service.

• To connect your leagues and show your rosters, rankings, and intel.
• To generate AI-assisted player intelligence and recommendations (see Section 4).
• To process subscriptions, billing, and cancellations via Stripe.
• To send transactional email (sign-in links, support replies).
• To monitor reliability and security, debug errors, and prevent abuse.
• To comply with legal obligations.

AI-generated player intelligence is a core feature. We use the Anthropic (Claude) and OpenAI APIs in two ways:

• Player intelligence. We generate outlooks and analysis from publicly available NFL data (player stats, news, depth charts). This processing is about NFL players, not about you, and does not include your personal information.
• Support replies. When you message support, the text of your message may be sent to the Anthropic API to draft a suggested reply. A human reviews and approves every reply before it is sent — the AI cannot email you on its own.
• League write-ups you ask us to generate. Some features write a shareable recap of your league — for example the guillotine Chop Report. When you request one, details from that league are sent to the Anthropic API to draft the text: the league name, team names, weekly scores, and the player names on the relevant rosters. Team names are chosen by the managers in your league and can contain personal information. We do not send your email address, account ID, or billing details. If AI drafting is unavailable, we fall back to a template generated entirely on our own servers.

We use these providers' business/API tiers. Under their API terms, data you submit is processed to produce the output and is not used to train their models by default.

We rely on the third-party processors below to operate Fantasy Heartbeat. Each receives only the data needed for its function:

These providers process data on our behalf under their own security and privacy commitments. Some may process data outside your country; where required, transfers rely on appropriate safeguards.

We use two categories of cookies and browser storage:

• Essential (always on). Supabase Auth sets secure, HTTP-only session cookies that keep you logged in across pages. When you connect a league that requires authorization (such as Yahoo OAuth), we set a short-lived state cookie to protect the flow against cross-site request forgery. These cookies are required for the service to function.
• Non-essential product analytics (your choice). We use a product-analytics pipeline that links your internal account UUID to usage events (for example, which features you interact with) so we can measure active engagement and improve the product. This is not advertising — we do not run third-party ad networks or cross-site tracking pixels. We show a cookie-consent banner on your first visit and activate this pipeline only if you accept. Your choice is stored in your browser's local storage; for signed-in users it is also recorded in our auditable consent ledger.
• Draft Bridge session storage. The browser extension keeps at most eight recent draft snapshots in Chrome's session-only extension storage so it can reconnect an open Fantasy Heartbeat tab after a refresh. These snapshots stay on the device and are cleared when the browser session ends. The extension does not use this storage for advertising, profiling, or cross-site tracking. During private Yahoo compatibility testing, you may explicitly download a bounded calibration JSON. It excludes the page URL, raw HTML, images, and real fantasy-team names and is never transmitted automatically.

Changing your choice. You can withdraw or update your analytics-cookie consent at any time by clearing your browser's cookies and local storage for this site — doing so resets your choice and the banner will reappear so you can make a new selection. Note that clearing cookies will also sign you out, because the session cookie is essential.

Global Privacy Control (GPC). We honor the Global Privacy Control signal. If your browser or extension sends GPC, we treat it as a standing instruction to turn off all non-essential product analytics for that browser — automatically, with no action needed from you and no banner shown. A GPC signal overrides any earlier "accept" you may have chosen on that device, and we enforce it on our servers as well as in your browser, so an analytics event is not recorded even if a cached copy of our site tries to send one. Essential cookies (your login session) are not affected, because the service cannot function without them.

• Account & league data is kept while your account is active. When you delete your account, we delete or anonymize it within a reasonable period, except where we must retain certain records by law.
• Billing records are retained as required for tax, accounting, and legal purposes, by us and by Stripe.
• Support correspondence is kept to maintain a history of your requests.
• Error telemetry is retained per our monitoring provider's retention window and is already stripped of personal data.
• Draft Bridge snapshots are session-only on your device and are not retained on our servers. A calibration JSON exists only if you explicitly download it and remains under your control until you delete or share it.
• Product analytics & email updates. Usage events are kept in aggregate to understand product engagement; your email-updates subscription is kept until you unsubscribe or delete your account.

Depending on where you live (including under the EU/UK GDPR and the California CCPA/CPRA), you have rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Export — receive your data in a portable format. You can download it yourself at any time from Settings (Settings → Download my data), which returns a machine-readable JSON file of the personal data we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — delete your account and personal data yourself from Settings (Settings → Delete account), or ask us to do it. Deletion removes your account, league connections, and stored tokens, subject to legal retention requirements.
• Disconnect & withdraw consent — remove a connected league or revoke platform authorization at any time.

We do not sell or share your personal information, so there is no "sale" or "share" to opt out of, and we will not discriminate against you for exercising any of these rights. We nonetheless honor the Global Privacy Control signal as an opt-out of non-essential analytics — see Cookies and local storage. To exercise a right, email support@fantasyheartbeat.com or use the contact form. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law allows.

We protect your data with encryption in transit, encryption at rest for sensitive credentials, scoped access controls, and a monitoring layer that removes personal data from error reports. No system is perfectly secure, but we work to limit what we collect and who can access it.

Fantasy Heartbeat is primarily a tool for managing competitive fantasy football leagues. We do not knowingly collect personal information from anyone under 13 — to create an account you must confirm you are at least 13 years old. If you believe a child under 13 has provided us personal information without parental consent, contact support@fantasyheartbeat.com and we will delete it.

Users aged 13 to 17 may create accounts and use the free tier. We do not direct the service at minors and do not collect data from them beyond what is described in this policy for all users (account email, league connections, usage events gated on cookie consent). Minors may not purchase a paid subscription — the platform requires users to be old enough to form a binding contract in their jurisdiction (generally 18) before subscribing.

We may update this policy as the service evolves. We will revise the "Last updated" date above and, for material changes, provide a more prominent notice. Continued use after an update means you accept the revised policy.

Questions about this policy or your data? Email support@fantasyheartbeat.com or use our contact form.