Privacy policy
Last updated 1 September 2026.
The short version: this app collects the least it can get away with, shows it only to the people in your league, sells it to nobody, and deletes all of it when you delete your account.
What is collected, and why
Your email address
Needed to create an account, to confirm it is yours, and to let you reset a forgotten password. It is also how the app can tell you something urgent, like an injury to one of your players. It is never shown to anybody else — not even to the other members of your league, who see your team name and display name only.
If you sign in with Apple and choose Hide My Email, we receive a relay address and never see your real one. That works perfectly well for everything above.
Your username and display name
You choose both. They are visible to other members of any league you join. Use a name you are happy for them to see; there is no requirement to use a real one.
Your fantasy activity
Your teams, rosters, lineups, draft picks, trades and weekly scores. This is the app — without it there is nothing to show you. It is visible to the other members of the same league, which is the point of playing in one.
Your chat messages
Stored so the conversation is still there tomorrow, and visible to the other members of that league. Nobody outside the league can read them. If somebody reports a message, a copy of it is kept with the report so it can still be reviewed after it is deleted — see the terms.
Your favourite school
Used to pick the accent colour the app wears, and to show who is leading your league. Visible to your league.
A device token, only if you turn on notifications
If you allow push notifications, Apple or Google give the app an opaque token for that device so a notification can be delivered to it. It identifies a device, not you, and it is deleted when you turn notifications off or delete your account. Say no and nothing is stored.
Technical logs
The servers keep short-lived request logs, which include IP addresses, for security and debugging. A hashed — not reversible — form of your IP address is also used to count sign-in attempts, so somebody cannot sit there guessing passwords. The plain address is not stored in the app's own database at all.
What is NOT collected
This is the more useful list:
- No advertising. There are no ads and no ad identifiers.
- No tracking across other apps or websites. None. There is no pixel, no SDK doing it, nothing to opt out of.
- No analytics on your behaviour. No third-party analytics is installed.
- No location. The app never asks for it and would not know what to do with it.
- No contacts, photos, camera, microphone, or health data.
- No payment details, because nothing costs anything.
- Nothing is sold or shared with data brokers. Not now, and if that ever changed it would need a new version of this policy and your agreement to it.
Who can see what
- Other members of your league: your team name, display name, favourite school, roster, lineups, scores, trades and chat messages.
- Nobody else using the app: anything from a league you are not both in. This is enforced by database access rules, not only by what the screens choose to show.
- Your email address: nobody but you and whoever operates the app.
Who processes it on our behalf
These are the only third parties involved, and each does one job:
- Supabase — the database and sign-in system. Holds everything listed above. Their privacy policy.
- Vercel — hosts the app and serves the pages. Sees request logs. Their privacy policy.
- Apple and Google — only if you sign in with them, or allow push notifications.
- CollegeFootballData — where statistics and schedules come from. Data flows one way: nothing about you is ever sent to them.
Data is stored in the United States. If you are elsewhere, using the app means accepting that.
How long it is kept
- Your account and activity: until you delete it.
- Chat messages: until you or a commissioner deletes them, or you delete your account.
- Reports: kept after the reported account is gone, so a pattern of behaviour can still be seen.
- Notifications: removed a month after being read.
- Sign-in attempt counters: a day.
- Server logs: a few weeks, by our hosts' own retention.
Deleting everything
Your account → Delete my account. It removes your account, your profile, your teams, rosters, lineups, chat messages and notifications, immediately and permanently.
Two things deliberately survive. Your league's results and schedule stay, because they are the other managers' season too and one person leaving in week ten must not erase it. And a report filed about you stays, for the reason above. Neither continues to identify you by name.
Your rights
Depending on where you live you may have the right to a copy of your data, to have it corrected, or to have it deleted. Deletion is built into the app. For a copy or a correction, email privacy@secfantasy.app and we will reply within 30 days. We will not charge you and will not make the app worse for you for having asked.
California residents: we do not sell personal information and do not share it for cross-context behavioural advertising, so there is no opt-out to offer. The rights above are available to you.
Children
The app is not for children under 13 and we do not knowingly collect their information. If you believe a child under 13 has an account, email us and it will be removed.
Security
Passwords are stored only as bcrypt hashes — we could not tell you your password if we wanted to. Access to data is enforced by row-level rules in the database, so a bug in a screen cannot expose another league's information. Traffic is encrypted in transit. No system is perfect, and if there is a breach affecting you we will tell you.
Changes
If this policy changes materially, the app will say so before the change applies to you. The date at the top always reflects the current version.