Privacy Policy for Draft Decoder

What we collect, and why

If you create an account

• Sign-in details. If you sign in with Google we receive your name, email address and profile picture. If you sign in by email we store that address and send a one-time link to it. This is how we know which leagues and purchases are yours.
• Profile settings you choose. Your team name and favorite NFL team, if you set them.

If you connect a fantasy platform

• Yahoo: an OAuth access token and refresh token, so we can read your leagues without asking you to sign in again.
• ESPN: your SWID and espn_s2 session cookies. ESPN offers no OAuth, so these cookies are the only way to read a private league. They are stored on our servers until you disconnect — see "How long we keep it" below.
• Sleeper: your Sleeper username and user id. Sleeper leagues are public to read, so no password or token is involved.
• League and draft data from whichever platform you connect: league settings, team and manager names, rosters, and past and present draft picks. Manager tendencies — the core of what Draft Decoder does — are calculated from your league's own draft history.

If you buy something

• We never see your card. Payments run through Stripe's own hosted checkout; card numbers never reach our servers.
• We store the Stripe customer and subscription identifiers Stripe gives us, your plan, and which drafts a credit has unlocked, so we know what you have paid for.

If you use the site at all

• Aggregate traffic data through Vercel Analytics: pages viewed, and which site referred you. It does not use cookies to follow you across other websites.
• Where a visit came from, when you arrive from one of our ad campaigns, so we can tell which advertising is worth paying for.
• Draft preferences kept in your own browser — your player queue, column choices and sort order. These live in your browser's local storage, not on our servers, and clearing your browser data removes them.

If you contact us

• The name, email address and message you send through our contact form. It is emailed to our support inbox so we can reply. The form does not save your message to our database.

If you install the Chrome extension

• Your ESPN session cookies (SWID and espn_s2), read when you use the Sync button or connect ESPN, so the app can read your ESPN league. These are the only cookies the extension reads — it does not read Sleeper or Yahoo cookies, which the app reaches through their own sign-in instead.
• Draft room activity: which players have been drafted, who is on the clock, and when you make a pick. The extension reads the draft board and nothing else on the page.
• The extension talks only to Draft Decoder. It sends nothing to advertisers or analytics providers.

Where it is kept

Account details, platform tokens, purchases and league data are stored in our database, hosted by Supabase. The site runs on Vercel. Payments are handled by Stripe, and our email is sent through Resend. Each of these providers processes data on our behalf in order to run the service.

The extension itself stores nothing on your device. It holds no browser storage of any kind and keeps no copy of your drafts — it reads the page you are on and passes what it finds to Draft Decoder in the moment.

How long we keep it

• Platform tokens and ESPN cookies are kept until you disconnect that platform. Disconnecting from your Settings page deletes the stored credentials for it. This is a correction to our previous policy, which said session cookies were not retained between drafts. They were, and are — that is what lets a connected league still be there when you come back.
• Account details, purchases and league data are kept while your account exists.
• The extension stores nothing on your device, so there is nothing for uninstalling it to clear. Removing your stored ESPN cookies is done from Settings, on your account.

Deleting your data

You can disconnect any fantasy platform yourself from the Settings page, which removes the credentials we hold for it. To delete your whole account and everything attached to it, ask us through the contact form and we will do it. We will also tell you what we hold about you if you ask.

Who we share it with

We do not sell your data, and we do not share it with advertisers. It goes to the providers named above only so they can perform their part of running the service, and to the fantasy platform you asked us to connect to. We may disclose data if the law requires it.

Children

Draft Decoder is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us data, contact us and we will remove it.

Changes to this policy

We may update this policy. We will change the "Last updated" date above, and note anything significant on the site. If a change affects the extension, we will also update its Chrome Web Store listing.