Privacy Policy

Last updated: September 24, 2026 · Effective: September 24, 2026

Scope and controller

This Privacy Policy explains how Niam LeStourgeon, doing business as Fantasy Agent ("Fantasy Agent," "we," "us," or "our"), collects, uses, discloses, and otherwise processes personal information when you use our websites, applications, emails, and related services (collectively, the "Service"). It does not govern information processed by third parties under their own privacy notices, including Sleeper and Stripe.

Information we collect

Information you provide

• Account and contact details: your email address and account identifiers created when you sign in through an emailed one-time link.
• Trusted devices: if you choose "Trust this device" when signing in, we set a strictly necessary cookie on that browser holding a random device token for up to 90 days. Scripts on the page cannot read it. Our database keeps a one-way hash of that token, an encrypted copy of your sign-in session so the device can stay signed in, a device name derived from your browser and operating system, your browser's user agent, and the IP address the device was trusted from. You can see and revoke trusted devices, or sign out on a device, at any time from your account; revoking a device deletes its stored session.
• League-selection and profile details: the platform your league is on (Sleeper or ESPN); your Sleeper username or your ESPN league ID and team; the league you choose to connect; and the temporary verification code you add to your Sleeper or ESPN team name to show that you control the selected team.
• GM philosophy: your answers to our GM philosophy questionnaire (for example, how you weigh risk, matchups, waivers, trades, and expert rankings) and the philosophy document we generate from those answers, which you can download as a PDF.
• Email preferences: the days, time, and time zone you choose for recommendation emails.
• Other content: settings, communications, support requests, and other information you choose to submit.
• Payment and subscription details: subscription status and billing-related identifiers. Payment-card information is collected and processed by Stripe; Fantasy Agent does not receive or store full payment-card numbers.

Information from connected services and public league sources

When you ask us to use Sleeper or ESPN information, we retrieve and process the information that platform makes available to us for the selected account or league. For ESPN, we read leagues that the league manager has made viewable to the public; we do not ask for or store your ESPN password. If a user consents, we store ESPN sign-in cookies so that the service can use your private leagues. Depending on the league and the platform’s available data, this may include usernames, league membership, rosters, matchup and transaction activity, scoring settings, player selections, waiver and trade information, and publicly available league content. This information may concern other people in your league; use of the Service does not authorize you to provide us private information that you are not permitted to share.

Information collected automatically

We may collect device, browser, IP address, approximate location derived from IP address, pages viewed, interactions, timestamps, referring URLs, diagnostic logs, and similar usage information. Cloudflare, our security and content-delivery provider, may process request and browser information, including IP address, browser and device characteristics, request metadata, and security signals, to protect the Service from automated abuse, fraud, credential-stuffing attempts, malicious traffic, and other threats. Our Cloudflare client-side security tools may also monitor third-party scripts, browser connections, and cookies loaded on our pages for security risks. With your consent where required, Google Analytics may collect information through cookies or similar technologies. We do not knowingly use this information for targeted advertising or sell it for money.

How we use information

We use personal information to provide, secure, improve, and support the Service, including to:

• create and maintain accounts, authenticate users, and verify league control;
• retrieve, organize, and analyze selected league data to generate lineup, waiver, trade, and other Fantasy-football recommendations;
• use your GM philosophy answers to tailor those recommendations to how you manage, and generate your downloadable philosophy document;
• send recommendation emails on the schedule you choose, as well as transaction messages, administrative notices, and support responses;
• process subscriptions, manage billing status, prevent fraud, and maintain records;
• monitor performance, debug errors, protect the Service, and enforce our Terms of Service; and
• measure and improve product use, where permitted by your preferences and applicable law.

We may create aggregated or de-identified information that no longer reasonably identifies you. We may use and disclose that information for lawful business purposes.

Legal bases for processing

Where the GDPR, UK GDPR, or similar law applies, we process personal data to perform our contract with you; to comply with legal obligations; to pursue our legitimate interests in operating, securing, and improving the Service where those interests are not overridden by your rights; and, where required, with your consent. You may withdraw consent at any time, but doing so does not affect processing already performed lawfully before withdrawal.

How we share information

We may disclose personal information to the following categories of recipients, only as needed for the purposes above:

• Service providers: hosting, database, email, authentication, analytics, customer-support, security, and payment providers that process information under contractual restrictions. This includes Cloudflare, which provides content delivery, bot mitigation, and client-side security monitoring for our website.
• AI model providers: providers that host the AI models we use to generate recommendations (currently Anthropic). We send them the league data and GM philosophy needed for a recommendation, not your payment details, and we do not authorize them to use it to train their models.
• Connected services: Sleeper or ESPN, when required to retrieve or verify league information; and Stripe, when required to create or administer a subscription.
• Professional advisers and authorities: auditors, insurers, legal advisers, regulators, law enforcement, or others when we believe disclosure is required by law or necessary to protect rights, safety, or security.
• Business transferees: a buyer, investor, successor, or other participant in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.
• At your direction or with your consent: other recipients you ask us to share information with.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws. If that practice changes, we will update this policy and provide any required notice or choice.

Cookies and analytics

We use strictly necessary technologies to operate the Service, such as technologies that maintain a session, protect against abuse, or remember a privacy choice. Cloudflare may use strictly necessary cookies or similar browser identifiers to distinguish automated traffic from legitimate visitors and to apply security protections. Where enabled and allowed by your consent, we use Google Analytics to understand aggregate use of our site. You can manage optional analytics through the Cookie settings link on our website and may also control cookies through your browser. Blocking cookies may affect some features or prevent security checks from completing.

Separately from Google Analytics, we keep our own basic measurement that uses no cookies and does not identify you. Each page view or action on the page is added to hourly totals along with the page address, a broad device type (mobile, tablet, or desktop), and the website that referred you. These totals are counted for every visitor, including visitors who decline analytics cookies, because they contain no identifiers, are never linked to your account, and cannot be traced back to an individual; where the GDPR or similar law applies, we rely on our legitimate interest in understanding whether the Service works and how people find it.

Our website also stores a single item in your browser's local storage, named fa_source, recording where you first arrived from, such as a directory listing or a search engine. Signing in uses a link sent to your email, so without it a sign-up finished after you return from your email would be credited to no source at all. It holds no identifier and nothing about you, only the name of the website or campaign you arrived from; it is readable only by our own site; and you can remove it at any time by clearing site data in your browser.

We honor legally required opt-out preference signals where applicable.

Unique visitor measurement

We count unique visitors to our website using a privacy-preserving method: we compute a daily rotating hash of your IP address and browser user-agent string. This hash cannot be reversed to identify you, is not linked to your account, and is discarded when the daily salt rotates. Like the totals described above, it is counted for every visitor rather than only those who allow analytics cookies, and we use it only to understand aggregate traffic patterns (for example, how many distinct people visited on a given day). We do not use it for profiling, advertising, or cross-site tracking.

Retention and security

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide the Service, comply with legal and accounting obligations, resolve disputes, and enforce agreements. The appropriate period depends on the type of information, your relationship with us, legal requirements, and our operational needs. We keep all logs, regardless of the content for 1 year, because we only collect data needed to make our service work as best we can. Inactivity after 1 year will result in us deleting all data associated with your account.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These measures include traffic filtering and bot-mitigation tools provided through Cloudflare, as well as client-side monitoring designed to identify potentially risky third-party scripts, connections, and cookies. No system or transmission is completely secure, however, and we cannot guarantee absolute security. You are responsible for maintaining the security of your email account and should promptly notify us of suspected unauthorized account use.

Your choices and privacy rights

Account, communications, and connected data

You may update certain account information, retake the GM philosophy questionnaire, change your email schedule, download your philosophy document, disconnect or stop using the Service, and unsubscribe from non-essential marketing communications through the link in those messages. We may still send transactional, billing, security, and other non-marketing communications. You can view and revoke trusted devices from your account settings at any time; revoking a device immediately invalidates its token and signs you out on that device. To request account deletion or deletion of connected league data, contact support@footballagent.tech. Deletion may be subject to lawful retention requirements and backup cycles.

Regional rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection to certain processing; to withdraw consent; and to appeal a privacy-rights decision. California residents may have rights to know, correct, delete, and limit certain uses of sensitive personal information. We do not discriminate against individuals for exercising applicable privacy rights.

To make a request, email support@footballagent.tech with "Privacy Request" in the subject line. We may need to verify your identity and authority before acting. An authorized agent may submit a request where permitted by law, subject to verification. If we deny an appealable request, you may appeal by replying to our decision with "Privacy Appeal." You may also complain to your local data-protection authority where applicable.

International transfers

We may process and store information in the United States and other countries that may have different data-protection laws than your country of residence. Where required, we use appropriate safeguards for restricted international transfers, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another valid transfer mechanism. You may request information about applicable safeguards at support@footballagent.tech.

Children’s privacy

The Service is not directed to children, and we do not knowingly collect personal information from children under the age at which parental consent is required under applicable law. If you believe a child has provided personal information to us, contact us so that we can investigate and take appropriate action.

Changes to this policy and contact

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. If a change materially affects your rights, we will provide additional notice when required by law. Your continued use of the Service after an update becomes effective is subject to the updated policy, to the extent permitted by law.

Questions or requests about this policy may be sent to Niam LeStourgeon, legal@footballagent.tech.