Privacy Policy

Account information. When you create an account or join the waitlist, we collect your email address. If you set a password we store it only in hashed form, so we can't see your actual password. If you choose to sign in with Google instead, Google tells us the email address on that account along with the basic profile details it includes, such as your name and profile picture, and we never receive your Google password.

Billing information. Payments are handled by Stripe. We receive confirmation of your subscription status and payment history, but we never see or store your full card details. Those go directly to Stripe.

Synced league data. If you connect a fantasy league (from platforms like ESPN, Yahoo, Sleeper or Fantrax), we read your league's rosters, scoring settings, standings and transactions so the tools can work against your actual league. Section 4 explains what we store from that read and what we only pass through, and section 5 explains the one thing we build from it that is not solely about you.

Fantasy platform credentials. Connecting a Yahoo league sends you to Yahoo to authorise us, and the access token that comes back lasts about an hour and is never stored. ESPN offers nothing equivalent, so a private ESPN league is read by forwarding two of your own ESPN browser cookies, called SWID and espn_s2, which you paste in yourself. Those two values are stored against your league so that the features which read the platform live, like the free agent list behind the streaming picks, keep working after the day you set the league up. They grant read access to your own ESPN fantasy leagues, they are readable only by your account, and you can remove them at any time by disconnecting the league. Sleeper and public ESPN leagues need no credential at all.

Content you create. Rankings you build, Rankings Game entries, saved scoring settings, stream reminders you ask for, and anything you post on the Service.

Messages you send us. The contact box in the footer is handled by Netlify Forms, which stores every message along with the name and email address you put in it, and emails a copy to us.

How you use the Service. We record a small number of milestones against your account so the product knows where you are up to, such as when you finished the mock draft, when you completed setup and which league you last had open.

Technical data. IP address, browser type, device information and request logs, recorded automatically by the services that host us. We use this to keep the Service running and to detect scraping or abuse. We want to be specific here, because most sites cannot say it: League Winner runs no analytics or advertising software of any kind. There is no Google Analytics, no advertising pixel and no third party tracker anywhere on the site, and we do not build a profile of your browsing.

We use your information to:

• provide and manage your account, membership tier and tools;
• generate personalised rankings and analysis from your synced leagues;
• build the anonymous trade history described in section 5;
• process payments, credit a referral to the affiliate who sent you, and detect fraudulent transactions;
• run the Rankings Game, including verifying entries, scoring them, publishing results and paying prizes, as described in section 6;
• send transactional emails covering logins, billing and important account changes;
• send the reminders you specifically ask for, such as an email the night before a player you planned to stream is due to play;
• send marketing emails like newsletters and product updates, if you've opted in. Every one includes an unsubscribe link, and opting out never affects your membership;
• improve the Service and protect it from scraping, abuse and security threats.

We only collect and use your information for these purposes. If we ever need it for something materially different, we'll ask you first.

We do not sell your personal information. We share it only with:

• Service providers we rely on to run League Winner. These are Stripe for payments, Netlify for hosting and for storing contact form messages, Supabase for authentication and our database, Resend for the emails we send you, Google for the waitlist list we started the business on, and Cloudflare and jsDelivr, whose networks deliver parts of the site to your browser and therefore see your IP address. Each of them only receives what it needs to do its job.
• Fantasy platforms you choose to sync. Where a platform connects through an authorised app (like Yahoo), that platform will show League Winner as an app you've authorised.
• Affiliates, in a limited way. If you arrived through an affiliate link, the affiliate who referred you is told that a referral converted so we can pay their commission. They are not given your email address or anything else about you.
• Authorities, if we're legally required to (for example by a court order), or where necessary to protect our legal rights.
• A buyer or successor, if League Winner is ever sold or merged. Your data would transfer as part of the business, under the same protections as this policy, and we'd notify you before that happened.

Most of these providers store data outside Australia. Stripe processes payments in the United States and Ireland, and Netlify, Resend, Google, Cloudflare and jsDelivr all operate from the United States. Our database and authentication run on Supabase, in the single hosting region we selected for the project. Where information goes overseas we take reasonable steps to ensure it is handled consistently with Australian privacy law.

You control your synced leagues. We only access the leagues you authorise, and you can disconnect a league at any time through your account settings or through the fantasy platform itself. Once disconnected, we stop collecting data from that league.

It is worth being exact about what a sync leaves behind, because it is less than people expect. What we store is the league's name, your own team name and your own roster, the league's scoring settings and its shape, and for a private ESPN league the two cookies described in section 1. Everything else the tools show you, including the free agent list and the state of other teams in your league, is read live from the platform while you have the page open and is not kept afterwards.

A fantasy league necessarily contains other people, so a sync passes over information about the other managers in your league, such as their team names. We do not store their rosters or build any record about them, and we never contact them.

The fantasy platforms themselves (ESPN, Yahoo, Sleeper, Fantrax) have their own privacy policies covering how they handle your data. We're not responsible for their practices and encourage you to review their policies.

There is one use of synced league data that benefits members other than you, and we would rather explain it than bury it. Trade Winner is more useful the more real trades it can compare a deal against, so every night we take the league identifiers of synced Sleeper leagues and read the public transaction log that Sleeper publishes for each of them. Real completed trades flow into a shared history that all Pro members can see.

What that history records is the players involved and the shape of the league the trade happened in, meaning its size, its roster spots and its scoring type. It records no names. No manager identity, team name, email address or account is stored with a trade, and nothing in that history identifies you or anyone else in your league.

If you would prefer your league not to contribute to it at all, disconnect the league or email us and we will exclude it.

Entering the Rankings Game means giving us a ranked list of 50 players, which we hold against your account. To be eligible for a prize you also need to confirm your email address, which is how we know a winner is a real person we can pay.

Once entries close and the season ends, we publish the final board and the score of every entry, so that any result can be checked by anyone. We may also use the lists themselves in aggregate to publish a community consensus ranking of the kind commonly called average draft position. No entrant's name is ever shown beside their specific picks. The full rules for both competitions are in the Rankings Game terms.

If you win, we collect the payment details needed to pay you, such as a PayID or PayPal address, and we keep the record of that payment for as long as tax law requires.

Almost everything the Service produces is advice rather than a decision. Rankings, trade values and streaming suggestions are all computed automatically, but they only ever recommend something to you, and nothing about your account changes based on them.

There is one exception worth naming. Rankings Game entries are scored by a computer program, with no human judgement involved, and that score decides who wins a prize. The personal information it uses is the list of 50 players you submitted and the time you submitted it, which is what settles a tie. The rule it applies is published in full in clauses 6 and 7 of the Rankings Game terms, so any result can be checked by hand. If you think your entry has been scored wrongly, email us and a person will look at it.

Draft Hacker's Chrome extension connects your draft room to your draft board. Signing in to the extension uses your League Winner email and password. The password is sent once, over an encrypted connection, to our own authentication service and is never stored by the extension; a session token is kept in your browser's extension storage so you stay signed in, and you can log out at any time from the extension itself.

While your draft runs, the extension reads the draft room tabs you have open on ESPN, Sleeper, Yahoo or Fantrax and passes the picks, which are public player names, to your own League Winner tab. Those picks move between your tabs inside your browser. They are not sent to our servers, and the draft snapshot the extension holds is cleared when your browser closes.

Chrome will tell you when you install it that the extension can read and change data on all websites, and we would rather explain that than leave you wondering about it. The reason for the broad permission is the floating panel, which has to be able to appear over a draft room, and Chrome offers no narrower way to ask. The panel checks which site it is on before it does anything, so on any page that is not one of those four draft rooms it does nothing at all. The extension does not read, collect or transmit your browsing history, and it reads no page other than a draft room you have open.

We use browser storage to keep you logged in and to remember your preferences, such as where you left the extension's panel sitting. Your login session is held in your browser's local storage rather than in a cookie.

One other thing is stored, and it is the only thing we keep that is about where you came from rather than what you are doing. If you arrive through an affiliate link carrying a referral code, that code is saved in your browser for 30 days so the affiliate is credited if you subscribe within that window. It records the code and the time you arrived, it is not linked to you unless you actually subscribe, and it is not used to track you across other websites.

You can block or delete browser storage in your browser settings, but some features, like staying logged in, won't work properly without it.

We use industry-standard measures to protect your information, including encrypted connections (HTTPS), hashed passwords, and payment processing handled entirely by Stripe. Our database enforces access rules row by row, so your leagues, entries and settings are readable only by your own account, and the platform credentials described in section 1 are covered by that same rule.

No internet service can guarantee absolute security, but we take protecting your data seriously and will notify you and the regulator as required by law if a data breach ever puts your information at risk.

We keep your information while your account is active and for as long as we need it to run the Service or meet legal obligations. If you delete your account, your profile, your leagues, any stored platform credentials, your saved settings, your reminders and your Rankings Game entries are deleted with it.

Three things outlive the account, and none of them is hidden. Your billing records stay with Stripe, because paid invoices are tax records we are required to keep. Rankings Game results that have already been published stay published, because a competition result that can be edited afterwards is not a result. Trades already added to the anonymous history described in section 5 remain, because they carry no identifying information and nothing in them points back to you.

You can:

• Access the personal information we hold about you;
• Correct anything that's inaccurate or out of date;
• Delete your account and associated data;
• Unsubscribe from marketing at any time;
• Complain if you think we've mishandled your information.

Deleting your account does not require asking us. There is a button on your account page that does it immediately, and it cancels any live subscription before it deletes anything, so you cannot end up paying for an account that no longer exists.

For anything else, email us at hello@leaguewinnernba.com. We'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

If you're in the UK or EU, you have equivalent rights under the GDPR, including data portability and the right to complain to your local supervisory authority. Where the GDPR applies, we rely on the performance of our contract with you to provide the Service and take payment, on your consent for marketing emails, and on our legitimate interests in keeping the Service secure and in improving it.

The Service is for people aged 18 and over. We don't knowingly collect personal information from anyone under 18. If we learn we have, we'll delete it.

We may update this policy from time to time. If we make a material change to how we handle your personal information, we'll notify you by email or on the Service before it takes effect. The "Last updated" date at the top always shows the current version.

Questions about this policy or your data? Email us at hello@leaguewinnernba.com.