Privacy Policy

Last Updated: July 18, 2026

Offseason ("we", "us", or "our") is an independent app that connects to your fantasy football league, keeps its records, and runs year-round events and side bets for your group. This Privacy Policy explains what we collect, how the Yahoo connection works, who we share data with, and the controls you have, when you use this website or the Offseason app (together, the "Service"). We keep our data practices as small and boring as we can.

What We Collect

We only collect what we genuinely need to run the Service.

Category	What it is	Why we have it
Account info	Email address, a hashed password, your chosen username, and a profile emoji	To create and authenticate your account and let your commissioner find you.
Yahoo link	If you connect Yahoo: your Yahoo account ID (GUID), Yahoo nickname, your Yahoo avatar image URL, and OAuth access and refresh tokens (stored encrypted)	To read your fantasy leagues from Yahoo on your behalf and keep them in sync. See "Linking Your Yahoo Account" below.
Imported league data	Your leagues' rosters, standings, records, drafts, keepers, transactions, and the Yahoo display names of every member, across the seasons Yahoo has	To build your league's record book and power the trade, what-if, keeper, draft, and season tools. See "Imported League Data" below.
Play data	Your calls, side bets, event picks, standings, chat messages, and any trade or what-if reads you run	To score your entries, show your league, and let your group compare and argue.
League membership	Which leagues you are in and your role (member or commissioner)	To grant you access to the right leagues, chats, and standings.
Device and log info	App version, language preference, and standard web-server logs (IP address, request time, error codes)	To keep you signed in, debug crashes, and protect the Service from abuse. Server logs rotate on a short schedule.

We do not collect: your real legal name (unless it happens to be your Yahoo nickname, which you control on Yahoo), phone numbers, dates of birth, contact lists, precise location, microphone access, or advertising identifiers.

Linking Your Yahoo Account

Connecting a Yahoo Fantasy league is optional, but it is the core of the product. When you connect Yahoo:

• Read-only access. We request the minimum Yahoo scope, openid fspt-r, which is read-only fantasy access. We cannot change your Yahoo lineups, make trades, or post in Yahoo on your behalf. We only read.
• What we store from Yahoo. Your Yahoo account ID (GUID), your Yahoo nickname, your Yahoo avatar image URL, and the OAuth access and refresh tokens Yahoo issues so we can keep syncing without asking you to sign in every time.
• Tokens are encrypted at rest. The access and refresh tokens are encrypted with a key that is held in the server environment, not in the database, so a copy of the database alone cannot use them. We use them only to read your leagues from Yahoo.
• Yahoo is a separate company. Offseason is independent and not affiliated with, endorsed by, or sponsored by Yahoo. Your Yahoo account itself is governed by Yahoo's own terms and privacy policy.
• You can unlink any time. Unlinking your Yahoo account, from your profile, revokes and deletes the stored tokens. Deleting your Offseason account does the same.

Imported League Data

This is the part people miss, so we want to be plain about it. When you connect a league, Yahoo returns the whole league, not just you. That means Offseason imports and stores the Yahoo display names, team names, records, drafts, and transactions of every member of that league, for every season Yahoo has, including people who do not have an Offseason account and never signed up for anything.

We do this because it is what makes the record book work: the rivalries, the all-time head-to-heads, and the draft grades all need the full league history. But it means someone else's action (a leaguemate connecting the league) can bring your Yahoo-visible data into Offseason.

If you are in an imported league and want your name and records removed, email privacy@offseason.org with the league and the name to remove. We will pseudonymize your entries so your name no longer appears, while leaving the rest of the league's history intact. Commissioners can also keep private notes about managers in their own league; those are deleted when you are pseudonymized or when the league is deleted.

When a league loses its last Offseason member, or a site administrator deletes a league, its imported data is purged.

Analytics

We run our own first-party analytics so we can understand how the Service is used and make it better. We do not use Google Analytics, Mixpanel, Segment, Meta Pixel, or any other third-party tracker, and we do not share usage data with anyone for advertising or profiling.

Our analytics are aggregate-only. We count events (for example, "pageview of /home") in hourly buckets. For each event we store the event name from a fixed allowlist, an optional short label (like a page path), an approximate country and region from our CDN's edge header (never your IP), a two-letter language code from your browser, and the platform (web, iOS, Android). We do not store IP addresses, user IDs, device fingerprints, user agents, or advertising IDs in analytics. Counts are updated in place, so one row represents many people at once, and the rows are never de-anonymized, sold, or shared.

If your browser sends a Do-Not-Track signal, our web tracker skips itself and records nothing on that page load. In the app, analytics is disabled when the operating system reports that tracking is turned off.

How We Use It

• Run the Service: sync your Yahoo leagues, build the record book, score your calls and picks, run the trade, what-if, keeper, mock draft, almanac, and gazette tools, and let your league chat and compare.
• Account security: sign you in, recover your password, and detect suspicious access.
• Communication: send operational emails only (email verification, password resets, a password-changed alert). We do not send marketing emails, so there is nothing to opt out of.
• Improve the app: look at aggregate, anonymized usage (see Analytics) to fix bugs and improve features. We do not profile individuals, and we do not combine analytics with your account.

Sharing and Vendors

We do not sell your personal data. Ever. To anyone.

We share data only in these limited ways:

• Within your league: your username, profile emoji, calls, side bets, picks, points, and rank are visible to other members of leagues you join. Imported Yahoo names and records are visible to that league's members. That is the point of playing in a league.
• Service providers: a small set of vendors, each receiving only the minimum needed:
  • Yahoo, the source of the fantasy data you choose to connect.
  • SendGrid, which sends our transactional email; it sees your email address and the message.
  • Player-data providers we read from to power projections, market values, and average draft position: Sleeper, Fantasy Calculator (FantasyCalc), and Fantasy Football Calculator. We read public data from these sources; we do not send them your personal data. Values and average draft position shown in the app are provided by these sources and credited to them.
  • Our hosting provider, which runs the server behind offseason.org.
  None of these vendors are permitted to use your data for their own purposes.
• Public share links: content you choose to share by link is visible to anyone who has the link. See the next section.
• Legal compliance: if we receive a valid legal request we are required to honor, we may disclose the specific data it covers. We resist overbroad requests where we can.
• Business changes: if Offseason is ever acquired or merged, your data may transfer as part of the deal, and the new owner inherits this policy.

Public Share Links

Some features let you create a public link to a piece of content: an almanac chapter, a what-if replay, a trade read, or a commissioner docket or rule-lab result, plus shareable call receipts. These links:

• Are unauthenticated: anyone who has the link can view the shared content without signing in, including the member names it references.
• Show only the specific projection stored when you shared, not your whole account or league.
• Use long, random tokens that are not guessable.
• Persist until you revoke them. They do not expire on their own. You can revoke a link from the share screen where you created it, and a commissioner can revoke every share link in their league at once from the commissioner tools. Deleting your account removes the links you created.

Security

• Encryption in transit: all traffic uses HTTPS (TLS 1.2+), with HSTS so your browser refuses to downgrade.
• Password hashing: we never store plaintext passwords. We use bcrypt, a modern, salted, deliberately slow hash, so a database leak would not expose your password.
• Token hashing and encryption: session tokens, email verification links, and password reset links are stored as SHA-256 hashes, not raw values. Yahoo OAuth tokens, which have to be replayable, are stored encrypted with a key kept in the server environment rather than the database.
• Database placement: the database lives outside the public web directory, so it cannot be fetched over the web, with server rules as a second layer of defense.
• Access control: only a small number of authorized people can reach production data, and only when needed for support or security.
• Disclosure: we welcome responsible security disclosure at security@offseason.org.

No system is bulletproof. If we discover an incident that affects your data, we will notify you and the appropriate authorities promptly.

Your Rights

You control your data. At any time you can:

• Access and export: download a portable JSON copy of your account data from inside the app, or email us and we will send it within 30 days. The export includes your account, links, picks, calls, side bets, chat messages, and Yahoo link metadata; it never includes secrets like passwords or OAuth tokens.
• Correct: change your profile emoji and theme in the app. For your username or email, email us and we will update it. Passwords change through the password-reset flow.
• Delete: permanently delete your account from your profile settings. This removes your account and the rows attributable to you across the Service, deletes and revokes your stored Yahoo tokens, and pseudonymizes your own imported Yahoo identity. See Data Retention for the narrow exceptions.
• Revoke shares: revoke any public link you created, from the screen where you shared it.
• Third-party removal: if your Yahoo data was imported because a leaguemate connected your league, email privacy@offseason.org and we will remove your name from that league's imported data.

To exercise any of these rights, email privacy@offseason.org. No forms, no ticket queue.

Data Retention

We keep your data while your account is active. When you delete your account we permanently delete the data attributable to you within 30 days, with two narrow exceptions:

• Aggregate, anonymized stats (for example, "so many trades evaluated"), which contain no personal data.
• Minimal accountability and legal records we are required to keep (for example, an administrative action log), retained only for the required period.

Imported league data is purged when a league loses its last Offseason member or a site administrator deletes it. Public share links persist until revoked. Expired sessions are pruned on a schedule.

Children

Offseason is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, email privacy@offseason.org and we will delete it.

Changes to This Policy

We may update this policy from time to time. If we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the Service after a change takes effect means you accept the updated policy.

Contact Us

Questions about this policy, our data practices, or your rights? Get in touch: