Privacy Policy

Your Sleeper username. Entering it is what makes the site useful. We use it to look up your public Sleeper profile, leagues, rosters, and transaction history through Sleeper's public API. This is stored in your browser's local storage, and — if you have an account — on your account record so it follows you between devices.

Your email address, if you create an account. Accounts use a “magic link” sent to your email; there are no passwords, so we never store one. We also store your notification preferences.

Billing status, if you subscribe. Payments are handled entirely by Stripe — card numbers never reach our servers. We store only the identifiers and status Stripe reports back (customer and subscription IDs, plan, current period end, whether it is set to cancel).

Anything you send us through the contact form, which reaches us by email.

We do not run advertising networks, analytics scripts, session recording, fingerprinting, or third-party trackers of any kind. There is no advertising on Gridiron LM. We do not build advertising profiles, and we do not sell or rent personal information to anyone.

We never receive your Sleeper password, and we never receive your card details.

We use one cookie: gridironlm_session. It is set only after you sign in, holds a signed token identifying your account, is HTTP-only, and expires after 30 days. It is strictly necessary to keep you signed in — there are no optional or advertising cookies, which is why you aren't asked to accept any.

Your synced Sleeper username and display preferences are kept in your browser's local storage so the site works on repeat visits. Clearing your browser data removes them.

We rely on a small number of service providers, each of which processes data only to provide their service to us:

• Vercel — hosting and serving the site.
• Neon — the Postgres database holding accounts and subscription status.
• Resend — delivering sign-in links and contact messages.
• Stripe — payment processing and billing management.

Separately, the site reads public data from Sleeper and nflverse. Those are sources we read from — we do not send your personal information to them. See Credits for details and licenses.

Account records are kept while your account exists. Sign-in links expire 15 minutes after they are sent and can be used once. Cached Sleeper and player data is transient and refreshed regularly.

We don't send marketing email. The only email we send is the sign-in link you request, plus a reply if you contact us. You can clear your synced Sleeper username at any time by signing out of the sync, and manage your account from your account page.

To request a copy of your data or have your account and its data deleted, message us through the contact form and we'll take care of it. Deleting your account removes your email, Sleeper link, and preferences; any active subscription should be cancelled first through your billing portal.

Gridiron LM is not directed to children under 13, and we do not knowingly collect their personal information.

If this policy changes materially we'll update the date at the top of this page. Questions about privacy can go through the contact form.