Privacy Policy
Fantasy Hoff (fantasyhoff.com) · Last updated July 2, 2026
Fantasy Hoff turns your fantasy football league's history into a living archive. To do that we store some data about you and your league. This page says exactly what, why, and what we'll never do with it — in plain language, because you're here to look at trade heists, not legalese.
What we collect
- Your email address — it's how you sign in (magic links, no passwords) and where league emails like invites land.
-
Provider connections — to import your league we
store a Yahoo OAuth token, a Sleeper league ID, and/or ESPN
session cookies (
SWID/espn_s2). ESPN cookies are encrypted at rest (AES-256-GCM) and used only to read your league's data from ESPN. We can never see or change your provider password, and we never write to your provider account — all imports are read-only. - Your league's history — teams, matchups, rosters, drafts, and transactions as reported by your fantasy provider, plus things your league creates in the app (votes, comments, messages, franchise claims).
- Basic product analytics — first-party only (page views, feature usage, error reports) stored in our own database. No third-party trackers, no ad pixels, no fingerprinting. Cookies are used for one thing: keeping you signed in.
What we do with it
- Show your league its own history. That's the product.
- Send transactional email: sign-in links, league invites, and import-status notices. No marketing lists, no selling your email.
- Answer "Ask the Historian" questions by sending your league's statistical summary (standings, records, transactions — never your email or credentials) to Anthropic's Claude API to generate the response.
What we never do
- Sell or share your personal data with advertisers. Ever.
- Post, trade, or change anything on your fantasy provider account.
- Expose your league to non-members — leagues are private to the people invited into them. Share links reveal a single record headline and nothing else.
Where it lives
Data is stored on Railway (US-hosted Postgres) and email is sent via Resend. Both process data on our behalf under their own security terms.
Deleting your data
You can delete your account from Settings → Profile at any time. That removes your sign-in, provider connections, memberships, and franchise claims immediately. Leagues you imported and solely own are deleted with it; leagues with other active members must be transferred or deleted first, so one person leaving can't erase a whole league's shared history. Questions or manual requests: [email protected].
Changes
If this policy changes materially we'll note it here with a new date. Continued use after a change means you're okay with it.