Privacy

Your account. An email address, and either a password (stored hashed — we never see it) or the basic profile Google returns when you sign in with it: your email, your name and your profile picture.

Your profile. A display name, your team names, and the icon and colour you pick for them.

Your game.The leagues you join, the players you pick each week, your scores, and whether you're still alive in a league.

Invitations you send. If you invite someone to co-manage your team, we store the email address you typed so we can show them the invitation when they sign in.

Basic usage data.Which pages get visited, in aggregate, through Vercel Analytics — which doesn't use cookies and doesn't build a profile of you. Our servers also keep short-lived logs containing IP addresses, as essentially every web server does.

This is a game other people play with you, so some of it is on purpose: everyone in a league you join can see your display name, your team name and icon, your weekly line-ups once they lock, your scores, and whether you've been eliminated.

Your email address is not shown to other players. The one exception is the person you invite to co-manage your team, who is contacted using the address you provide.

We use a session cookie to keep you signed in. Without it the app can't tell who you are, so there's nothing to consent to or switch off — sign out and it's gone.

We also store one small value in your browser to remember which of your teams you were last looking at. It never leaves your device.

There are no advertising cookies and no third-party trackers.

Three companies, each doing one job for us:

• Supabase — stores the database and handles sign-in.
• Vercel — hosts the site and provides the aggregate analytics described above.
• Forward Email — delivers the emails we send you.

We also fetch NFL schedules and player scores from third-party sports data providers. That traffic goes out only — no information about you is sent to them.

We don't sell your data, share it for advertising, or hand it to anyone else unless the law requires it.

Account emails — confirming your address, resetting your password — and a single welcome email when you first sign up. That's it. We don't run a mailing list and won't send you marketing.

For as long as you have an account. Ask us to delete it and we will remove your account and personal details.

Results from leagues that have already finished may stay in place so the standings other players competed in remain intact — with your name removed from them.

Email contact@oneshotfantasy.com to get a copy of what we hold about you, correct something that's wrong, or delete your account. A person reads it, and there's no form to fill in.

Depending on where you live you may have further rights over your data under local law. We'll honour those requests too — just ask.

One Shot Fantasy isn't intended for children under 13, and we don't knowingly collect their information. If you believe a child has created an account, tell us and we'll remove it.

If we change what we collect or who handles it, we'll update this page and the date at the top. Nothing here changes retroactively for data we've already collected.