Privacy Policy

Who we are

League Loom ("League Loom", "we", "us", or "our") is operated by an individual developer based in the United States. It is not a registered company. This policy covers the website at leagueloom.com and the League Loom connector service. Questions: support@leagueloom.com.

How the service works

Understanding the flow makes the rest of this policy concrete:

• During setup you provide your own provider credentials (your ESPN espn_s2 and SWID cookies, your Sleeper username, or your Fantrax Secret ID).
• Those credentials are encrypted with AES-256-GCM and sealed into a connector token that you hold. They are not written to any server-side database.
• Each time your connected AI requests league data, the server decrypts your token in memory for that single request, reads only the data the AI asked for from the provider, returns it, and keeps nothing afterward.
• The service is read-only. It never writes to, modifies, posts to, or deletes anything in your leagues or provider accounts.

Information we collect

• Provider credentials you give us. Your ESPN espn_s2 and SWID cookies, Sleeper username, or Fantrax Secret ID. These are placed into your own encrypted connector token. We use them only to read your leagues when your AI asks.
• Fantasy league data, on demand. When your connected AI requests it, we read rosters, standings, matchups, drafts, and player data from the provider and return it. We do not keep a copy afterward.
• Website analytics. When you visit leagueloom.com we use Google Analytics (GA4) to measure aggregate usage. The custom events we send are deliberately coarse: only allowlisted values such as the page, a link or button name, a provider name, and counts. Google Analytics may also collect standard technical data such as approximate location derived from your IP address, device and browser type, and a cookie identifier.
• Messages you send us. If you email us, we receive your message and address.

What we do not collect or store

• We do not store your provider credentials in any server-side database. They live only inside your own encrypted connector token.
• We do not have user accounts or passwords beyond that token.
• Our analytics never send your credentials, your league or team identifiers, your name, or any values you copy. Our custom events carry no personal information.
• Because the service is stateless, the league data we read for your AI is not saved after the request finishes.
• Honest caveat: like any internet service, requests pass through our hosting provider, and brief operational logs may exist for security and reliability before they expire. We design the service to avoid capturing your token or credentials in those logs.

How we use information

• Credentials are used only to authenticate to ESPN, Sleeper, or Fantrax on your behalf for the read-only request your AI made.
• League data is used only to answer your AI's specific request, then returned to you and discarded.
• Analytics are used only to understand aggregate usage and improve the service.

We do not sell your personal information for money, we do not use it for advertising, and we do not use your league data or credentials to train any AI model.

How your credentials are protected

Your credentials are sealed into your own bearer token using AES-256-GCM encryption, decrypted only in memory per request, and sent over encrypted connections (HTTPS/TLS). Your token is the key to your league data, so keep it private: anyone who has your token can read your leagues. You can replace it at any time by running the setup again to mint a new token, and then stop using the old one. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we aim to minimize what is stored and exposed.

Cookies and analytics

We use Google Analytics (GA4), provided by Google LLC, which sets cookies or similar identifiers to measure usage. You can opt out using your browser's cookie controls, the Google Analytics opt-out browser add-on, or your browser's privacy settings. Our website does not currently respond to browser "Do Not Track" or Global Privacy Control signals, because there is no single industry standard for them; you can still opt out of analytics using the controls above. If you are in a region that requires consent before non-essential cookies load, please use your browser controls to block them.

Third-party services

• Fantasy providers: ESPN (The Walt Disney Company), Sleeper, and Fantrax. We access them read-only using the credentials you provide. Their own privacy policies govern your account with them. League Loom is not affiliated with, endorsed by, or sponsored by any of them.
• The AI tool you connect: when you use League Loom through Claude (Anthropic), ChatGPT (OpenAI), or another AI tool, the data we return flows to that tool, and that provider's own terms and privacy policy govern what it does with the data. We do not control the AI tool.
• Analytics: Google Analytics (Google LLC).
• Hosting: Vercel, which serves the site and processes requests.

Data retention

• Credentials: not retained in our database. They persist only inside your token, which you control.
• League data: processed per request and not stored afterward.
• Analytics: retained in aggregate by Google Analytics for its configured period.
• Operational logs from our host may be retained briefly for security and reliability, then expire.

Children's privacy

League Loom is intended for adults managing their own fantasy leagues and is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not ask your age. If you believe a child has provided personal information, contact us at support@leagueloom.com and we will address it.

Your choices and rights

• Stop and disconnect: remove the League Loom connector from your AI tool and stop using your token at any time.
• Rotate your token: run setup again to mint a new token and discard the old one.
• Opt out of analytics: see "Cookies and analytics" above.

Depending on where you live, you may have rights to access, correct, or delete personal information, or to opt out of the sale or sharing of it. Because we do not maintain accounts or store your credentials, the main personal data we hold is coarse analytics. To make a request, email support@leagueloom.com. We do not sell or share your personal information for cross-context behavioral advertising for money; note that some privacy laws treat standard analytics cookies as a "sale" or "share", which you can opt out of using the browser and Google controls above. We will not treat you differently for exercising your rights.

California and other US state residents

If you are a California resident, you may have rights under the CCPA and CPRA, including to know, delete, and opt out of the sale or sharing of personal information. We do not sell your personal information for money. To exercise any right, contact support@leagueloom.com. Residents of other US states with privacy laws may have similar rights and can use the same contact.

EU, EEA, and UK visitors

If you visit from the EU, EEA, or UK, our lawful basis for reading your leagues and handling your token is performance of the service you requested, and our basis for coarse analytics is our legitimate interest in understanding aggregate usage. You may have rights to access, correct, delete, restrict, or object to processing, and to complain to your local supervisory authority. Contact support@leagueloom.com. Our operator and hosting are in the United States, so your data is processed in the United States; by using the service from outside the US you understand and accept this.

Changes to this policy

We may update this policy. We will post changes here, update the "Last updated" date above, and highlight material changes where reasonable. Continued use after an update means you accept the revised policy.

Contact

Questions or requests: support@leagueloom.com.