Privacy Policy

1. Information We Collect

We collect information that you provide directly to us when you create an account, link your fantasy sports leagues (such as Sleeper, ESPN, or Yahoo), or interact with our platform.

• Account Information: Name, email address, and authentication data.
• League Data: Data from your connected fantasy platforms, including rosters, match histories, and team names.
• Usage Data: Information about how you interact with our application.
• ESPN Private League Cookies: ESPN won't share a private league without proof you belong to it, so connecting one requires the two cookies ESPN sets in your browser (espn_s2 and SWID). You can enter them by hand or use our optional browser extension (see Section 6). We store them with that league — the espn_s2 session token encrypted — and use them only to read that league's data on your behalf. Deleting the league removes them.
• Connected Yahoo Accounts: If you connect Yahoo, you sign in on Yahoo's own page and grant us read-only access to your Yahoo Fantasy Sports data. We never see your Yahoo password. We store the access and refresh tokens Yahoo issues, encrypted, together with the account identifier Yahoo gives us, and use them only to read the leagues you import. See Section 6 for how that data is shared, retained, and revoked.

2. How We Use Your Information

We use the collected data to provide, maintain, and improve our services. Specifically, we use your league data to generate automated power rankings, expected win models, and AI-driven commissioner commentary.

3. Artificial Intelligence & Third-Party Services

Our platform leverages generative Artificial Intelligence (AI) to produce personalized league commentary and insights.

• AI Disclosures: By using Rivalry, you acknowledge that league data, team names, and any custom text, hot takes, or commentary you submit are transmitted to our AI providers (e.g., Anthropic, OpenAI) strictly to generate your weekly rankings.
• No Training on Your Data: We configure our API connections with AI providers to ensure your private league data and inputs are not used to train their foundational models.

4. Data Sharing & Third Parties

We do not sell your personal data. We only share information with third-party service providers (like hosting providers, analytics services, and AI APIs) to the extent necessary to operate our service.

5. Cookies, Advertising & Measurement

We advertise on Facebook and Instagram and use the Meta Pixel and Meta Conversions API to measure how well those ads work.

• What's collected: When you visit our site, the Meta Pixel may set cookies and send Meta information such as the pages you view, your browser and device, your IP address, and whether you signed up. When you create an account, we also send Meta a one-way hashed (SHA-256) copy of your email address so the sign-up can be matched to an ad you saw. We never send your password, league data, or anything you write.
• Campaign details: If you arrive from an ad or a tagged link, we store the campaign parameters in the link (for example utm_source or fbclid) with your account so we know which campaigns bring in sign-ups.
• Consent: If you visit from the European Union/EEA, the United Kingdom, or Switzerland, none of this happens unless you choose “Accept” in our cookie banner. Elsewhere it's on by default and you can opt out at any time.
• Your choices: Change your choice at any time with Cookie settings (also linked in the site footer). You can also block or clear cookies in your browser, and control how Meta uses this information for ads in your Facebook or Instagram ad preferences. Declining or blocking these cookies doesn't affect how Rivalry works.
• Functional cookies: If you follow a link with a promotion, we store the promo code in a cookie so it's applied when you activate your league. It contains only the code.

Meta processes this information under its own Privacy Policy.

6. Our Browser Extension

Connecting a private ESPN league needs the two cookies described in Section 1. You can copy them out of your browser by hand, or install our optional extension for Chrome and Edge, Rivalry League Connector, which reads them for you. The extension is entirely optional and Rivalry works exactly the same without it.

• What it can read: Only the espn_s2 and SWID cookies, and only on espn.com. It cannot read any other website, any other cookie, your ESPN password, or the contents of the pages you visit.
• When it reads them: Only when you press “Import from my browser” on a Rivalry page, or open the extension's own popup. It does nothing in the background, on a schedule, or while you browse.
• Where the values go: Straight into the Rivalry page you already have open, exactly as if you had typed them. The extension makes no network requests of its own and transmits nothing to us, to ESPN, or to anyone else. It stores nothing — the values live in the page you're using, and closing the extension's popup discards them.
• What happens next: Identical to pasting the cookies by hand. If you go on to connect the league, we store and use them as described in Section 1. Using the extension gives us no access we wouldn't otherwise have.
• Removing it: Uninstall it at any time from your browser's extensions page. Leagues you've already connected keep working, since we hold the cookies we need. To cut off our access to ESPN instead, change your ESPN password — which invalidates the cookies — or delete the league from Rivalry.
• No affiliation with ESPN: The extension reads cookies your own browser already holds. It is not endorsed by, affiliated with, or connected to ESPN.

7. Yahoo Fantasy Data

If you connect a Yahoo account, we read your Yahoo Fantasy Sports data through Yahoo's official API, under the read-only fspt-r permission you approve on Yahoo's own consent screen. This section sets out how that data is used, shared, retained, and revoked, in addition to the general practices described above.

• What we access: Your Yahoo Fantasy leagues, teams, rosters, matchups, and standings — read access only. We cannot change your Yahoo account or manage your fantasy teams, and we never see your Yahoo password.
• Your Yahoo account identifier: Yahoo gives us an identifier (a GUID) for your account. We store it only to recognise your connection and to notice if you later reconnect with a different Yahoo account. We never share it with any third party, and it is never included in anything we send to our AI providers.
• How it's shared: Beyond the infrastructure providers that host Rivalry (Section 4), the only third party that receives Yahoo-derived data is our AI provider, which generates your rankings from league data such as team names, records, scores, and the comments league members submit. It is used solely to produce your league's rankings and is not used to train AI models (Section 3). By connecting Yahoo you permit this processing; if you would rather it did not happen, do not connect a Yahoo account.
• How long we keep it: We keep a connected league's data for as long as that league remains connected to Rivalry, because each week's rankings are built by comparing against earlier weeks. Removing the league from Rivalry deletes its data. Disconnecting Yahoo deletes the stored access and refresh tokens immediately.
• Revoking access: You can disconnect Yahoo at any time in your Rivalry settings, or remove Rivalry from your Yahoo account's security settings. Either one stops all further access to your Yahoo data.
• No affiliation with Yahoo: Rivalry is an independent product and is not endorsed by, affiliated with, or sponsored by Yahoo.

8. How We Protect Your Data

• Traffic between your browser and Rivalry is encrypted in transit (HTTPS).
• The platform session tokens we hold on your behalf — your ESPN espn_s2 cookie and your Yahoo access and refresh tokens — are encrypted at rest.
• Your Rivalry password is stored only as a salted one-way hash. We cannot read it, and nobody at Rivalry can tell you what it is.
• Access to the systems holding your data is limited to what's needed to run the service.

No method of transmission or storage is completely secure, so we can't guarantee absolute security — but we treat the credentials you entrust to us as the sensitive data they are.

9. Data Retention & Deletion

You may request the deletion of your account and associated data at any time by contacting us at privacy@lakeannafantasylab.com (or via your account settings). Upon deletion, your data will be permanently removed from our active databases, though some residual data may remain in secure backups for a limited time.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date.