Privacy policy

What we store

When you use the app, we store:

• Your sign-in. An account identifier from our sign-in provider, and the email address you sign in with. If you use Sign in with Apple and choose "Hide My Email", that's Apple's private relay address, not your real one. We also note how you sign in (Apple, Google or email). If you use Sign in with Apple, we keep the token Apple issues for your sign-in, encrypted, only so we can ask Apple to revoke it when you delete your account.
• If you join as a guest (without an account): an anonymous account identifier on this device, with no name or email, the leagues you join, and when you last used the app. A guest account unused for 90 days is deleted, with its memberships. If you sign in later, the same account carries on.
• Your display name, as your sign-in provider gives it to us or as you change it.
• Your linked Sleeper username (and Sleeper's user id for it), if you link one. We use it only to list your Sleeper leagues when you set one up and to show which team is yours. It never gives you access to anything.
• The leagues you join in the app: which ones, your role (admin or member), when you joined, and when you last opened each, so leagues people use stay up to date.
• The playoff formats you and your league's admins build, publish or decide, and a record of which playoff rounds were played.
• Which team is yours, if you pick it in a league, only to highlight it for you.
• Notices you dismissed ("unusual settings" notices), so they stay dismissed.
• Security data:
  • the network (IP) address a league was set up from, used to spot abuse;
  • for app verification (Apple App Attest or Google Play Integrity), a public key for your installation of the app and a counter;
  • short-lived, one-time codes;
  • a count of actions taken from devices that can't verify the app.
  None of it identifies you outside the app.

Your league's admins and members can see your display name, your role and your linked Sleeper username within that league. Nobody outside a league can see it.

Public Sleeper data we read

The app reads public data from Sleeper's public API: leagues, teams, rosters, matchups, scores and transactions, and public user profiles (usernames and avatars). We store copies of this league data to show you standings, scores and brackets. We never write to Sleeper, and we don't have your Sleeper password or account. Fantasy Playoff Builder isn't made by, or affiliated with, Sleeper.

What we don't do

• We don't show ads.
• We don't sell, rent or share your data with anyone for their own use.
• We don't track you across other companies' apps or websites, and we don't use advertising identifiers or third-party analytics.
• We don't collect your location, contacts, photos, payment details or health data.

Who handles data for us

These service providers process data only to run the app for us:

• Supabase: sign-in (accounts, email addresses, sign-in sessions) and our database.
• Railway: hosts the app's server, which handles every request and keeps short-lived technical logs.
• Apple and Google: if you choose Sign in with Apple or Google, and to verify that requests come from our genuine app (App Attest and Play Integrity).
• Our email provider (Resend): sends the 6-digit sign-in codes to the address you type in.
• Sentry: error reports from the app and the server, so we can fix what breaks. Before a report leaves, we remove email addresses, sign-in tokens, league invite codes and IP addresses from it, and it never includes who you are.

How long we keep it

• We keep your data while you have an account.
• When you delete your account, it's deleted right away, except:
  • a record that an account was deleted and when, with no name or email, so its old sign-in can't be used again;
  • if Supabase or Apple can't be reached at that moment, what we need to finish: the sign-in identifier, and for Sign in with Apple the token, still encrypted. We retry for up to 7 days, then remove the token;
  • copies in our providers' routine backups, which expire on their own schedule.
• One-time security codes are deleted within a few days; email sign-in codes expire after 10 minutes.
• Guest accounts unused for 90 days are deleted, with their memberships.
• Error reports are kept by Sentry for up to 90 days.

Deleting your account

In the app, go to Home → Account → Delete account, then type DELETE to confirm. Before you confirm, the app lists exactly what happens to each of your leagues:

• Leagues where you're the only admin and others remain: the longest-standing member becomes admin.
• Leagues where you're the only member: deleted, with their playoff formats.
• All other leagues: your membership is removed.

Your account, memberships, dismissed notices and app-verification keys are deleted. Your sign-in is also deleted from Supabase, and if you used Sign in with Apple, we ask Apple to revoke the app's access. Nothing changes on Sleeper.

You can also leave any single league from its ⋯ menu. As a guest, Home → Account → Remove this device's guest access deletes the guest account and its memberships.

Can't open the app? Email support@sovranstudios.com from the address you sign in with, subject "Delete my account". We delete your account and data within 30 days and confirm by email. See Delete your account.

Children

The app isn't directed at children under 13, and we don't knowingly collect data from them. If you believe a child has given us data, contact us and we'll delete it.

Your rights

You can see your data in the app, change your display name and Sleeper username, and delete your account at any time. Depending on where you live, you may have further rights, such as getting a copy of your data. Contact us to use them.

Changes

If this policy changes, we'll update the date at the top and, for significant changes, tell you in the app.