Privacy Policy

To sync your leagues, you provide:

• Sleeper — your public username.
• ESPN — the flow depends on the client. On iOS, you sign in to ESPN inside an in-app web view and the app captures your team page URL plus the SWID and ESPN_S2 cookies ESPN sets. On the web, you paste your ESPN team page URL; private leagues also require you to paste SWID and ESPN_S2 from your signed-in browser cookies. Neither client asks for or receives your ESPN password.
• Fleaflicker — your account email (used as a public lookup; Fleaflicker does not require a password for league reads).
• MyFantasyLeague — your league ID and team name (we match you to your franchise by name).
• Yahoo(planned; not yet available) — when Yahoo support launches, you will approve read-only access in Yahoo's secure OAuth window. We never see your Yahoo password.
• Account email + password — for your League Ledger account itself, managed by Supabase Auth and stored encrypted at rest.

On iOS, ESPN credentials stay on your device in iOS Keychain. They are encrypted at rest, scoped to the iOS app, and automatically erased when you sign out of League Ledger.

On the web, private-league credentials are pasted into the Add League form. They remain in that form while the page is open and are sent to our Supabase Edge Function with the import request. The function uses SWID and ESPN_S2 strictly as an ESPN Cookie: header for that read. The ESPN_S2 session secret is discarded after the request and is not stored in our database, so the web flow asks you to paste a fresh value when ESPN expires it.

For transparency, the non-secret SWID identifier is stored with your ESPN league record so resyncs can recognize which ESPN account owns the league. It is not usable to sign in on its own, and it is deleted with your leagues when you remove them or delete your account.

When an iOS sync runs, the app forwards its Keychain credentials to the same Edge Function. Credentials are used only to read your league from the source platform and are dropped from function memory after the read.

Yahoo OAuth tokens are handled differently. Yahoo access and refresh tokens are AES-256-GCM encrypted in a server-only database table, cryptographically bound to your League Ledger user ID, and decrypted only inside our Edge Function for read-only sync and token refresh. The Yahoo client secret and encryption key are stored as deployment secrets and never enter the web or iOS app. Client accounts have no database access to the token table.

Sign out from iOS Settings to wipe credentials held in iOS Keychain. The web app does not retain pasted ESPN_S2 values for future imports. Use Disconnect Yahoo in Settings to delete the encrypted Yahoo token envelope. Deleting your League Ledger account also deletes it automatically.

Only the synced results:

• Your leagues, weekly rosters, team names, scores, and matchup history.
• Cross-league derived data — player weights, rooting board calculations.
• Your account email + Supabase auth row.
• For Yahoo only, the encrypted OAuth token envelope described above.
• Application error and crash reports, linked to your account ID so we can investigate problems you report. They contain the error message, app version, and device model identifier (like "iPhone17,1") — never your credentials or league financial details — are used only for debugging, and are deleted with your account.
• If you turn on Live Game Pings in Settings: an APNs device token + a stable per-install device ID, used only to send you a single notification when one of your leagues enters a live game window. The token is deactivated when you turn the toggle off or sign out, deleted when you delete your account, and automatically purged server-side if the device hasn't checked in for 180 days.

All user data is scoped by your user ID through Supabase Row-Level Security policies. You cannot read anyone else's data; nobody else can read yours.

We do not sell, share, or rent your data. We do not run third-party analytics SDKs that fingerprint you. The platforms we sync from (Sleeper, ESPN, Yahoo, Fleaflicker, MFL) see the requests our edge function makes on your behalf — those go through their own privacy practices.

Hosting: Supabase (database + auth) and Vercel (web companion). Crash reporting: Sentry, when configured. Apple TestFlight + App Store handle iOS distribution and the standard Apple privacy disclosures apply there.

League Ledger is not directed at children under 13. We do not knowingly collect data from anyone under 13.

You can:

• Delete any league from the app (soft delete; row is marked inactive).
• Sign out on iOS — wipes credentials held in iOS Keychain. The web does not retain a pasted ESPN_S2 for future imports.
• Disconnect Yahoo — permanently deletes the encrypted Yahoo OAuth token envelope from League Ledger.
• Delete your account entirely from inside the app: Settings → Delete Account → confirm. This immediately and permanently removes every row keyed to your account (leagues, rosters, matchups, push tokens, error logs, profile, auth row) and signs you out. No email exchange or wait period — it happens in the tap.
• Export your data first if you want a copy: Settings → Export My Data returns a JSON file with every league, roster, and matchup row we hold for you.
• If anything blocks an in-app deletion, email support@leagueledger.co and we'll handle it manually within 7 days.

If we make material changes, the new policy will be posted here and dated above. Continued use of the app constitutes acceptance.

support@leagueledger.co