Privacy

Last updated October 3, 2026. This page describes what cfbfantasy.net stores when you visit or use the product.

Accounts

Sign-in is handled by Supabase Auth. We store your account email and user id there. League membership in our database uses your user id, not a copy of your email, except on pending invite rows (so we can send the invite).

League data

Rosters, drafts, waivers, trades, and settings live in our application database so the product can run. Draft chat (“banter”) is kept in memory for the room and is not written to disk.

Marketing analytics

The marketing page and sign-in card send first-party events (page view, button click, signup). Those rows store an anonymous session id, optional campaign tags (UTM), the referring site’s origin only (scheme and host — no path or query), and your browser’s User-Agent. We do not store your IP address on those events.

Creating or joining a league records a separate activation event with your user id so we can see whether sign-up led to a league. Anonymous session traffic is never attached to your account on the server.

Product emails

We send service messages about a league or account you are in (invites, draft reminders, report cards, the weekly recap of your official result, manager grade, and league awards, and a Saturday reminder to set your lineup when that league has it on and the lineup still needs a fix). Commissioner roasts are separate and only go out when that league turns them on. These are not a newsletter. Auth mail (confirm, password reset) is not optional.

Opening a weekly recap records that you viewed it, from the email or from Matchups. That view stores your user id, the league, and the week. The send also stores your user id on that delivery, so a later roster change does not move the record. A lineup save in the following days stores your user id, the league, and the time of the save. Waiver, add, drop, and trade actions are counted from the timestamps those flows already store. None of these rows store your email. Operators see counts only. View and lineup rows are deleted with your account and after 400 days. Deleting your account also clears your id from the delivery.

To stop product SMTP, email invites@cfbfantasy.net from the same address with subject Stop emails. Leaving a league or deleting the account also ends league mail. How we handle data after that is below.

Your rights

Email invites@cfbfantasy.net from the same address as your account. We use that match to confirm it is you. We reply within 30 days.

• Subject Stop emails to block further product SMTP to that address.
• Subject Export my data for a copy of your product data.
• Subject Delete my account to close the account.

What we erase: your Auth account, league membership, pending invites, mock drafts you created, and ops/lifecycle rows keyed to your user id.

To prevent a deleted signed-in session from recreating those records, we retain a deletion marker containing only your account user id and deletion time. It contains no email or profile data and is retained for the lifetime of the service for this purpose.

What we keep: your league team seat, roster, picks, and matchup history, with your name and email removed, so the rest of the league can finish the season. If you are the only person in a league that has not opened a draft, or that draft has already finished, we delete that league with your account. If you are the only person in a waiting-room or live draft, we keep the league until you confirm it is empty or a test.

Backups may retain deleted rows until that copy is rotated.