Cookie Policy
Last updated 1 November 2026
This page is pending attorney review.
This policy is written in plain language while our final legal copy is prepared. Everything described here is true of the product as it works today — nothing below claims a behaviour we do not have. What the final version adds is legal precision, not different facts. The date above changes when it lands.
This page lists every cookie, storage key and optional script Fantasy Wingman™ uses, what each is for and how long it lasts. An automated test checks the list against the code, so a cookie added without being listed here fails it. For what we do with personal data more generally, see the Privacy Policy.
Your choices
Until you choose, only the strictly necessary items below are used. Saved display preferences and analytics stay off unless you allow them, and Accept all and Reject non-essential are equal choices. We keep your choice for 180 days (about 6 months), then ask again. You can change it at any time:
If your browser sends Global Privacy Control, we treat it as a rejection of everything optional, do not show the banner, and keep both optional categories off for as long as the signal is on, whatever you chose before. If it sends Do Not Track, our own analytics send nothing. If you turn analytics off after it was on, the page reloads so that nothing keeps running.
Strictly necessary: needed to run the service
Keep you signed in, protect your account, remember your age confirmation and this choice, and let the installed app open without a connection. These are always on.
- Name
- fw_consent
- Type
- First-party cookie
- What it is for
- Remembers whether you accepted or rejected optional cookies, so we do not ask again and do not run what you rejected.
- How long
- 180 days (about 6 months)
- Sent to us
- Sent with requests to this site
- Name
- sb-<project>-auth-token (and numbered parts of it)
- Type
- First-party cookie
- What it is for
- Keeps you signed in. Set by our sign-in library when you verify your emailed code, and removed when you sign out. Scripts on the page cannot read it (HttpOnly).
- How long
- Up to 400 days, or until you sign out
- Sent to us
- Sent with requests to this site
- Name
- sb-access-token
- Type
- First-party cookie
- What it is for
- A short-lived copy of your sign-in token that our own pages read directly, so a page you open knows who you are straight away. Not readable by scripts on the page (HttpOnly).
- How long
- 1 hour, replaced when your session refreshes
- Sent to us
- Sent with requests to this site
- Name
- fw_age18
- Type
- First-party cookie
- What it is for
- Remembers for a short time that your account's age confirmation is on file, so we do not look it up on every request. Its value is your account id. Not readable by scripts on the page (HttpOnly).
- How long
- 1 hour
- Sent to us
- Sent with requests to this site
- Name
- fw_yahoo_oauth_state
- Type
- First-party cookie
- What it is for
- Set only while you connect a Yahoo league: a signed, single-use check that the return from Yahoo is the one you started. Not readable by scripts on the page (HttpOnly).
- How long
- 10 minutes
- Sent to us
- Sent with requests to this site
- Name
- fw-shell-v2 · fw-static-v2 · fw-scope-v2 · fw-pages-v2-<account scope>
- Type
- First-party cache storage
- What it is for
- Lets the installed app open without a connection: the app shell, static files, and a saved copy of two signed-in pages (Team and Briefing) for offline reading, kept separately for each account.
- How long
- Until the app updates it or your account changes
- Sent to us
- Stays on your device; never sent to us
Strictly necessary: saved because you used a feature
Written to your device only after you use the feature that needs it. None of these identifies you or is read by anyone but us, and you can remove each one in your browser's settings. We treat them as strictly necessary for that feature; that classification is part of the legal review this page is waiting on.
- Name
- fw-draft-queue:<draft>
- Type
- First-party local storage
- What it is for
- Your queue of players for a draft, saved on this device so a reload does not lose it. One entry per draft.
- How long
- Until you clear it or clear your browser data
- Sent to us
- Stays on your device; never sent to us
- Name
- fw-gm-shortcut-v1 · fw-agent-dock-positions-v1
- Type
- First-party local storage
- What it is for
- Whether you switched on the GM shortcut and where you placed it on each screen size.
- How long
- Until you clear it or clear your browser data
- Sent to us
- Stays on your device; never sent to us
- Name
- fw:huddle-seen
- Type
- First-party local storage
- What it is for
- Which short explainers you have already opened. Cosmetic: it only stops them being highlighted again.
- How long
- Until you clear it or clear your browser data
- Sent to us
- Stays on your device; never sent to us
- Name
- fw.install-nudge.dismissed.v1
- Type
- First-party local storage
- What it is for
- That you dismissed the prompt to install the app, so it is not shown to you again on this device.
- How long
- Until you clear it or clear your browser data
- Sent to us
- Stays on your device; never sent to us
- Name
- fw_dfs_scoring
- Type
- First-party cookie
- What it is for
- The scoring format you chose for the DFS board. Read only by that board, and only under /dfs. Not readable by scripts on the page (HttpOnly).
- How long
- 1 year
- Sent to us
- Sent with requests under /dfs
Preferences
Remember your display settings — theme, motion, haptics and density — on this device between visits. Off: your settings still work while the page is open, then reset. Off until you allow it.
- Name
- fw-prefs
- Type
- First-party cookie
- What it is for
- Your display settings — theme, motion, haptics and density — so our server can draw the right theme on the first response instead of flashing the wrong one. No identifier and nothing from your account.
- How long
- 1 year
- Sent to us
- Sent with requests to this site
- Name
- fw-prefs
- Type
- First-party local storage
- What it is for
- The same display settings, read before the page first paints so a dark-mode visitor never sees one white frame.
- How long
- Until you clear it or clear your browser data
- Sent to us
- Stays on your device; never sent to us
Analytics
Count which pages are used and how quickly they load, with Vercel Web Analytics and Speed Insights and with our own page-view and tool-use counts. Off: none of these load or run in your browser. Off until you allow it.
- Name
- fw.analytics.sid
- Type
- First-party session storage
- What it is for
- A random id for this browser tab, so one visit's page views and tool uses can be counted together. Not linked to your name or email.
- How long
- Until you close the tab
- Sent to us
- Sent with our own page-view and tool-use counts (below), not as a cookie
- Name
- /api/analytics
- Type
- First-party request
- What it is for
- Our own page-view and tool-use counts, sent to this site with the tab id above. The database refuses an email address, a league name or roster contents in them.
- How long
- Not stored on your device
- Sent to us
- Sent to this site only
- Name
- Vercel Web Analytics
- Type
- Third-party script
- What it is for
- Anonymous, aggregate page-view numbers, measured by Vercel, the company that runs this site. Loaded only if you allow Analytics, from this site's own address.
- How long
- Not stored on your device by us
- Sent to us
- Sent to Vercel, through this site's own address
- Name
- Vercel Speed Insights
- Type
- Third-party script
- What it is for
- Anonymous, aggregate page-load speed numbers, measured by Vercel. Loaded only if you allow Analytics, from this site's own address.
- How long
- Not stored on your device by us
- Sent to us
- Sent to Vercel, through this site's own address
Other things that run in your browser
- Error reports. When something breaks, a technical error report is sent to our error-monitoring service so we can fix it. In our configuration it records no sessions, sends no default personal data and writes no cookie or storage in your browser.
- The sign-in bot check. Pages with a sign-in or email form load a bot check from Cloudflare when it is switched on. It runs in your browser and may keep data there under Cloudflare’s own policy; we do not control it and cannot list what it stores.
- Payment. When you buy, you leave this site for Stripe’s hosted checkout page, which sets its own cookies under Stripe’s policy. We load no Stripe script on our own pages.
Questions
Write to support@aiintegratedsols.com.