Privacy Policy
Effective September 11, 2026
The short version. This site stores what it needs to show you your own feed and nothing else. There are no ads, no analytics, no trackers, and no third-party scripts of any kind on any page. Nothing is sold, rented or shared for marketing. You can see everything held about you on your account page and delete all of it from the same page.
What is stored, and why
- Your email address. This is how you sign back in. It is never used to send you anything, and this app has no mail provider connected.
- Your password, hashed. Stored as a PBKDF2-SHA256 hash with a per-account salt. The password itself is never written down anywhere.
- Your sessions. When each browser signed in, when it was last used, and its browser identification string, so you can see and end them. The sign-in token itself is stored only as a hash.
- Your watchlist. The players you follow.
- Your starred and flagged items. Which stories you marked to act on, and which you said should not have been ranked as top news.
- Your league settings. Scoring, superflex, IDP and the rest, which change how stories are ranked for you.
- Your Sleeper connection, if you make one. Your Sleeper username and user id, and the roster that public account returns. No Sleeper password is asked for, given, or held. The connection is read-only and uses Sleeper's public API.
- Your Yahoo connection, if you make one. A refresh token issued by Yahoo when you approve the connection on Yahoo's own sign-in page, plus the team and player names it returns. No Yahoo password is asked for, given, or held. The token only grants read access to Yahoo Fantasy, and you can revoke it at any time from your Yahoo account settings, which cuts this site off immediately.
- Your ESPN connections, if you make any. For a public league, just the league and team numbers. For a private league, the two ESPN session cookies you paste in. Those are covered in detail below, because they deserve it.
ESPN private leagues
ESPN offers no way for an application to read a private league with your permission.
There is no OAuth flow and no read-only token, which is what Sleeper and Yahoo provide
and why those connections need nothing sensitive. The only route in is your own browser
session cookies, espn_s2 and SWID.
You should understand what those are before you hand them over. They are not scoped to fantasy football. They are the cookies that keep you signed in to ESPN generally, so while they are valid anyone holding them can act as your ESPN account. This is a real cost, and it is the reason this connection is optional, folded away by default, and never suggested to you.
If you choose to connect one anyway, here is exactly what happens to them:
- They are encrypted before being written to the database, with a key held in the server's environment and never stored in the database itself.
- They are used for one purpose: reading the roster of the league you connected. Nothing else on ESPN is read or written.
- They are never displayed back to you, never included in any page, and never written to logs or error reports.
- They are deleted when you disconnect that league, and when you delete your account, in the same transaction as the rest of your data.
- If the server has no encryption key configured, the connection is refused outright rather than stored unencrypted.
You can end it from ESPN's side too: signing out of ESPN everywhere invalidates the cookies, after which the connection simply stops working.
Cookies
Two cookies, both strictly functional. There are no advertising or analytics cookies, which is why this site shows you no cookie banner.
fn_visitor. A random identifier so a signed-out browser can have its own players and settings. It identifies a browser, not a person.fn_session. Set when you sign in, so you stay signed in. Deleting it, or signing out, ends the session.
Both are HttpOnly (unreadable by page scripts), SameSite=Lax (not sent from other sites) and, over HTTPS, Secure.
Server logs
The hosting provider records ordinary web server logs (IP address, requested page, timestamp, browser string), as every web server does. They are used to keep the site running and to investigate faults.
Who else is involved
- Railway hosts the app and its database, in the United States.
- Sleeper receives your Sleeper username when you connect an account, because that is the request that fetches your roster.
- Yahoo handles your sign-in directly if you connect a Yahoo account, and receives the token when your rosters are read.
- ESPN receives the league request, and for a private league the session cookies you supplied, because that is what the request needs to be allowed.
- The publications linked here see you as an ordinary visitor if you click through to them. What happens on their site is governed by their policy, not this one.
That is the complete list. No analytics provider, no ad network, no data broker, no email platform.
How long things are kept
Account data is kept until you delete it. Sessions expire after 180 days without use, and expired ones are removed. News items are part of the shared feed and are not personal to you.
Deleting everything
The delete control on your account page removes your account, watchlist, stars and flags, league settings, every league connection including any stored ESPN cookies or Yahoo token, and all sessions, in a single transaction. It is a real deletion, not a flag on a row that stays behind, and it cannot be undone.
Children
This site is not directed to children under 13 and accounts are not knowingly created for them.
Changes
If this policy changes materially, the effective date above changes.
Contact
Questions about any of this: forecastcard@gmail.com.