Privacy Policy

Last updated: 12 November 2026

This Privacy Policy explains what the operator of Fantasy Witch ("we", "us") collects when you use Fantasy Witch at https://fantasywitch.app, why, and the choices you have. The short version: no accounts, no passwords, no advertising cookies, and we never ask for your Sleeper or ESPN login.

1. What we collect

League data you ask us to read. When you enter a Sleeper username or an ESPN league ID, we fetch the publicly available league, roster, matchup and score data from that platform to build your curse. We do not log in as you.
Curse and league records. When you brew a curse in a Sleeper or ESPN league, we store a record of it: the league ID and name, week, team and manager display names, the player cursed, the curse level and score numbers, and later whether the curse "worked". This powers league hex boards, results emails and aggregate statistics. These records are visible to anyone who has the league's board link.
"Hex any team" input. Opponent and team names and the player list you type or paste are encoded in the shareable link. Screenshots you choose are read on your device with OCR and are not uploaded to us.
Email address. If you join the waitlist, we store your email and the time. We use it for the waitlist and our weekly results email, and we process unsubscribes.
Anonymous usage analytics. We record events such as page views, curses brewed, share clicks (and which method) and shared-link opens, with a random per-tab session identifier, the page path, a referrer domain, and device type (mobile or desktop). We do not set cookies, store IP addresses in our analytics, or track you across sites. We respect the browser's Do Not Track signal.
Technical logs. Our hosting provider keeps standard server logs (such as IP address, user agent and requested URL) for security and operations, for a limited period.
Preferences on your device. We save your Sleeper username, last league, ESPN league and team, curse level and temporary session flags in your browser's local storage so the site can remember you. They stay on your device and you can clear them with "Forget me" or your browser settings.

2. How we use it

To operate and improve the Service, generate and display curses and boards, send emails you asked for, measure what is working, prevent abuse and keep the site secure, and comply with law.

3. Who we share it with (service providers)

We do not sell your personal information. We use these providers to run the Service: Render (hosting), Supabase (database for curse records, waitlist emails and analytics), Resend (sending email), GitHub (code hosting and scheduled jobs), and Google Fonts and Sleeper's image CDN (fonts, player photos and avatars are loaded from their servers, which means those services receive your IP address and browser details). If you use the screenshot reader, the OCR library is loaded from jsDelivr on demand. Each provider handles data under its own privacy terms. We may also disclose information if required by law or to protect our rights and users.

4. Public information from other platforms

Team names, manager display names, avatars and player data originate on Sleeper or ESPN, where they are already visible to others in your league. Shared curse links and cards can display them to anyone with the link.

5. Retention

Curse records and analytics are kept as long as they are useful to run and improve the Service, and waitlist emails until you unsubscribe or ask us to delete them. You can ask us to remove data sooner (see Your choices).

6. Your choices and rights

Unsubscribe from any email using its link.
Clear local data with "Forget me" on the site or your browser settings.
Do Not Track: turn it on in your browser and we will not record analytics events.
Access, correction, deletion, objection. Email hello@fantasywitch.app to ask for a copy of your data, to correct or delete it (including removing a league's curse records or an email address), or to object to processing. Depending on where you live (for example the EEA/UK under GDPR, or California under CCPA/CPRA) you may have additional rights, including to lodge a complaint with your local authority. We will not discriminate against you for exercising them.

7. Children

The Service is not directed to children under 13 (16 in the EEA/UK) and we do not knowingly collect their personal information. If you believe a child has given us data, contact us and we will delete it.

8. Security and international transfers

We use reasonable technical measures such as encrypted connections and restricted database access, but no system is perfectly secure. Our providers may process data in the United States and other countries, where data protection laws may differ from yours.

9. Changes

We may update this policy. The "Last updated" date shows the latest version. If a change is material we will make a reasonable effort to tell you.

10. Contact

hello@fantasywitch.app