Privacy policy

• Your account. Your email address, and — if you sign in with Google — the name and picture Google shares. You can also sign in with a link sent to your email. Sign-in is handled by Supabase. We also keep a display name and time zone if you set them.
• Your leagues. Each league you connect: its platform, league id, season, name and your team in it.
• Platform credentials. For a private MyFantasyLeague league, the API key you paste. For Yahoo, the access you approve at Yahoo — we store the long-lived refresh token Yahoo gives us; short-lived access tokens are held only in server memory. Both the MFL key and the Yahoo token are encrypted at rest, and if encryption is not available we store nothing rather than store them in plain text. For Sleeper we ask only for your username, to find your leagues, and do not keep it.
• Email preferences. Which emails each league sends you (daily briefing, waiver alerts, lineup reminders), whether to combine them, and a record of what was sent each day so you never get the same email twice.
• Advice history. A short summary of the advice we gave you about a league, so what we tell you stays consistent from one day to the next.
• Usage records. For each request to our AI provider: which feature, the model, how many tokens, the cost and how long it took — tied to your account and league, with no text of the question or the answer.
• Security and error records. Sign-in failures, access denials and admin actions (with the IP address and browser that made them), and error reports with any credential removed before they are stored.

We never ask for or store your fantasy platform password.

To answer quickly we keep recent copies of what we read from your league's platform — rosters, settings, standings, transactions:

• Computed pages (your briefing, lineup, trade and waiver ideas) are cached on our server for minutes to hours, and at most 3 days. Expired copies are deleted every hour.
• A snapshot of your league's settings (team count, scoring, lineup) is kept so a short outage at your platform does not produce wrong answers. It is replaced on every successful read and is never used once it is more than 30 days old.
• Completed seasons — who was drafted where in past years — are kept, because they cannot change and re-reading them is most of the cost of manager history.
• Your browser keeps a copy of the pages you viewed for up to 7 days so they open instantly; for a Yahoo league it keeps them only until you close the tab.

Yahoo leagues. Data from a Yahoo league is shown only to members of that league. The advice summaries we keep for a Yahoo league are deleted after 30 days. Our stored copies of a Yahoo league's data are also deleted 30 days after we read them. When you remove a Yahoo league, what we kept for your team — its advice and our stored copies of its data — is deleted at once. When the member who connected the league to Yahoo disconnects it or removes it, or the last member removes it, everything we kept from that league is deleted at once.

Our records about you. Security records are kept 90 days and error records 30 days, then deleted automatically.

Only to run Fantasy Boardroom for you: to read your league, compute rankings, needs, lineups and trade values, write your briefings and trade and waiver advice, send the emails you turned on, keep the service secure, and fix what breaks. We do not sell your data, use it for advertising, or share it with anyone not listed below.

• Anthropic (Claude) writes briefings and advice. We send it your league's context — rosters, team names, settings, standings, news — and your question if you ask one. We never send it your platform credentials.
• Supabase — our database and sign-in.
• Render runs our server; Vercel serves this website.
• Resend delivers our emails.
• MyFantasyLeague, Sleeper and Yahoo — the platforms you connect. We read your league from them, as you authorise; we never write to them.

We also read public sports data (player values, statistics, schedules, betting lines, news) from public sources; we send them nothing about you. Two images on the site load directly from third parties, who see the request: NFL team logos on player cards (from ESPN) and news-site icons (from Google's favicon service).

There are no advertising or analytics scripts on this site.

• Sign-in session cookies (set by Supabase) keep you signed in.
• active_league remembers which of your leagues you are viewing (one year).
• During sign-in from an AI assistant, a short cookie (ten minutes) remembers where to send you back to.

Your light or dark theme and the page cache above are kept in your browser's storage, not in cookies. There are no tracking or advertising cookies.

• Remove a league in Settings (Remove league). When the last member removes it, the league and its stored credentials are deleted; for a Yahoo league, what we kept from it is deleted at once, as described above.
• Disconnect Yahoo in Settings, if you are the member who connected the league, to delete the access token we hold and everything we stored from that league. Yahoo still lists the approval in your Yahoo account until you remove it there.
• An AI assistant you connected (Claude, ChatGPT) can be disconnected in Settings → Connected AI apps.
• Delete your account by emailing support@fantasyboardroom.ai from the address you sign in with. We delete your account and everything tied to it within 30 days and confirm when it is done.

Under Canada's privacy law (PIPEDA) you can ask to see the personal information we hold about you, have it corrected, or withdraw your consent — which means we stop and delete it, and the service stops working for you. Email support@fantasyboardroom.ai; we answer within 30 days.

Fantasy Boardroom is not directed at children under 13, and we do not knowingly collect their information.

Fantasy Boardroom is operated from Toronto, Canada. Questions about this policy, or any request above: support@fantasyboardroom.ai. If we change this policy we update the date at the top; see also our Terms.