What we collect
- Verified email and account ID — used to create your account, secure your session, and connect paid access.
- Sign-in records — one-time email codes are stored only as hashes with expiration and attempt counts. Google sign-in stores Google's stable account identifier, verified email, and basic profile details.
- Linked Sleeper profile — public Sleeper user ID, username, display name, and avatar used to fetch your leagues and rosters.
- Connected fantasy leagues — platform, league ID, season, league name, selected team, and sync status for leagues you save from supported providers.
- Yahoo authorization — when Yahoo access is available and you choose to connect it, we store encrypted OAuth access and refresh tokens so rosterrr can read only the Yahoo Fantasy leagues your Yahoo account permits. We never receive your Yahoo password.
- PayPal purchase metadata — subscription or order ID, plan or capture ID, status, billing or pass dates, and the email PayPal returns for subscription support. We do not see your card details.
- App Store and Google Play subscription metadata — store, product, status, transaction identifiers, and billing dates returned through RevenueCat. Apple and Google process the payment; we do not receive your full payment-card details.
- Session cookie — a signed, httpOnly cookie that identifies your verified account and expires after 30 days.
- Email preferences — whether you receive the optional weekly NFL roster reminder and when you turned it off.
- Aggregate product analytics — Google Analytics receives page categories and events such as league previews, opens, upgrade clicks, and completed purchases. Dynamic league and team identifiers, usernames, player names, and query strings are removed before analytics events are sent.
- Advertising measurement — the Reddit Pixel and Reddit Conversions API receive page visits and a small set of conversion events: verified signup, checkout, and completed subscription purchases. Server events can include a one-way hashed account identifier, Reddit click or Pixel cookie identifiers, IP address, browser user agent, and purchase value and currency. We do not send account email, phone number, Sleeper data, league data, or raw PayPal identifiers.
What we don't collect
- Passwords (we don't use them)
- Credit cards (PayPal handles payment)
- Your browsing history outside rosterrr
How we use it
We use the data above to operate the service: showing you your rosters, evaluating trades, gating Pro features, processing billing, and sending optional weekly roster reminders during the NFL regular season. You can turn those reminders off from your account or any weekly email. We do not sell your data or provide it for unrelated advertising.
Third parties
- PayPal — for subscription billing. See PayPal's own privacy policy.
- Apple, Google Play, and RevenueCat — for mobile subscription purchase validation and cross-platform Pro access.
- Resend — to deliver one-time sign-in codes, account and billing messages, optional weekly roster reminders, and minimal account-activity notifications to the site owner.
- Google — for optional Google sign-in and verified email identity.
- Google Gemini API — your trade analyses and team data are sent to Google for AI processing when you use AI features. Google's API terms apply.
- Fantasy league providers — we read supported league data from Sleeper, MyFantasyLeague, Fleaflicker, Fantrax, and publicly viewable ESPN leagues. Yahoo data is read only after you explicitly authorize access through Yahoo.
- Dynasty rankings provider — we cache public consensus dynasty rankings.
- Google Analytics — for aggregate product and conversion measurement. We do not send Sleeper usernames, league IDs, team IDs, player names, or PayPal account details.
- Reddit Ads — for measuring whether Reddit ads lead to visits, verified signups, and subscriptions through the browser Pixel and server-side Conversions API. We do not send account email or phone number.
Data deletion
You can permanently delete your account from Account & settings in the website or mobile app. See the account-deletion page for instructions or email info@rosterrr.com if you cannot sign in. We remove your account identity, grants, linked Sleeper profile, connected leagues, encrypted provider credentials, saved workspace data, mobile sessions, and sign-in records, subject to required financial record retention.
Cookies
We use an essential session cookie and Google Analytics for aggregate usage measurement. The Reddit Pixel and a first-party attribution cookie may store Reddit advertising measurement identifiers in your browser so we can attribute campaign conversions. We do not sell analytics data or send Reddit your account email, Sleeper username, league IDs, team IDs, or player names.