Privacy Policy

Effective September 28, 2026

The short version. This site stores what it needs to show you your own feed and nothing else. There are no ads, no analytics, no trackers, and no third-party scripts of any kind on any page. Nothing is sold, rented or shared for marketing. You can see everything held about you on your account page and delete all of it from the same page.

Donations. The Support page links to Buy Me a Coffee. It is a plain link: nothing of theirs loads on this site. If you give there, their privacy policy covers it, and what they pass on to a creator (such as the name and message you choose to leave) is never connected to your account or activity here.

Data stored, and why

Your email address. This is how you sign back in. It is never used to send you anything, and this app has no mail provider connected.
Your password, hashed. Stored as a PBKDF2-SHA256 hash with a per-account salt. The password itself is never written down anywhere.
Your sessions. When each browser signed in, when it was last used, and its browser identification string, so you can see and end them. The sign-in token itself is stored only as a hash.
Your watchlist. The players you follow.
Your starred and flagged items. Which stories you marked to act on, and which you said should not have been ranked as top news.
Your league settings. Scoring, superflex, IDP and the rest, which change how stories are ranked for you.
Your Sleeper connection, if you make one. Your Sleeper username and user id, the roster that public account returns, and which players are rostered by anyone in each of your leagues, so the feed can show who is still a free agent there. No Sleeper password is asked for, given, or held. The connection is read-only and uses Sleeper's public API.
Your Yahoo connection, if you make one. A refresh token issued by Yahoo when you approve the connection on Yahoo's own sign-in page, plus the team and player names it returns. No Yahoo password is asked for, given, or held. The token only grants read access to Yahoo Fantasy, and you can revoke it at any time from your Yahoo account settings, which cuts this site off immediately.
Your ESPN connections, if you make any. For a public league, only the league and team numbers. For a private league, the two ESPN session cookies you paste in. Those are covered in detail below. As with Sleeper, which players are rostered in the league is kept too, to show free agents. Disconnecting a league removes all of it.

ESPN private leagues

ESPN offers no way for an application to read a private league with your permission. There is no OAuth flow and no read-only token, which is what Sleeper and Yahoo provide and why those connections need nothing sensitive. The only route in is your own browser session cookies, espn_s2 and SWID.

You should understand what those are before you hand them over. They are not scoped to fantasy football. They are the cookies that keep you signed in to ESPN generally, so while they are valid anyone holding them can act as your ESPN account. That is a real cost, so this connection is optional, folded away by default, and never suggested to you.

If you choose to connect one anyway, here is exactly what happens to them:

They are encrypted before being written to the database, with a key held in the server's environment and never stored in the database itself.
They are used for one purpose: reading the roster of the league you connected. Nothing else on ESPN is read or written.
They are never displayed back to you, never included in any page, and never written to logs or error reports.
They are deleted when you disconnect that league, and when you delete your account, in the same transaction as the rest of your data.
If the server has no encryption key configured, the connection is refused outright. Cookies are never stored unencrypted.

You can end it from ESPN's side too: signing out of ESPN everywhere invalidates the cookies, after which the connection stops working.

Cookies

Three cookies, all strictly functional. There are no advertising or analytics cookies, so this site shows no cookie banner.

fn_visitor. A random identifier so a signed-out browser can have its own players and settings. It identifies a browser, not a person.
fn_session. Set when you sign in, so you stay signed in. Deleting it, or signing out, ends the session.
fn_hidden. Which of the site's cards you closed (game day, the catch-up list, the alerts ask, the connect and save prompts, a what's-new note, the short page tours and the support thank-you lines), and until when, so they stay closed. It holds nothing else, and each entry lapses on its own.

All three are SameSite=Lax (not sent from other sites) and, over HTTPS, Secure. The first two are HttpOnly (unreadable by page scripts); fn_hidden is set by the page when you close a card, so it is not.

Server logs

The hosting provider records ordinary web server logs (IP address, requested page, timestamp, browser string), as every web server does. They are used to keep the site running and to investigate faults.

Third parties

Railway hosts the app and its database, in the United States.
Sleeper receives your Sleeper username when you connect an account, because that is the request that fetches your roster.
Yahoo handles your sign-in directly if you connect a Yahoo account, and receives the token when your rosters are read.
ESPN receives the league request, and for a private league the session cookies you supplied, because that is what the request needs to be allowed.
The publications linked here see you as an ordinary visitor if you click through to them. What happens on their site is governed by their policy, not this one.

There are no others: no analytics provider, ad network, data broker or email platform.

Retention

Account data is kept until you delete it. Sessions expire after 180 days without use, and expired ones are removed. News items are part of the shared feed and are not personal to you.

Deleting everything

The delete control on your account page removes your account, watchlist, stars and flags, league settings, every league connection including any stored ESPN cookies or Yahoo token, alert history and all sessions, in a single transaction. The rows are removed from the database, and the deletion cannot be undone.

The database is copied once a day to a backup on the same server, kept for 7 days, so it can be restored after a fault. A deleted account is gone from the live site at once and from the last backup within 7 days. Backups are never used for anything else.

Children

This site is not directed to children under 13 and accounts are not knowingly created for them.

Changes

If this policy changes materially, the effective date above changes.

Contact

Questions about any of this: forecastcard@gmail.com.