Privacy Policy

RedZone Fantasy ("RedZone", "we", "us") runs the website at redzonefantasy.online, a free set of fantasy football research tools. This policy explains what we collect, why, who we share it with, and the choices you have. Questions go to support@redzonefantasy.online.

Account. Your email address. You sign in with a one-time code sent to that address, or with Google. We never see or store a password. If you use Google, we receive your email address and basic profile name from Google, nothing else.

Platform connections, only if you connect one:

• Yahoo: access and refresh tokens from Yahoo's own sign-in, which let us read your leagues on your behalf.
• ESPN: the espn_s2 and SWID cookies you paste in yourself for a private league, plus the league IDs you enter.
• Sleeper: your Sleeper username. Sleeper league data is public and needs no credential.

Things you save. Draft boards you create, with their settings and picks.

Technical data. Your IP address is used briefly to limit repeated requests (for example, sign-in attempts) and is kept for no more than 15 minutes for that purpose. Our hosting provider keeps standard server logs, which include IP addresses, browser type and the pages requested.

We do not collect payment information, precise location, contacts, or anything from your device beyond what a browser sends with every request.

• To sign you in and keep you signed in.
• To show your own leagues, rosters and trades inside the tools you use.
• To send sign-in codes. We do not send marketing email.
• To keep the service secure and working, including preventing abuse.

Every platform connection is read-only. Nothing on this site can make a roster move, submit a waiver claim, propose or accept a trade, or take any other action on Yahoo, ESPN or Sleeper.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles. We do not run advertising, analytics or tracking scripts. League and roster information from Yahoo is read live each time you use a tool and is not stored or used for anything else.

Only the service providers that run the site, each limited to its job:

• Vercel: hosts the site and keeps server logs.
• Prisma: hosts our database.
• Upstash: a short-lived cache and request counters.
• Resend: delivers sign-in code emails to your address.
• Google: only if you choose Sign in with Google.
• Yahoo, ESPN and Sleeper: we send them your stored credential or username to read your league, only when you use a tool that needs it.

Player values, projections and NFL statistics come from public sources (FantasyCalc, Sleeper, nflverse) and involve no information about you. We may also disclose information if the law requires it, to protect the rights and safety of our users or the service, or as part of a transfer of the service to a new owner, who would be bound by this policy.

One cookie keeps you signed in. During a Yahoo connection a short-lived cookie confirms the request came from you. Your browser's local storage remembers which league you last selected. None of these are used for tracking or advertising, and there are no third-party cookies. Because we don't track you, browser "Do Not Track" and Global Privacy Control signals need no further action from us.

The site is served only over HTTPS. Platform credentials (Yahoo tokens and ESPN cookies) are encrypted in our database with AES-256-GCM. Sign-in codes expire quickly and work once. No system is perfectly secure, but if we learn of a breach affecting your information we will notify you as the law requires.

We keep your account and saved draft boards until you delete them or ask us to delete your account. Disconnecting a platform in Settings, Platforms removes its stored credential right away. Used and expired sign-in codes are deleted. Server logs are kept by our hosting provider for a limited period under its own policy.

You can ask to see the personal information we hold about you, correct it, get a copy of it, or have your account and everything linked to it deleted. Email support@redzonefantasy.online from the address on your account and we will respond within 30 days. We won't treat you differently for making a request. Depending on where you live (for example, California, or the European Economic Area and United Kingdom), the law gives you these rights directly, including the right to complain to your local data protection authority. Where the GDPR applies, we process your information to provide the service you signed up for and, for security and abuse prevention, on the basis of our legitimate interest in keeping the service running.

RedZone and its service providers operate in the United States, so your information is processed and stored there. By using the site from outside the United States, you understand your information will be transferred there.

The site is not directed at children, and you must be at least 16 to use it. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

If we change this policy, we will update the date at the top of this page. For a significant change, we will also let you know by email or with a notice on the site before it takes effect.

Questions or requests about your information: support@redzonefantasy.online.