Privacy Policy

1. Information we collect

Information you provide

Beta records include your name or tester label, an account identifier, device limits, access status, expiration dates, administrative notes, and activity timestamps. We receive the invite/access code you enter to verify access; the database stores protected lookup and verification values rather than a readable copy of the code. Device records include a device identifier, a protected authorization-token value, a device label, approval status, and request, approval, expiration, and last-used times.

You may provide a Sleeper username, manually entered Yahoo league and team details, scoring rules, weekly starting lineups, matchup projections, and screenshots for import. Issue reports contain your message, reporter identity, status, timestamps, and app context such as the Sleeper username, league name or identifier, week, and checkpoint. An optional report image is also collected.

The beta registration form does not ask for an email address and the beta-user table has no dedicated email field. An email address can still be included in a note, report, or communication you provide. For administrator sign-in, the hosting authentication system supplies an account identifier and email address to the server, which checks authorization against its configured administrator record.

Fantasy information

We retrieve or receive league and team names, fantasy user identifiers and display names, avatars where supplied by a fantasy platform, rosters, starters, bench and reserve information where available, matchups, scoring settings, standings, player identities and statistics, scores, and projections. This can include information about other teams and managers in leagues you select or screenshots you submit.

Device, request, and activity information

The server receives request metadata, including a user-agent string and an IP address when supplied by the hosting network. The app uses the user agent to create a general device/browser label. Access-code rate limiting uses a protected, IP-derived identifier and attempt counts. We retain device last-used times, access and administration events, selected league registration timestamps, and operational diagnostics such as response status, request identifiers, and timing. Infrastructure providers may also process request metadata in their own logs. This policy does not promise a particular retention period for those provider logs.

2. Fantasy platforms and other sources

Entering a Sleeper username lets the app request the public information available through Sleeper's API. We do not request your Sleeper password. Sleeper supplies league, roster, matchup, player, statistics, and projection data. ESPN supplies football schedules, game status, scores, and play-by-play information used to reconstruct checkpoints.

Yahoo support primarily uses manual imports. If you use the implemented Yahoo authorization connection, Yahoo handles its sign-in and consent process and returns read-only authorization credentials and account/league information to Fantasy Checkpoint. We do not collect your Yahoo password. The connection may not be available or successfully return league data for every account. Manual screenshot imports do not require this connection.

Some data and avatar requests are made directly from your browser. The relevant provider receives the request, its identifiers, and ordinary network metadata. These services control their own privacy practices.

3. How we use information

• Display leagues, lineups, standings, scores, and projections using the applicable scoring settings.
• Reconstruct historical checkpoints and provide Replay Matchup, Lead History, Sunday Pulse, and Rooting Interest.
• Generate and retrieve Sunday Night Check-In and Final Matchup Stories.
• Read Yahoo screenshots and save the league rules and weekly lineup information you review and submit.
• Verify beta access and device authorization, administer the beta, enforce rate limits, and prevent misuse.
• Handle issue reports, diagnose failures, and improve reliability and performance.
• Remember preferences and where you left off.

The app registers selected Sleeper accounts and leagues on the server. This is operational tracking, rather than an advertising profile or a log of every click.

4. AI features and screenshot processing

Matchup Stories

When a new story is requested, Fantasy Checkpoint sends a structured narrative prompt to Cloudflare Workers AI using a Meta Llama model. The prompt includes fantasy team names, relevant player names and positions, selected checkpoint scores and scoring contributions, lead changes, remaining opportunities, and available league context such as records, ranks, and matchup stakes. It does not intentionally include your beta access code, authorization cookies, email address, or the original Yahoo screenshots. Team names or other fantasy labels may themselves contain personal information.

Generated stories and factual fallback stories are saved in Cloudflare D1 with an owner identifier, a matchup-derived key, a hash of the input, timestamps, model information, and diagnostic status. Saved stories can be reused without another inference request. The app does not persist the full submitted story prompt as a separate prompt record. AI output can be inaccurate; a factual fallback may be displayed when generation is unavailable or validation fails.

Yahoo screenshot extraction

Images you submit for scoring-settings or matchup extraction are sent to Cloudflare Workers AI using a Meta Llama vision model, along with instructions describing what to extract. The whole submitted image is processed, so anything visible in it may be disclosed to the provider. Crop out unrelated messages, account information, and anything you do not want processed.

Fantasy Checkpoint handles these image bytes for the extraction request but does not write the import image files to D1 or R2 or create a permanent screenshot archive. Extracted scoring rules, league/team names, player names, teams, positions, and matchup projections are returned for review. The information you save is persisted as structured league and matchup records. This distinction does not guarantee immediate deletion from infrastructure or provider systems.

Cloudflare's handling of inference content is described in its Workers AI data usage documentation and privacy policy. Fantasy Checkpoint uses these models for inference, not to train its own model.

5. Sharing, sale, and advertising

We use service providers to operate Fantasy Checkpoint. Cloudflare processes hosting requests, database records, stored images, and AI inference content. OpenAI's Sites hosting and authentication services support publication and administrator sign-in. Sleeper, Yahoo where used, and ESPN receive the requests needed for their integrations and data sources. Authorized administrators can review beta records and issue reports, including report screenshots, to manage access and support users.

Fantasy Checkpoint does not sell personal information. It does not share personal information for cross-context behavioral advertising or targeted advertising. The current app code includes no advertising pixels, advertising network integrations, or third-party behavioral analytics scripts. Ordinary hosting, authentication, API, and AI processing are different from selling information. External providers' own websites and services may have different practices.

6. Storage and retention

Server storage

Cloudflare D1 stores beta accounts and devices, access/administration events and rate-limit records, tracked Sleeper accounts and leagues, matchup snapshots submitted through the snapshot API, weekly frozen projection snapshots, saved stories and generation diagnostics/budget records, schedule caches, manual Yahoo imports, and Yahoo connection/state records where used. Some administrator-provided manual Yahoo setup is also held in server-side configuration.

Cloudflare R2 stores optional issue-report images. The report message, context, status, and image reference are stored in D1. Successfully saved report images remain available for administrator review; resolving a report does not automatically delete its image. The image-serving route requires administrator authorization.

Retention and deletion

There is no fixed automatic deletion schedule for beta records, access events, selected Sleeper records, saved matchup snapshots, imported Yahoo records, stories, or successfully saved issue-report images. These records may remain until removed. Information is retained as reasonably necessary to operate and secure Fantasy Checkpoint, maintain functionality, resolve issues or disputes, and meet applicable legal obligations. A request for deletion is handled subject to applicable law and any necessary retention.

Beta device authorization normally expires after 90 days; expiration or revocation removes access, not the stored device history. Yahoo OAuth state is valid for 10 minutes and is removed after a successful exchange; an unused expired state is not automatically erased by that validity check. Expired rate-limit rows are cleaned up when rate-limit checks run. These are validity and cleanup rules, not a general data-deletion schedule.

Removing an imported Yahoo league deletes its imported league and weekly matchup records from the app's database. It does not automatically erase cached stories or other records derived from that league. The implemented Yahoo disconnect action removes that connection's stored authorization record and session cookie. Removing a Sleeper username from the interface clears the current connection preferences but does not delete server records or every saved browser preference. Provider logs and recovery systems may have separate retention practices.

7. Cookies and browser storage

The beta device cookie is a Secure, HttpOnly, same-site authorization cookie, normally valid for 90 days. Its token lets the server look up a device record and independently check current access. Where Yahoo authorization is used, a separate Secure, HttpOnly session cookie associates the browser with the server-side connection, with a configured maximum age of one year. Yahoo access and refresh tokens are encrypted before database storage. Hosting/sign-in services may use their own cookies.

Local storage remembers the Sleeper username, selected leagues and league order, selected week/checkpoint and matchup, reading position and expanded sections, watched-game choices, Rooting Interest priorities, score-change preferences, and tour/introduction completion. These are browser-local values, not cookies, and they do not grant administrator access. The current app does not use session storage for these features.

The service worker caches a small set of branding assets, not authenticated API data or replay navigation. Other fantasy data may be held temporarily in browser memory while the app is open. Browser settings let you clear site data or block storage, though doing so can remove preferences or require a new device authorization request.

8. Security

Technical measures include server-side beta and administrator authorization checks, protected invite-code and device-token verification values, Secure/HttpOnly cookies, encrypted Yahoo connection tokens, same-origin checks for sensitive actions, rate limits, and restricted access to report images. We use measures designed to protect information handled by Fantasy Checkpoint. However, no internet service or storage system can guarantee absolute security. Do not include passwords, access codes, or unnecessary sensitive information in reports, team names, or screenshots.

9. Your choices and privacy rights

You can review and edit your imported Yahoo league rules and weekly matchups, remove an imported league, change the connected Sleeper username, and clear browser site data. The app currently has no single self-service control that deletes your complete beta account and all associated server records.

Depending on where you live and applicable law, you may have rights to request access, correction, deletion, a copy of your information, or information about disclosures; to object to or restrict certain processing; or to appeal a decision or complain to the appropriate authority. This can include applicable U.S. state privacy rights. Availability and exceptions depend on the law and your circumstances; this policy does not assert that Fantasy Checkpoint meets the thresholds for every privacy law.

Use the contact method below for privacy questions or requests. Include enough information to locate the relevant beta account or league, but do not send your access code or password. We may need to verify your identity before disclosing or changing records. Signed-in beta users can also send a privacy request through More → Report an issue; it is delivered to the administrator and stored as an issue report.

10. Children's privacy

Fantasy Checkpoint is not intended for children under 13. The beta does not ask for a date of birth or use an age-verification system. If you believe a child under 13 has provided personal information, contact us so that we can review it and address removal as required by applicable law.

11. International users

Fantasy Checkpoint can be accessed internationally. Its hosting, storage, authentication, AI, and data providers may process information in countries other than your own. Applicable law and the providers' arrangements govern that processing. This policy does not claim a particular data-residency location or privacy certification.

12. Third-party services

Information handled directly by third-party services is subject to their own policies. You can read the policies for Sleeper, Yahoo, ESPN / Disney, Cloudflare, and OpenAI. Links and integrations do not make Fantasy Checkpoint responsible for those services' independent practices.

13. Changes to this policy

We may update this policy as Fantasy Checkpoint evolves. The date above identifies the latest revision. Material changes will be communicated as required by applicable law. The current policy remains available at this page.

14. Contact us

For questions about this policy or requests concerning your information, email admin@fantasycheckpoint.com. Signed-in beta users may also use More → Report an issue.