Beat Your League — Privacy Policy

The whole list. Your email address; the roster you entered and each change you make to it; your league's settings — league type (redraft, keeper or dynasty), scoring type, league size and lineup shape; and your card's country and, where the card needs one, its postal code, which Stripe takes with the card at checkout (a full billing address only if our checkout is set to ask for one). If you buy: when you bought, which plan, the Stripe reference numbers for your customer record and subscription, the record of your accepting our terms, and, for each weekly report, the lineup it set and the odds it printed. If you hold a League Pass seat: which pass it belongs to. Beside those: what you send through our forms, with the time it arrived; anything you email us; the name of the channel if you came from a link we posted; anonymous page counts, saying which page was opened, which signup step was taken or which kind of league a checked roster is for, never by whom (section 3); a record of which emails we've sent you, which never holds your address; and keyed one-way codes that can't be matched back without our private key — one made from your address if you asked for a free report, with one for each player on that roster, and one made from your address on our stop list only if you ask us to stop emailing you. Section 1 says why we keep each, and we hold nothing beyond them. We never see your card, you never create a password with us, and we never connect to your league account.

1. What we collect, and why

Your email address — because the product is an email. It is how your report reaches you and how we send the acknowledgment and renewal notices the law requires.
The roster you entered, each change you make to it, and your league's settings — because the report is computed for your team under the settings you chose: full PPR, half-PPR or standard scoring; 8, 10, 12 or 14 teams; your lineup shape; and whether it is a redraft, keeper or dynasty league, which labels your report and changes none of its numbers. Those are the closest match to your league we offer, not every custom rule it may have. Without them there is no product. A change is kept with the date it took effect, so each report can say which roster it used.
Your purchase: when you bought, which plan, and the Stripe reference numbers for your customer record and subscription — so we know each week who is entitled to a report, and so cancelling actually stops the emails.
The lineup each weekly report set and the odds it printed — so the Saturday check can hold Friday's injury news against the lineup you were sent, and so your report can grade its own earlier calls for you.
A record of which emails we've sent you — which one and when, so nothing is sent twice. It never holds your address.
Your card's country and, where the card needs one, its postal code, which Stripe's checkout page asks for along with the card; a full billing address only if our checkout is set to ask for one. Sales-tax and VAT rules turn on where a customer is, and the thresholds deciding where we must register are counted per country and per state — so we need to know where our sales come from in order to comply. They also help Stripe check the card is yours. They are not used to target advertising at you, and they play no part in your report: your report is built from your roster and public NFL data, and would be identical if you lived somewhere else.
If you ask for a free report: your email and the roster you entered, to build and send that one report — and a keyed one-way code made from your address, one that can't be matched back to it without our private key, so each person gets one per season — and a keyed one-way code for each player on that roster (no names, no address), kept with our subscriber list for the season, so one roster gets one free report. We send nothing else unless you sign up.
If you join the waitlist: your email, to send the one message the form promised — and, if you checked a roster on the signup page or the bye-week planner first, a short code standing for that roster and your league settings, so that message can bring your setup back. Nothing else is sent to it.
If you claim a League Pass seat: your email, your roster, and the pass code in your league's own link, which is what matches your seat to your league's pass (a keyed one-way code that can't be matched back to the buyer's address without our private key) — so we can email you a button to confirm the seat. Once you confirm, we keep which pass your seat belongs to for as long as it runs.
If you change your roster through our form: the new roster and your email, so we can email you a button to confirm the change. Once confirmed, it becomes the roster on file, kept with the date it took effect.
If you add a team or name one: that team's roster and settings, and the name you gave it, so its report can carry it. We email you a button first, and nothing is added until you press it.
If you ask for the rookie report: that you asked, and your email, so we can send it after the NFL Draft. Your rosters stay on file so it can name the rookies who landed beside your players. Reply stop and it won't come. If you ask on the rookie report page without a plan, we keep your email to send that one report, and nothing else.
If you use the Trade Check: your email and the roster you entered, to send you the comparison. It never changes the roster on file.
When you accepted these terms — the date and which version, recorded at checkout — so a renewal can always be tied to the words you agreed to.
Anything you email us at hello@ — an updated roster, a refund or deletion request, a question — so we can answer it.
Where you came from, if it was a link we posted: the name of that channel (for example "x" or "reddit"), read off the link itself and stored with your form entry — or, if you buy, on your Stripe customer record — so we can count which posts bring people. No cookie is involved, and it says nothing about anywhere else you go.
Page counts (section 3): one short line when a page opens or a signup step is taken (checking a roster or joining the waitlist on the bye-week planner is a step) — which page or step, the channel tag if the link had one, the name of the site that linked here (ours, for a step from one of our pages to another), whether the screen is phone- or desktop-sized, whether checkout was open, and the country Cloudflare reports, with the time it arrived. A roster checked on the signup page for a keeper or dynasty league sends one more line of the same kind, naming which of the two. They let us see which posts bring people, where the signup page loses them and which kinds of league want the report. No cookie, address, IP address or ID is in a line, and we never match one to a form entry or a purchase.
If you ask us to stop emailing you: a keyed one-way code made from your address on our stop list, one that can't be matched back to it without our private key — never the address itself — so nothing is sent to it again, except the notice the law requires before a yearly subscription renews (it tells you how to cancel). If you hold a League Pass seat, stopping also frees your seat.

We do not build a profile of you, and we do not use your data to train anything.

2. What we never ask for

Passwords or logins of any kind. We never connect to your league account on any platform — you type or paste your roster, and that is the whole connection.
Payment details. Card numbers go to Stripe on Stripe's own page. We never see them, never transmit them and never store them.
The roster you check on the bye-week planner. It is checked in your own browser and kept only in that page's own address, so a bookmark brings it back; it reaches us only if you leave your email there to join the waitlist (section 1).
Anything beyond that list — no phone number, no date of birth, and no tracking of you: the page counts in section 3 say which page was opened, never by whom. Beyond your card, checkout asks for its country and, where the card needs one, its postal code, and for a full billing address only if it is set to.

3. Cookies, analytics and tracking

This site sets no cookies and carries no advertising or tracking scripts. We count visits our own way, and this is the most it records: when a page opens, when someone checks a roster on the signup page or the bye-week planner, presses a buy button or asks for a free report on the signup page, and when someone joins the waitlist (on the front page, the signup page or the bye-week planner), one short line can go to our own counter at forms.beatyourleague.com — which page or step it was, the channel tag if the link carried one (section 1), the name of the site that linked here (for example "t.co", or ours for a step from one of our pages to the next), whether the screen is phone- or desktop-sized, and whether checkout was open at the time. A roster checked on the signup page for a keeper or dynasty league sends one more line, naming which of the two. Cloudflare, which runs the counter for us, adds the country the visit came from and the time it arrived, and keeps the lines in its Analytics Engine. That is the whole line: no cookie, no email or other address, no IP address, no browser or device ID, and nothing else from the page's address, so a count does not identify you, and we never match one to a form entry or a purchase. The counts delete themselves after three months. If your browser sends Global Privacy Control or Do Not Track, the page sends nothing at all. There is no consent banner because nothing is stored on your device and no count carries an ID. Loading our pages makes no request to any third party: the type is served from this site and the counter lives on our own domain, so the only parties that see a visit are our host (GitHub) and Cloudflare, each with the ordinary request logs any server keeps.

4. Who else sees your data

Five service providers, each doing one job, and none gets anything beyond it. Each processes data in the United States, so your information is handled there.

Stripe handles payment and billing. They hold your payment details and your subscription. Your checkout and your customer record there also carry the roster and settings you entered (as a short code), the plan you chose, the channel tag if you came from a link we posted, and the record of your accepting these terms — that is how a payment becomes your report. We hold a reference to that record.
Resend delivers our emails. They handle your address and the message.
Cloudflare runs our domain, routes mail sent to hello@, stores what you send through our forms (waitlist and rookie-report requests, free-report requests, seat claims, roster changes, team adds, Trade Checks, and the buttons you press to confirm them), each entry with the time it arrived, and runs our page counter (section 3). Each of those entries deletes itself within about 13 months of arriving; the page counts after three months.
Google (Gmail) is the inbox that mail to hello@ is forwarded to, and where we read and answer it. It holds what you email us and our replies. Before our forms were switched on, joining the waitlist sent us an email there instead; we delete those emails once the launch email has gone out.
GitHub hosts this site and runs the automation that builds and sends the reports. Your email, roster, settings and purchase records, and the lineup and odds of each report you were sent, are kept, encrypted, in the storage that automation carries between runs (its cache), and in an encrypted backup copy it keeps for up to 90 days — never in the public site, its code or its run logs. A deletion removes the older copies too. Five records it keeps beside the code are public: what has been sent, the stop list and the list of deleted customers, each as keyed one-way codes, never an address; League Pass seat resets, as a one-way code of the pass's Stripe reference number and the time; and our record of graded calls (section 5).

Each has its own privacy policy. We do not sell your data, rent it, or hand it to advertisers or data brokers — not now and not later. If that ever changed we would have to tell you first, and you could leave.

Where your postal code and any billing address actually live, exactly. They are held by Stripe, alongside your payment, and we read them in Stripe's own dashboard. They are not copied into the system that builds and sends your reports — that system knows your email, your roster, your settings and the records listed above, never your postal code or billing address, so neither can reach a report, the public record of graded calls, or anything else we publish. Stripe also records the country your card was issued in, which it collects to check the card whether we ask for an address or not.

5. Your report is yours alone

It is built from the roster you gave us and public NFL data, and it goes only to you. We never publish your name or your email. We do publish a record of graded calls: each call your report printed odds on is listed with its two NFL players, the lineup slot, the setup (scoring, league size and lineup shape), the week and when it was recorded — never a subscriber, a league or an address. The calls from one report can sit together there, so when only a few subscribers share your setup, someone who already knows your roster could recognise your calls in it. It also records the odds printed each week on our own sample roster's report, which holds nothing of yours.

6. Where the football data comes from

Openly licensed public NFL data. Nothing about you, your league or your leaguemates is in it, and nothing about you is ever sent to it.

7. How long we keep it

Form submissions (every kind section 4 lists) delete themselves within about 13 months of arriving, and page counts (section 3) after three months. Waitlist requests that reached us by email, before our forms were switched on, are deleted once the launch email has gone out. A confirmed seat or roster change becomes part of your subscription and is kept like the rest of it. Everything else — your email, roster and settings, your purchase records, the lineups and odds your reports gave you, and the mail you send us — we keep while it is needed: while you are subscribed, and afterwards so a returning subscriber's setup still works and a refund or billing question can be answered. There is no fixed date for those: ask, and we delete them and confirm it within 30 days. Your postal code, and any billing address, are the one item we cannot always delete on request: they are part of the payment record Stripe keeps for us — the amount, the date, the plan, any tax charged and where you are — which tax law requires to be kept for a set number of years. We delete everything else and tell you in writing that this payment record is what remains. So that an old payment is never read back in and your data restored, we keep one keyed code of your Stripe customer number, which can't be matched back to you without our private key.

8. Seeing or deleting what we hold

Email hello@beatyourleague.com and within 30 days we will tell you exactly what we hold, send you a copy you can take elsewhere, correct it, or delete it — whichever you ask for. You do not need an account or a form, and we will not ask you why. Cancelling stops the billing; asking us removes the data. If you are covered by the GDPR, the UK GDPR, Canadian privacy law, or a US state privacy law, these are the access, correction, deletion and portability rights those laws give you, and we honour them for everyone regardless of where you live.

9. Age

This is an adult product: you must be 18 or older to subscribe. We do not knowingly collect anything from children, and if you believe a child has given us data, email us and we will delete it.

10. Changes to this policy

We may update this policy. If a change materially affects you, we will email subscribers and League Pass seat holders before it takes effect, and the date at the top of this page will change.

11. Who to contact

Beat Your League is an independent solo project, and its one person answers this page. Privacy contact, Beat Your League: hello@beatyourleague.com — for anything on this page: access, deletion, or a question about how something works. Billing questions are covered in the Terms of Service.