Effective 5 October 2026. FAABFAX is operated by an individual, not a company. Contact: faabfax@gmail.com
*Changed since the 12 September 2026 version: you can now choose to get a weekly email. If you do, we store your email address and record which links in it you click. It is optional and off unless you ask for it. See "Your email address, if you give it".*
This is a beta. It is small, it is run by one person, and this policy describes what actually happens rather than what a lawyer would like to reserve the right to do.
A random token. When you first add a league we generate a random identifier (a UUID) and put it in your dashboard URL. That token is the whole account. We store it, and it is stored in your browser's localStorage so you can find your way back.
Your Sleeper username, if you typed one. If you looked up your leagues by username rather than by league ID, we keep that username so the dashboard can show you the right leagues.
Your email address, if you give it. Only if you sign up for the weekly email. We use it for one thing: sending you that email, plus a one-time confirmation first. We store the address, which account it belongs to, where on the site you signed up, and when you confirmed. We do not use it for anything else, add it to any other list, or share it, except with the company that delivers the email (see "Who we share it with").
The email contains a link to your dashboard. That link is your account, so anyone you forward the email to can see your leagues. Links in the email go through faabfax.com first, so we can record which links you click and when. We use this only to see whether the email is useful. We do not use tracking pixels and we do not track whether you opened it.
Unsubscribe from the link in any email, or from your dashboard. When you do, we delete the address and keep only a one-way scrambled copy (a hash) so we never email it again unless you sign up again.
Which leagues you added. League ID, league name, platform, and when it was last synced.
Job records. Each time we build or rebuild a league, we record that it happened, what step it reached, and any error text, so the status page can tell you what went wrong.
Private-league entries. If you enter a private ESPN league, we record your token and that league ID so the unlock flow has something to attach to, and so we can see how many people need it. We do not collect, request, or store ESPN cookies or credentials of any kind.
Your IP address, briefly. We count requests per IP address to stop one person from overwhelming the service. Those counters live in memory only, are discarded as they age out, and are never written to our database. Our hosting provider keeps its own server logs, which typically include IP addresses, under its own policies and retention periods.
We do not use cookies. We do not run third-party analytics, tracking pixels, advertising scripts, or session recording.
Read this part. It is the part most services bury.
When you add a league, we download that league's history and store it. A fantasy league is a group activity, so that history is about ten to fourteen people, not just you. For each of them we store:
Our server reads only what Sleeper or ESPN already serves publicly to anyone who asks, with no login and no credentials of ours.
A private ESPN league is different, and you have to start it. ESPN serves a private league only to a signed-in member, so we give you a bookmarklet that runs in your browser, reads the league using the session you already have, and posts the resulting league data to us. What reaches our server is league history and nothing else: no password, no session cookie, no access to your ESPN account. Nothing happens unless you click it.
That said, "publicly available" is not the same as "everyone in your league expected this." The people in your league did not agree to this policy and most likely do not know this tool exists. If that matters to you, tell them. If you or another member of a league has questions or a request about data we hold, write to faabfax@gmail.com.
The public Sleeper API and the public ESPN fantasy API, which our server reads anonymously. For a private ESPN league, the data instead comes from the bookmarklet you run in your own browser, as described above.
We hold no credentials for either platform, and our server never signs in as you.
Two things, and nothing else.
To build your league's analysis and show it to you. That is the main purpose and always has been.
To check whether our own advice was any good. When the FA Board suggests a bid, we record what it suggested. Later we compare that against what your league actually bid, so we can tell whether the recommendation was close or wrong. Without it we would be guessing about our own accuracy.
What that record contains: the league, the week, which player, and the numbers we put on the screen. No name, no user ID, no team name, nothing anyone typed. The code refuses to write a row carrying any of those and fails loudly if one is ever handed to it. The record is attached to the league, not to a person, though we can of course tell which account added that league.
We do not profile you for advertising, and we do not sell or rent your data.
Your league's history is what prices your league. Aggregate patterns from many leagues calibrate the model underneath it.
Those are two different things and the difference is the product, so here it is plainly.
*What prices YOUR board is YOUR league.* When we tell you what a player will cost, the number is built from your league's own bidding history: what your leaguemates have paid before, who actually competes for which positions, and how much budget each of them has left. On a league with a few seasons of history, most of the numbers you see come from that league alone, and every one of them is labelled with where it came from.
*What the shared model learns from everyone is shape, not prices.* Underneath your numbers there is a model that knows general things, like how much steeper the top of a bidding war runs than the middle. That is fitted across many leagues. As of September 2026 it is fitted on three sources: the operator's own leagues, a set of public Sleeper leagues collected from Sleeper's public API, and leagues connected to this service. That last source is new, and it includes leagues that were already connected before the change.
It is fitted on aggregates only. No names, no team names, no account, and never one league's individual bids. Your league is one of several hundred inputs to a handful of numbers, and none of those numbers can be traced back to it.
We changed this in September 2026 because it makes the tool more accurate. Public Sleeper leagues are a decent sample, but they are last season's and there is no way to tell how seriously any of them were played. Leagues connected here are current and active.
The public collection itself stays free of connected leagues, and we still check that directly and automatically (tools/check_corpus_overlap.py) every time it changes. The two sources stay separate so we can always tell which answer came from which.
Nobody, with four exceptions:
This is a design decision and you should understand it before you share anything.
Your dashboard URL contains your token, and the token is the credential. There is no password on top of it. If you post that link, forward it, or paste it somewhere public, whoever reads it can see every league on your account. They cannot delete your data, and re-syncing is throttled, but they can see it.
If you never gave us an email address, there is no account recovery: lose the link and clear your browser storage, and the account is gone. If you signed up for the weekly email, every email carries your dashboard link.
There are two different things stored, kept for different lengths of time.
The raw Sleeper/ESPN API responses captured while your league is ingested or re-synced are kept on the server for up to 30 days (currently the production setting), then deleted automatically. They exist only to make re-syncing fast and reliable, not as a permanent copy, so once they age out they're gone.
What actually powers your dashboard is a separate, derived database (rosters, draft picks, waiver claims, FAAB bids, the analysis built from them, and the bid recommendations described above). We keep that data indefinitely while the beta runs, because deleting it would break the dashboard you're using. There is no automatic deletion schedule for it yet, and saying otherwise would be inventing a process that does not exist.
Unconfirmed sign-ups are deleted after 7 days. Confirmed addresses are kept until you unsubscribe or ask us to delete your account. Records of which links you clicked in the weekly email are deleted after 180 days; we keep only each week's totals, which name no one.
If you want your account and its leagues removed, send your token to faabfax@gmail.com and we will action it manually. Sending the token is what lets us identify the account; it is the only identifier we have.
The honest limits: the token travels in a URL, which means it can end up in browser history, in a shared screenshot, or in the logs of any site you navigate to from a dashboard page. We set Referrer-Policy: no-referrer specifically to stop that last one. This is a beta run by one person and has not been penetration tested by a third party.
If a security incident occurs, we will post a notice on the site, and we will email the people who gave us an address.
This service is not directed at children under 13 and we do not knowingly collect their data.
The service is operated from the United States and data is stored there. If you use it from elsewhere, your data is processed in the US.
Depending on where you live, local law may give you rights over your personal data that go beyond what this policy describes. If you believe that applies to you, write to faabfax@gmail.com.
If this policy changes materially, the effective date at the top changes, a notice goes on the site, and weekly-email subscribers are told in the next email.
If you connect "Sign in with Yahoo", FAABFAX requests read-only access to your Yahoo Fantasy account. We cannot make changes to your Yahoo leagues, teams, or rosters, and we never see your Yahoo password. Sign-in uses OAuth only.