Privacy Policy

Fantasy Hall of Fame (fantasyhoff.com) · Last updated October 10, 2026

Fantasy Hall of Fame turns your fantasy league's history into a living archive, for football and basketball. To do that we store some data about you and your league. This page says exactly what, why, and what we'll never do with it, in plain language.

What we collect

• Your email address. It's how you sign in (a six-digit code or a sign-in link, no passwords) and where league emails like invites land. You can also add a display name.
• Provider connections. To import your league we store a Yahoo OAuth token, a Sleeper league ID, encrypted normalized CBS exports, and/or ESPN session cookies (SWID / espn_s2). ESPN cookies are encrypted at rest (AES-256-GCM) and used only to read your league's data from ESPN. CBS session cookies are kept only if you turn on daily updates. For MyFantasyLeague we exchange your password for a session and don't keep the password. We never write to your provider account. All imports are read-only.
• Your league's history. Teams, matchups, rosters, drafts and transactions as reported by your fantasy provider, plus things your league creates here (votes, comments, LeagueBot questions, franchise claims).
• Purchases. Whether a league has an Elite membership and its billing status. Card details go straight to Stripe and never reach us.
• Product analytics. Page views, feature usage, sign-in timing and error reports, stored in our own database and in PostHog. On the website we also use Microsoft Clarity session analytics.
• Advertising measurement (website only). Meta and Reddit pixels and server-side conversion APIs measure whether ads lead to account registrations, league imports, checkout starts and purchases. They may receive the page URL, browser and device identifiers, IP address, ad-click identifiers, and one-way hashed versions of your email and internal user ID. We never send provider credentials or league data to these advertising tools.
• Cookies. On the website we use cookies to keep you signed in and to support analytics and ad attribution (including Meta and Reddit browser and click identifiers).

Our mobile apps

The Fantasy Hall of Fame apps for iPhone, iPad and Android use the same account and the same data as the website. They keep your sign-in in your device's secure storage: the keychain on iPhone and iPad, and an encrypted store protected by the Android Keystore on Android. When you connect ESPN, CBS or Yahoo in the app, you sign in on that site's own page inside the app, and we keep only what's listed above. In the United States, Elite purchases in the apps open our website's checkout, where Stripe handles your card. On Android, Google Play shows its own notice first and we tell Google Play about the purchase (the amount and date, never your card or name) because its rules require it.

• Usage and crash reports. The apps send usage and diagnostic events (which screens you open, how long sign-in took, whether a league connection worked, and crash details) to us and to PostHog, the analytics service we use, tied to your account ID rather than your email. We may record some app sessions to see where people get stuck; anything you type is always hidden in those recordings.
• Notifications. If you allow notifications, we store your device's notification token with your account so we can tell you when your league's history is ready, when the Tuesday Ledger is out, when there's a new trade in your league, and when a trial is about to end. Offers and news about new features come only if you turn them on separately. You can turn either off in the app's Settings or your phone's settings, and signing out removes the token from your account.
• Measuring our ads (United States only). To see which of our ads bring people to the app, the apps in the United States use Meta's app software to tell Meta about installs, sign-ups, connected leagues, trials and purchases, and our server sends Meta the same trial and purchase events with a scrambled (hashed) copy of your email. On iPhone and iPad, your device's advertising identifier is shared only if you allow tracking when Apple asks. On Android, the app can read your device's advertising ID, which you can reset or delete in your phone's settings. Apple also tells us which Apple search ad, if any, led to an install, without identifying you. Outside the United States, the apps don't load Meta's software.
• App updates. Between store releases the apps can download small updates to their own screens from our servers. Each update is signed by us and checked on your device before it runs.
• Comments. If you report a comment, we keep a copy so we can review it, usually within a day. If you block someone, their comments are hidden from you and you won't be notified about them.

What we do with it

• Show your league its own history. That's the product.
• Send email: sign-in codes, league invites, import notices, the weekly League Ledger newsletter for your league, and occasional product emails. Every newsletter and product email has an unsubscribe link, and you can change what you get in your account settings. We don't sell or share your email.
• Write league content with AI. LeagueBot answers questions by sending your league's statistical history (standings, records, transactions, never your email or credentials) to Anthropic's Claude API. Recaps and newsletter writing send the same kind of league statistics to OpenAI.

What we never do

• Sell your personal data. Ever.
• Post, trade or change anything on your fantasy provider account.
• Expose your league to non-members. Leagues are private to the people invited into them. Share links reveal a single record headline and nothing else.

Where it lives

Data is stored with Amazon Web Services in the United States. Email is sent through Resend, and payments are processed by Stripe. Anthropic and OpenAI process league statistics to write AI content. PostHog and Microsoft process analytics, and Meta and Reddit process advertising-measurement events from the website. These providers process data under their own security and privacy terms.

Deleting your data

You can delete your account at any time from Settings, then Profile, on the website or in the app. That immediately removes your sign-in, provider connections, memberships, franchise claims and usage history. Leagues you imported and solely own are deleted with it. Leagues with other active members must be handed to another member or deleted first, so one person leaving can't erase a whole league's shared history. Any Elite subscription on a league deleted this way is canceled. Questions or manual requests: [email protected].

Changes

If this policy changes materially we'll note it here with a new date. Continued use after a change means you're okay with it.

← Back to Fantasy Hall of Fame · Terms of Service · Support