Privacy

What Draft Copilot reads

• Your league's state: from Sleeper and public ESPN leagues through the host's own API, from private ESPN leagues with the session cookies you paste, and from Yahoo through the Draft Copilot browser extension. That is rosters, lineups, matchups, free agents, waiver order and transactions.
• Your email, so we can send the sign-in, confirmation and reset links, and the weekly digest and alerts you turned on.
• Your password, stored only as a salted hash we cannot reverse. If you sign in with Google or Facebook, we receive your email and name from them and no password.

What it never reads

• Your ESPN, Yahoo or Sleeper password. We never ask for it and the extension never sees it.
• Pages outside the draft rooms and league pages of ESPN, Yahoo and Sleeper, and other sites. The extension does not run anywhere else.

What it never does

• Submit a pick, lineup change, claim, drop or trade. Every action is a link you click in your own league.

What the browser extension reads and sends

• The extension reads ESPN, Yahoo and Sleeper draft rooms and league pages while you have them open. During a draft it passes the picks it sees to the Draft Copilot panel in your browser.
• It remembers up to eight leagues it recently saw, on your own computer, so Draft Copilot can offer to connect them. On Sleeper it reads your Sleeper user id from the page to know which seat is yours.
• When you open a Yahoo league page, the extension sends what the page shows (standings, rosters, free agents and league settings) to fantasydraftcopilot.com along with your Draft Copilot session, so Season Mode stays current. Nothing is sent from a page you do not open.

What we log

• Page views and product events, such as opening a draft or reaching a paywall, in our own database. Each is stored with the time, the page or action and, when you are signed in, your account. If you arrived through a referral link, the code is stored too. We use no third-party analytics or advertising trackers.
• Errors our servers hit, so we can fix them.

Cookies

• A session cookie keeps you signed in.
• A referral cookie remembers, for 30 days, whose link you came through, so the referral can be counted when you sign up.
• Short-lived cookies carry a draft's Sleeper username, a sign-in with Google or Facebook, or the ESPN details you are in the middle of entering.
• A separate cookie keeps the site's operator signed in to the admin pages.

Who else handles your data

• Stripe takes payment. We never see or store your card number.
• Resend sends our email.
• Neon hosts our database and Render hosts the site, so your account data lives on their servers.
• Google and Facebook, only if you choose to sign in with them.

Retention and deletion

Draft logs and league state stay until you delete the league or your account. For each league we keep only the newest dozen stored league states. Deleting your account removes it and everything attached to it, and backups clear within 30 days.

Private ESPN session cookies are stored encrypted and used only to read that league. They are deleted when you disconnect the league or delete your account.

Taking your data out

You do not have to ask. The account page has a download of everything we hold about you and a delete button beside it, and the delete removes the account, every connected league, every stored roster state, every saved host credential and the events we logged under your account.