Privacy policy

This policy explains how StatGrades Media LLC handles information on statgrades.com and in our mobile app. Writing to [email protected] reaches a person, not a form.

If you never make an account: nothing that identifies you. The site reads no cookie and stores no record of your visit beyond the temporary security logging described below. If you arrived through a tagged link or from another website, your own browser keeps a note of which one (see Cookies and browser storage); it stays in your browser unless you make an account.

If you make an account, we store:

• Your email address. Required. It's your login and how we send account email. Stored lower-cased.
• Your name. Optional, and only if you give it to us.
• A password hash. Never your actual password. We store a scrypt hash, which can't be reversed back into your password.
• Which page you signed up from. Just the section (home, odds, StatGrades AI Picks, fantasy), so we can tell what people come here for.
• What brought you here. If, in the 30 days before you signed up, you arrived through a tagged link (an ad, a newsletter, a post — the utm_ labels on the address) or by following a link from another website: that campaign's labels or that website's name, the page you landed on and when. Never the full address you came from. It tells us which promotions work, and it isn't passed to the ad platform or anyone else.
• Account activity. When you created the account, when you last signed in, whether you've confirmed your email, and whether alerts are on.
• Your sessions. One row per signed-in browser, holding a hash of the session token and the browser's user-agent string, so you can see and end sign-ins.

If you use fantasy or member features, we also store:

• Your connected leagues. For each league you import: which platform it's on (Sleeper, ESPN or Yahoo), the league id, its name and season, which team is yours and that team's name, and your user id on that platform where it gives us one (Sleeper and Yahoo; ESPN doesn't). We keep only the link — your roster, lineup and scoring settings are read fresh from the platform each time you load the page, never copied into our database.
• Your Yahoo connection. Only if you connect Yahoo. You sign in on Yahoo's own page and we never see your Yahoo password. Yahoo gives us a read-only access token, which lets us read your fantasy leagues and nothing else, and we store it encrypted, along with the refresh token that keeps the connection working and your Yahoo account id. Disconnecting Yahoo on My Team deletes both tokens; you can also revoke our access from your Yahoo account settings.
• Your ESPN sign-in. Only if you connect it, to import a league ESPN keeps private. ESPN offers other sites no way to ask permission, so this is the pair of cookies ESPN sets when you sign in at espn.com (espn_s2 and SWID), which you copy in or our Chrome extension sends from this site. We never see your ESPN password. We store both encrypted, use them only to read your fantasy leagues, and delete them when you press Disconnect on My Team, or when ESPN stops accepting them (signing out of espn.com ends them). The extension reads those two ESPN cookies only when you press its connect button on statgrades.com, and sends them nowhere but here.
• AI answers we generated. Roster advice and waiver claims, each with a fingerprint of what it was based on, so asking the same question twice doesn't cost us twice. We also count them against your monthly allowance.
• Which alerts we've already sent you. So you get told about an injury once rather than every hour.

For security, briefly: when you sign in, sign up or ask for AI advice, we record the event against your IP address or account id to enforce rate limits — this is what stops someone guessing passwords. These records are automatically deleted after 24 hours. We keep no general access log tied to you.

• No Google Analytics or any other analytics product.
• No advertising or social pixels, no conversion tracking, no fingerprinting.
• No cross-site or cross-app tracking, and no data brokers.
• No precise location, contacts, photos or device identifiers.
• No payment card numbers — our payment processor, Stripe, handles those and we never see them.

One cookie, named sg_session. It is set only when you sign in, holds a random token and nothing about you, is marked HttpOnly and Secure, and expires after 30 days or when you sign out. It is strictly necessary to keep you signed in, which is why there is no cookie banner to click.

When you arrive through a tagged link or from another website, the page saves a small note in your browser's own storage (not a cookie, and never sent to us with your visits): the campaign labels or the website's name, the page you landed on and the time. It is read only if you sign up, to fill in “What brought you here” above, and it is ignored after 30 days. Clearing your browser's site data removes it. Ad click ids that ad platforms add to links are only used to note that the click came from an ad — the id itself is never saved.

The installable app registers a service worker that caches the site's static files and an offline page so it opens without a connection. It never caches pages or API responses, so nothing of yours is stored on the device by it.

• To sign you in and keep you signed in.
• To show you your own leagues, rosters, advice and record.
• To send account email: confirming your address and resetting your password. Payment receipts come from Stripe.
• To send the alerts and emails you've turned on (the fantasy emails — waiver plan, trade ideas, start or sit — and the picks), each of which you can turn off at any time.
• To keep the site up and secure, and to enforce rate limits and our terms.
• To understand in aggregate which features get used, so we build the right things.

We do not use your information to build an advertising profile, and we do not make automated decisions about you that have legal or similarly significant effects.

We don't sell personal information and we don't share it for anyone else's advertising. A small number of service providers process data on our behalf, under contract, only to provide their service:

• Our own server. The database runs on hardware we control, not a third-party cloud database.
• Cloudflare. Sits in front of the site to serve it and absorb attacks, so it processes connection data including your IP address.
• Anthropic. Generates AI picks, roster advice and waiver claims. When we ask about your team, we send the football side of it: the players on your roster and on the waiver wire, your league's name and scoring, and this week's opponent's team name and lineup. We never send your email address, your name or your account details.
• Your fantasy platform. We read your leagues from the platform you choose, and send it only what it needs to find them: your username for Sleeper, the league id you enter for ESPN (plus your ESPN sign-in, if you connected it for a private league), and for Yahoo the access token you gave us when you connected. We send it nothing else about you.
• Our email provider. Receives your email address and the message in order to deliver it.
• Our payment processor. Stripe receives what it needs to take payment for a membership — your email address, card and billing details — and tells us only that you paid, which plan, and until when.

We may also disclose information if the law requires it, to protect our rights or someone's safety, or in connection with a sale of the business — in which case we'd tell account holders first.

• Your account and its data: until you ask us to delete it.
• Sessions: 30 days, or immediately when you sign out.
• Security and rate-limit records: 24 hours, deleted automatically.
• One-time links for confirming an address or resetting a password: short-lived, single-use, and only ever stored as a hash.
• Encrypted backups: kept on a rolling schedule, so deleted data can persist in a backup for a short period before ageing out.

• Turn off email. Every alert has an unsubscribe link that works without signing in, and you can switch alerts off on your account page.
• Disconnect a league. Remove it on My Team; we delete the link.
• Disconnect Yahoo. Disconnect on My Team; we delete the stored tokens.
• Get a copy, or a correction. Email [email protected] and we'll send you what we hold or fix what's wrong.
• Delete your account. Email [email protected] and we'll delete your account and everything attached to it. There is no self-service delete button yet; until there is, we do it by hand, promptly.

We won't charge you, degrade the service, or treat you differently for exercising any of these.

If you live in California, you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We don't sell or share personal information, so there is nothing to opt out of. The lists above are our notice at collection.

If you live in the EEA or the UK, our lawful bases are performing our contract with you (running your account), legitimate interests (keeping the site secure), and consent (optional email, which you can withdraw). You may also have the right to object, to restrict processing, to data portability, and to complain to your data protection authority. Our servers are in the United States, so using the site involves transferring your data there.

StatGrades is not for children. You must be 18 or older to hold an account, and betting content is intended for adults of legal gambling age. We don't knowingly collect information from anyone under 13, and if we learn we have, we delete it. If you believe a child has created an account, write to [email protected].

Passwords are stored as scrypt hashes. Session tokens and one-time email links are stored only as SHA-256 hashes, so a stolen copy of our database couldn't be used to sign in as anyone. The site is served over HTTPS only, personalised responses are marked never to be cached, and backups are taken nightly. No system is perfectly secure, but if a breach ever affects your information we will tell you and the relevant regulators as the law requires.

If we change what we collect or who we share it with, we'll update the date at the top and, for anything material, email account holders. We won't apply a materially different use to information we already hold without telling you first.

StatGrades Media LLC, a Wisconsin limited liability company — [email protected]. The agreement covering use of the site is in our Terms of Service.