Privacy Policy

What we collect from everyone:

• Sleeper username — entered by you to connect your leagues. Kept in your browser’s localStorage.
• Usage data, only if you allow it — which features you use, tied to a random device ID. §6 lists exactly what is sent.

If you create a HootFF account, we also store:

• Email address — to sign you in and to send account emails, such as a password reset. If you sign in with Google, we also receive the name and profile picture on your Google account.
• Password — only if you sign up with an email address. Our sign-in provider stores it as a one-way hash; nobody at HootFF can read it.
• Profile — your Sleeper username and Sleeper user ID, the display name you choose, and your Manager DNA archetype if you save it.
• Game entries — your Hoot Challenge squads and your Season Predictions picks, if you play. Your display name appears on Hoot Challenge leaderboards.

What we do NOT collect:

• Your Sleeper password
• Date of birth, phone number, or postal address
• Payment or billing information
• Advertising IDs or cross-site tracking identifiers
• Your precise location

Where it is stored, and who processes it for us:

• Your browser — your Sleeper username, selected leagues, cached league data, and your choice about usage data. If you link your Sleeper account, also the Sleeper session that lets HootFF make the changes you confirm. That session is sent only to Sleeper, never to our servers.
• Vercel — hosts HootFF. Like any web host, it receives your IP address and browser details with each request and keeps them in short-lived request logs.
• Supabase — our sign-in and account database: your email, password hash, and profile.
• Upstash — Hoot Challenge squads, Season Predictions entries, short links to cards you share, the trade records in §5, and, for up to 20 minutes, a count of requests per IP address that protects HootFF from abuse.
• Sentry — error reports when something in HootFF breaks: the page, the error, and your browser and device type, with the addresses of the pages and requests just before it, which can include Sleeper user and league IDs. It also records how fast 10% of page loads are. It runs on every page whether or not you allow usage data, because we need it to keep HootFF working. We strip sign-in headers, cookies, and tokens from each report before it is sent.
• PostHog — usage data, only if you allow it (§6).
• Resend — delivers what you send through the in-app feedback form to our inbox, with the page, language, screen size and browser you sent it from.

Your Sleeper username is used to fetch your leagues, rosters, and stats from Sleeper’s public API so HootFF can display analytics for your account. That league data is loaded on demand in your browser and is not stored on our servers, apart from the trade records described in §5.

If you have an account, we use your account details to sign you in, to restore your Sleeper connection on any device you sign in on, and to run the games you enter.

HootFF uses your browser’s localStorage to remember your Sleeper username, selected leagues, your choice about usage data, and your Sleeper session if you link your account. What is in localStorage stays on your device. Logging out removes your Sleeper session, watchlists and recent players from this device. It keeps your Sleeper username and leagues, so you can keep using HootFF as a guest. If your session simply ends, for example because it expires, your Sleeper session is still removed, but your watchlists and recent players stay. Unlinking in Settings also removes the Sleeper session. To remove everything, clear your browser’s site data for HootFF.

If you allow usage data, PostHog also keeps a random device ID in localStorage. Turning usage data off in Settings deletes it.

We may set a first-party cookie, NEXT_LOCALE, that remembers the language you chose until you close your browser. If you sign in, we also set first-party cookies that keep you signed in. We do not use third-party cookies or tracking cookies of any kind.

HootFF connects to third-party APIs to power its features. When you use HootFF, your browser may make requests to:

HootFF has no affiliation with Sleeper or FantasyCalc, and has no control over how they handle requests made to their APIs.

To power trade comps, HootFF can store completed trades from Sleeper leagues registered with its trade pipeline. When you connect your Sleeper account, HootFF registers the leagues you are in, so their trades can appear as trade comps for other HootFF users, without league or roster IDs. These records are pseudonymous, not anonymous:

• We store only public Sleeper data — league IDs, roster IDs, player IDs, draft-pick details, and league format settings (number of teams, scoring type). We store no usernames or emails, but anyone can match a roster ID to its manager through Sleeper’s public data, so these records can identify the managers in a league.
• Trade data is used only inside HootFF, to show trade comps and market context. We do not sell it or use it for advertising.
• To have a league’s trade records deleted, and the league taken out of the pipeline, email privacy@hootff.com with the league ID. We delete them by hand.

When a league is first added, the pipeline also copies up to 2 prior seasons of its trades. Records have no expiry date: they are kept until they are deleted on request.

HootFF uses PostHog (EU-hosted, at eu.i.posthog.com) to learn which features help people. It is off until you allow it: on your first visit we ask, and PostHog is not loaded at all unless you tap Allow. No session recordings, no advertising tracking, no cookies.

You can change your choice at any time with Share usage data in Settings. Turning it off stops all usage data and deletes PostHog’s device ID from your browser.

What is sent, if you allow it:

• Which features and pages you open, and the main actions in them — for example that you saved a Hoot Challenge squad, or which Manager DNA archetype you got
• Whether you viewed guidance (trade verdicts, waiver picks, alerts)
• Whether you shared content from the app and whether it led to new visitors
• App entry (first visit vs. returning), browser language, and your locale setting
• The current NFL season phase and week
• When you connect a league: its format (dynasty, keeper or redraft, and whether it has a superflex slot) — not its name or ID. When you make a change in Sleeper from HootFF: the kind of change, where you made it, and that league’s ID
• How fast pages load, and errors saving data on your device
• Details PostHog adds to every event: the page address, the site you came from, the campaign tags (UTM) of the link you arrived from, your browser, operating system, device type, screen size and timezone. Like any web service, PostHog receives your IP address with each event. It uses it to estimate your country and city, then discards it: the IP address itself is not stored.

What is never sent:

• Your email address or display name
• League names, rosters, scores, or trade details

How events are linked to you:

Events are tied to a random device ID stored in your browser’s localStorage. If you sign in, that device ID is linked to your Supabase user ID (a random UUID — not your email), so your devices count as one person, and your Sleeper username is attached to your analytics profile so we can measure retention by user. When you finish onboarding, that event also carries your Sleeper user ID. Sleeper usernames and user IDs are public on Sleeper. This makes usage data pseudonymous, not anonymous. When you sign out, PostHog starts a new device ID, so later events are not linked to your account.

How long it is kept:

PostHog keeps events for at least 1 year on our current plan, and may keep them longer in archive storage. We do not delete them on a schedule of our own; deleting your account deletes them (see below).

Your rights:

Deleting your account in Settings asks PostHog to delete your analytics profile and all its events. PostHog completes deletions in the background; if our request fails, we are alerted and finish the deletion by hand. If you never signed in, your events are tied to the device ID and, if you connected Sleeper, to your public Sleeper user ID. Turning usage data off deletes the device ID from your browser; to have the events themselves deleted, email privacy@hootff.com.

We do not sell, rent, or share any information about you with third parties for advertising or marketing purposes. We do not use advertising networks or cross-site tracking.

Most HootFF features rely on your browser’s localStorage; that data stays on your device and can be removed at any time.

Your account data (§1) is kept until you delete your account. Deleting your account in Settings removes your sign-in details, your profile, and your Hoot Challenge and Season Predictions entries, and asks PostHog to delete your usage data (§6). You can also download a copy of your account data, your profile, Hoot Challenge squads and scores and Season Predictions, as a JSON file from Settings, under Privacy, in the "Your data" row.

When you share a card, its content (for example your display name and picks) is stored under a short link so the link keeps working. Links are not tied to your account, so deleting your account does not remove them. Email the link to privacy@hootff.com and we will delete it.

Trade records (§5) have no automatic expiry: they are kept until a league’s records are deleted on request (see §5).

Error reports are kept for the retention period of our Sentry plan.

HootFF is intended for users aged 18 and over. We do not knowingly collect any information from users under the age of 13. If you believe a child under 13 has provided information through HootFF, please contact us so we can investigate.

HootFF is served over HTTPS. We keep only the personal data listed in §1 on our servers, and passwords only as one-way hashes. Nevertheless, no method of transmission over the internet is 100% secure.

We may update this Privacy Policy as the Service evolves. The effective date at the top of this page reflects the most recent revision. Continued use of HootFF after changes are posted constitutes your acceptance of the revised policy.

To ask about your data or to use your rights — access, correction, deletion — email privacy@hootff.com. You can also complain to your data-protection authority.