Privacy Policy

What you give us at signup: your email address, a display name, and a password (stored only as a hash, we never see the password itself).

What you import: when you run the import bookmarklet, we receive your fantasy league's structure and contents, league name and settings, team names, rosters, draft picks, transactions, and schedule. This includes the team names of the other managers in your league, because they are part of the league you are importing. It does not include their real names, their email addresses, or their platform usernames, we do not receive those and there is nowhere in our database to put them.

What you create in the product: ranking profiles, player overrides, notes, saved preferences, and similar settings.

How you use the tools: we record which tools you open and the settings you land on, for example, that a rankings board was configured to punt free-throws in a 12-team league. This is tied to your account (or to a random first-party browser id before you have one), it never includes anything you type, and it exists so we can see which tools earn their keep and make them better. It is deleted with your account.

Technical data: ordinary server logs from our hosting provider, including IP address, browser user agent, and the pages requested. These are used to keep the service running and secure.

If you never sign in: most of the site is open without an account, and browsing it does not create one. Opening a page sets no cookie of ours. Changing a setting on the rankings board does set one, signed in or not: it notes that you have saved settings, so the board opens with them, and holds nothing else. Our host still writes the server logs above. Two Vercel tools also run on every visit, and neither uses a cookie or sends what is on the page: Speed Insights measures how fast each page loaded for you, and Web Analytics counts page views (§5 lists what it receives). Beyond that we record the same tool-usage events described above with no account attached to them: a random id kept in your browser's own storage rather than in a cookie, the page you were on, and the settings you landed on. Those rows go to our own database, not to a vendor. If you arrived on a link carrying campaign tags, we keep those once, so we can tell which page brought you in. And if you sign up later in the same browser, we join that earlier activity to your new account, which is the only thing that random id exists to do. How long we keep any of it is in §7.

What we do not collect: we never receive or store your CBS, ESPN, or Yahoo credentials. The import runs in your own browser, in your own already-signed-in session. We also do not collect payment information, because AlgoBall is free.

• To run your account and keep you signed in.
• To produce the rankings, projections, and recommendations that are the product, priced against your league's own scoring settings.
• To send you service messages you can't opt out of while you have an account, email confirmation, password resets, and notices about material changes to these policies.
• To send you optional email you asked for, such as a daily brief, if and only if you opted in. Every such email carries a one-click unsubscribe, and unsubscribing from it never affects the service messages above.
• To understand which tools get used and how they are configured, so we improve the parts of the product that people actually rely on.
• To debug, secure, and improve the service.

We may look at aggregate, de-identified patterns across leagues: to test whether a model change actually improves accuracy, and to build product features and market signals that describe NBA players rather than people. Examples of the second kind: how often a player was drafted and at what pick, how many leagues added or dropped him this week, how often he was started. Synthetic test leagues are excluded from anything user-facing, and this analysis is never used to profile you individually or shared as anything but aggregates. What we can do with those aggregates is limited by §4.

• We do not sell your personal information.
• We do not share it with advertisers or data brokers.
• We do not run third-party advertising or cross-site tracking pixels.
• We do not email you marketing you did not ask for.
• We do not sell, license, or publish anything keyed to you, to your league, or to another manager in it, including your rosters, your transactions, your settings, and your league's name. The only thing we share outside AlgoBall is described in §4, and it is keyed to NBA players.
• We do not include information about other managers in your league in anything we publish or license, in any form. See §10.

Running the product produces a picture of the fantasy basketball market that no single league can see: which players get drafted where, which get added and dropped, which get started. We build that picture, we show it in the product, and we may publish it or license it to others. This section is the limit on what that can ever be.

Everything in it is keyed to an NBA player, never to a person. "Drafted at an average pick of 18.4 across 38 leagues" is a fact about a basketball player. It is not about you, it does not identify you, and it cannot be turned back into your roster. That is the only kind of data that leaves AlgoBall.

Specifically, and as a commitment rather than a description:

• Aggregates are player-keyed. We do not build, publish, or license a dataset keyed to a user, an account, a league, a team, or a manager.
• Aggregates are de-identified and pooled across leagues. We do not publish a figure so thin that it describes one league. Small counts are shown as counts with the number of leagues stated, not as percentages or averages.
• Aggregates never include other managers' information. Nothing about the other people in your league, including their team names, enters anything we publish or license, for any purpose. They did not sign up for AlgoBall, and we do not treat their data as ours to use.
• We do not re-identify aggregate data, do not attempt to, and require by contract that anyone we license it to does not either.

Because this data is not about you, it is not personal information, and building it is not selling your data. The promises in §3 stay exactly as they read. If we ever wanted to do something outside these limits, that would be a different policy, and §12 says how it would have to happen.

We use a small number of service providers, each of which processes data only to provide their service to us:

• Supabase: database, authentication, and file storage. Holds your account and your league data.
• Vercel: application hosting. Handles requests and produces server logs. Two of its tools also run on every visit, signed in or not, with no cookies and no page content. Speed Insights measures page-load timing. Web Analytics counts page views: for each one it receives the page address, the site that linked you there, your approximate location (down to the city, worked out from your connection), and your device type, operating system, and browser. To tell one visitor from another, it uses a code built from the request itself instead of a cookie, and discards it after 24 hours. We see totals, not a list of visitors.
• Resend: email delivery. Receives your email address and the contents of emails we send through it.
• BallDontLie: the source of NBA statistics, schedule, and player data. It supplies data to us; we do not send it anything about you.

If we add another provider that receives personal data, this list will be updated before it starts receiving anything.

We may also disclose data if legally required to, or where necessary to investigate a security incident or a violation of our Terms.

We use cookies that are strictly necessary to operate the site, and no others. There are no advertising or analytics cookies, which is why you have not been shown a consent banner.

• Session cookies: keep you signed in. Set by our authentication provider; removing them signs you out.
• Preference cookies: remember choices that change what you see first. Once you are signed in, they hold which league and season you are looking at, and the ids of your recent imports, so a finished import switches you to its league only once. The rankings board sets one more, signed in or not, the first time you change a setting there, so it opens with your saved settings instead of the defaults.

Your light/dark theme is not a cookie. It stays in your browser's own storage and is never sent to us.

Account and league data is kept while your account is open. Server logs are kept for a short operational window and then rotate out. When you delete your account, we delete your profile, your imported leagues, and the settings attached to them.

Usage events are the honest gap here. The ones tied to an account are deleted with it, which the database enforces rather than a cleanup job. The ones from a browser that never signed in belong to no account, so a deletion has nothing to match them to, and we have not set a retention period for them yet. Our intention is an eighteen-month window, and until the job that enforces it exists we would rather say so than print a number we are not keeping to.

Two exceptions: we retain what we are legally required to retain, and we retain an unsubscribe record after you opt out of email, keeping a suppression record is what stops us from emailing you again by mistake.

One thing deletion does not reach: the player-keyed aggregates in §4. Once your league's draft has been pooled into "drafted at an average pick of 18.4 across 38 leagues," there is no longer a part of that number that is yours to remove, and removing it would mean rebuilding a market statistic every time one person leaves. Your own data is deleted; the anonymous arithmetic it contributed to is not. Nothing in that arithmetic identifies you.

• Access and correction: your profile and league data are visible in the product, and you can edit or re-import them.
• Deletion: you can request deletion of your account and its data at any time.
• Email: optional email is opt-in, and every message carries a one-click unsubscribe.

How to ask for deletion. Email privacy@algoball.com from the address you signed up with and tell us to delete your account. You do not have to give a reason. We will confirm once it is done, and what goes is your profile, your imported leagues, the settings and ranking profiles attached to them, and the usage events tied to your account, subject to the exceptions in §7.

Depending on where you live, you may have additional rights, for example, to a portable copy of your data, or to object to certain processing. Write to us and we will honor them; we do not require you to prove a jurisdiction to be treated decently.

California's privacy law (the CCPA, as amended by the CPRA) defines "selling" and "sharing" personal information broadly. Money does not have to change hands, and disclosing personal information for cross-context behavioral advertising counts.

We do not sell or share your personal information as those terms are defined, and we have not in the preceding twelve months. That is why you will not find a "Do Not Sell or Share My Personal Information" link on this site: there is nothing for it to switch off. The player-keyed aggregates described in §4 are de-identified aggregate information, which that law treats as outside the definition of personal information.

If that ever changes, the link, an opt-out that works without an account, honoring Global Privacy Control signals from your browser, and notice at the point of collection all arrive before the practice does, not after. California residents also have rights to know, delete, and correct, and not to be discriminated against for exercising them; §8 is how to use them, and we do not ask you to prove residency first.

Importing a league necessarily brings in information about the other managers in it, their team names, as those platforms show them, and nothing else. We do not receive or store their real names, their email addresses, their platform usernames, or any other way of identifying who they are; a team in our database is a name, a roster, and a number the platform uses. We use this only to render your league accurately.

These people never signed up for AlgoBall, so we hold their information to a stricter rule than yours: it is never published, never licensed, and never included in any aggregate, whatever else §4 permits. It exists to draw your league and for nothing else.

If another manager in your league wants that information removed, they can contact us and we will remove it, which may leave parts of your league view incomplete.

AlgoBall is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, contact us and we will delete it.

If we change this policy in a way that materially affects how we handle your data, we will notify you by email or in the product before the change takes effect.

A change to this policy applies going forward, not backward. Data we already hold was collected under the policy that was posted at the time, and for the purposes that policy described. If we ever wanted to use data we already have for a purpose the old policy did not permit, in particular anything outside the player-keyed limits in §4, a new policy alone would not be enough. We would either exclude everything collected beforehand, or ask you to opt in to the new purpose. Rewriting this page does not reach back and re-authorize the past.

Privacy questions and deletion requests: privacy@algoball.com.