Privacy Policy

What we collect

Your email address, because it is how you sign in — there is no password. Your league and roster data from the platform(s) you connect, because that is what the product analyses. Basic product analytics — which pages were viewed and which features were used. If you use GM chat, the questions you type and the GM’s answers, kept only long enough to investigate a reported problem (see “How long we keep it” below). The date and time you confirmed each applicable age floor — a timestamp only, never your date of birth (see “Who can use it” below).

We do not collect your card details. Payments go through Stripe and card numbers never reach our servers.

Who can use it

You must be at least 18 years old to create an account. If you tell us you live in Illinois or Massachusetts, the minimum is 21. We ask for your date of birth and your state before you can sign in, and an account is refused if you are below the minimum for the state you select.

That is the rule for holding an account at all. One product surface carries a stricter, activity-specific floor on top of it: 18+ for fantasy; 21+ for DFS where required.

When you confirm either floor, we record the date and time you confirmed it on your account — never your date of birth. The account-level confirmation is recorded once, when you complete setup; the DFS-specific confirmation is recorded separately, the first time you reach that section and confirm it there. Your date of birth itself is checked in your browser and is not sent to us or stored by us. Each confirmation is your own self-attestation, not an identity check or an independently verified age, kept so we can show the question was actually asked and answered.

What our analytics deliberately cannot contain

Our first-party analytics go to our own database, not an advertising network. They record that something happened, never who you are inside the event: the table physically rejects email addresses, league names and roster contents. That is a constraint in the database, not a policy we remember to follow.

Separately, Vercel — the company that runs this application — also measures anonymous, aggregate page-view and load-performance numbers through its own Web Analytics and Speed Insights products, mounted on every page. Neither carries your email, account id, or anything else that identifies you individually; they answer “which pages, how fast,” the same question our own analytics answer, for a different owner.

The companies that process data for us, by name

Each one has one job, receives only what that job requires, and none of them may use your data for their own purposes.

• Vercel — runs the application itself (every page you load and every request you make passes through it), and separately collects the anonymous page-view/performance metrics described above.
• Supabase — our database, hosted on AWS in the United States (us-east-1). Your account, entitlements, league and roster data live here, isolated per owner by row-level security.
• Stripe — processes payments. We hand Stripe your billing details at checkout; Stripe never hands us your card number.
• Mailgun — delivers the one-time sign-in code to your email address. It sees the email and the code, nothing else.
• Anthropic — generates the morning briefing and the GM chat responses the product shows you. Your prompts and the league context needed to answer them are sent there to produce a response; Anthropic does not receive your email address, payment details, or account identity.
• Cloudflare — runs a bot check (Turnstile) when you sign in, to keep automated abuse off the sign-in form.
• Sentry — receives error reports when something breaks, so we can fix it. Error reports are technical (what failed, and where) rather than about what you were doing at the time.
• Better Stack — checks that the product is up by periodically requesting our own public pages from the outside, the reverse direction from everything else on this list. It does not receive anything you send us.
• OpenAI — does two things. When you use voice, your browser sends audio directly to OpenAI over an encrypted connection our own servers never see, with the same league and roster context described above included so the GM does not have to ask you for it again. Separately, when your written morning briefing is narrated as audio, we send that briefing’s text to OpenAI’s speech service and get the resulting audio back. When you start a voice conversation we also send OpenAI a one-way hashed account reference (never your email or name) so its abuse rules can apply to one account rather than to us as a whole. Neither use sends OpenAI your email address or payment details.
• Upstash — a caching layer that holds a short-lived copy of league and matchup data, and an internal account reference (never your email or name), so busy pages load fast. Entries expire automatically, typically within minutes.

Anything you type or say to the GM is sent to the model provider to produce the answer, so please don’t include personal details you don’t want shared. What the providers do not receive is your email address or payment details; the only account reference either receives is the hashed one described above for voice.

If you turn on push notifications, the alert is delivered through your own browser’s push service — Google, Mozilla, or Apple, depending on which browser you use, the same mechanism every website’s push notifications use. The message is encrypted before it leaves our servers, so that service can deliver it without being able to read it.

We do not sell your data, and we do not share it for advertising — with anyone, ever.

The fantasy platforms you connect

Today there are four: Sleeper (you connect by your public Sleeper username; there is no credential — we read what your league settings make public), ESPN (a public league is connected by its league id and needs no credential; a private league is connected by pasting two of your own ESPN account cookies, SWID and espn_s2, which we store encrypted, along with the time they were last used to read your league and a short log of when they were connected, used (at most once a day), refused by ESPN or removed), Yahoo (you sign in through Yahoo’s own screen; we never see your Yahoo password, only the access grant Yahoo hands us afterward, which we store encrypted), and MyFantasyLeague (you connect by league id, through MyFantasyLeague’s own keyless export — reading a league needs no credential either). Connecting any of these authorizes it to hand us your league and roster data; that connection runs the other direction from the vendor list above, and none of the four is itself one of our sub-processors in the usual sense — each is the source you point us at, not a company we hire. We read what your league settings make visible; we do not post, message, or change anything in your league on your behalf.

MyFantasyLeague roster-move support is being built and is not available yet. Every connection above is read-only today, including MyFantasyLeague. If you turn on MyFantasyLeague moves once they are available, you will type your MyFantasyLeague username and password one time. We use them in a single request to MyFantasyLeague to obtain its own sign-in cookie, and the password is then discarded — never stored, logged, or written anywhere. What we keep is that cookie, stored encrypted. We stop using it after 14 days whether or not you use it again, but it stays stored, encrypted, until you revoke it in Settings, under Connections, which deletes our copy (it does not sign you out of MyFantasyLeague itself). We will update this page before that feature reaches any subscriber.

How long we keep it

For as long as your account is open. If you cancel a subscription, your account and its data stay in place — cancelling stops billing, not access to your own history. Deleting your account (below) removes it outright.

One exception, shorter rather than longer: if you use GM chat, your questions and the GM’s answers are kept for 30 days so we can investigate a reported problem, then deleted automatically — a bounded window we enforce ourselves, not a promise we remember to keep by hand.

Your data is yours

You can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it — including your whole account. Deleting your account removes your profile, leagues and rosters. Write to support@aiintegratedsols.com and we will act on it.

Other users cannot see your data. Access is enforced per-row in the database, so one account cannot read another’s team, league or subscription — that is a property of the storage layer, not of the screens.

Cookies and local storage

We use a small number of cookies that are necessary for the product to function — keeping you signed in, and a small first-party cookie for your display preferences: your theme (light or dark), and your motion, haptics and density settings. Those preferences are saved in your browser’s own local storage and mirrored to a same-site cookie on your device, so our server can render the right theme on the very first response instead of flashing the wrong one and correcting it a moment later. That cookie carries no personal identifier and nothing from your account — it is read only by our own servers, never a third party, and is not used for tracking or advertising in any form. We do not use advertising or cross-site tracking cookies.

Changes and contact

We will update this policy as the product or its sub-processors change, and the date at the top will change with them — the list above is a live account of who touches your data today, not a snapshot we forget to revisit. Fantasy Wingman™ is operated by AI Integrated Solutions. Questions or requests go to support@aiintegratedsols.com.