Privacy and your data

What your account stores

Supabase handles email sign-in. GridLore stores your saved leagues, default view, team preference, delivery preference, membership and roster-claim status, and the League Office records you create or vote on. Sign-in cookies keep this browser session active.

To show what changed since your last visit, GridLore stores the last time you stayed on a saved Sleeper league home for at least ten visible seconds. That marker is removed when you remove the bookmark or delete your account, and is included in your data download.

If you arrive through a campaign link, GridLore keeps a bounded first-touch source, medium, campaign and referrer hostname after sign-in. It does not keep the full referring URL, IP address or browser fingerprint for this product attribution. Opening an edition while signed in records the account, league, edition, first and latest open time, and an aggregate open count. There is no email tracking pixel or read receipt.

Saving a league is only a bookmark. A team preference proves no ownership. Team ownership requires a Sleeper team-name check or commissioner approval; Office membership can also come from a commissioner invitation. Commissioner access requires a league-name check or delegation by an existing commissioner. These decisions are recorded in an audit log.

Where league information comes from

GridLore reads public Sleeper league data, including team and manager names, scores and league activity. League pages require a signed-in account that saved the league. Removing your bookmark does not remove public data from Sleeper or change the league.

Optional ESPN connection

To read a private ESPN league, you may provide its SWID and espn_s2 session cookies. These are sensitive account credentials, not limited-access OAuth tokens. GridLore validates them with a read-only league request, encrypts them with a server-held key before saving in Supabase, and decrypts them server-side to refresh your ESPN league view. They are never included in your account export. You can disconnect the league from Account to remove the active stored copy; provider backups may retain older snapshots under their retention policy. ESPN may expire or revoke them; this is an unofficial integration and does not verify team ownership.

Services involved

Supabase provides account and database services. Resend delivers sign-in codes, optional weekly editions, and one-time account setup or beta feedback messages. There is no recurring product-update email list. Vercel hosts the application. These services process the information needed for their roles and may retain operational logs under their own policies.

Weekly editions are generated from completed league results. When optional AI league briefs are enabled, only clicking Generate league brief sends your question and a bounded league snapshot to OpenAI. Loading a page does not request AI generation. Do not include sensitive information in your question.

AI allowance reservations store the requesting account, league and usage metadata in Supabase. Your question and the generated response are saved to your private Desk library so you can reread the conversation. Only your account can read them, and they are included in your data download. OpenAI may retain request data under its own API policies.

Download your saved data

While signed in, you can download your bookmarks, preferences, memberships, roster claims and assignments, delivery settings and history, acquisition source, edition-open events, authored League Office records, votes, provider-account metadata, legacy drafts, and your own audit events as JSON. Authentication credentials, provider tokens, other members' private records, and system-only health logs are excluded.

Download my personal data →

Removal and questions

You can remove bookmarks from your account library. You can delete your account from your account page. It removes your saved leagues, roster claims, provider links, notifications, Desk conversations and preferences. The league's shared record stays: workspaces, editions, the constitution, proposals, the ledger and dues history do not belong to one member. Deletion is blocked while you are the only commissioner of a league, so transfer that role first. Your sign-in record itself is kept, because league history refers to it; to have that removed too, contact nathanwolf100@gmail.com from your account email.

No fixed retention period or deletion completion time is promised here. This beta is not presented as a compliance certification.