Privacy policy

In short

• To read a private ESPN league, we need two ESPN session cookies, espn_s2 and SWID. You paste them, or the add-on reads them for you.
• They go only to our own server, over HTTPS. They are stored encrypted, used only to read your own league from ESPN, including its team logos from ESPN's image host, and deleted when you disconnect the league.
• We never sell your data, and we do not use it for advertising.

The League Connect add-on

The add-on has one purpose: connect your ESPN fantasy football league to your WINN4FANTASY account, and keep it connected.

What it reads

Two cookies from espn.com: espn_s2 and SWID. These are the session cookies ESPN uses to recognize you. ESPN offers no API or delegated sign-in for fantasy leagues, so there is no other way for an outside site to read a private league.

When you open the add-on's popup on an ESPN page, it reads that tab's address to find the league ID in it. The address leaves your browser only if you then click Connect, which opens WINN4FANTASY with the league filled in. It reads no other cookie, no other site, and nothing on any page.

When you click Connect with the add-on on WINN4FANTASY, it finds the league you are connecting in the addresses of the ESPN tabs open in your browser, and sends only that one league address. It never takes the league from the web page.

When it reads them

When you press Connect. This is how a league is first attached to your account, and nothing happens before you do it.

When ESPN replaces them, if you have already connected a league. ESPN issues a new session each time you sign back in, and the copy we hold stops working when it does. So once you have connected a league, the add-on watches those two cookie names and hands the new session to your account when it changes. It also checks once when the browser starts and once every 12 hours, to catch a sign-in made while it was not running. You can switch this off in the popup at any time, and it stops completely. There is also a Refresh now button if you would rather do it by hand.

Where they go

Only to our own server at https://www.winn4fantasy.com, over HTTPS. The server uses them to read your own league from ESPN, and stores them encrypted so your dashboard keeps working between visits. The background refresh can only replace the session on a league you already connected: it cannot connect a new one, and it gets nothing back except which leagues were updated.

What it keeps inside your browser

• A fingerprint (a SHA-256 hash) of the two cookies, so it can tell whether they changed. A hash cannot be turned back into the cookie.
• A token for the one endpoint on our server that replaces the session on a league you already connected. It is not a sign-in, and cannot read your data.
• Which WINN4FANTASY account it is linked to: a masked email such as n***@example.com and the account's internal ID. The popup shows it, and asks before linking to a different account.
• When it last checked, and a short note on what happened, for the popup.

The cookies themselves are never stored in the add-on. If the fingerprint has not changed, nothing is sent at all. The add-on contains no analytics, no telemetry, no advertising, and no remote code.

Forget everything stored here, in the popup, clears the add-on's own storage immediately.

What the website stores

• Your account: your email address and a password. Sign-in is run by our database provider, and the password is never stored in a readable form.
• Your league connection: the ESPN league ID, season, your team, and, for a private league, the two ESPN session cookies, encrypted with AES-256-GCM before they are saved.
• League data we build from it: a snapshot of your league, weekly forecasts and results, and any players you choose to watch.
• The Week Recap: the write-up of each finished week. One copy is kept per league, because every manager in it sees the same recap. It holds team names, scores and the week's highlights, and nothing about your account.
• Feedback notes: when you rate an answer from the assistant, the question, the answer and any note you write.
• Assistant questions: the text of each question and how much it cost to answer, so the daily limit can be counted. Answers are not kept unless you rate them.
• Phone alerts, if you turn them on: your alert settings and the push address your device gives us.
• Error reports: when a page breaks, your browser sends us the error message and where in our code it happened, with the page, browser type, screen width and whether you were signed in, but never your email, your league, your cookies or the rest of the page address.

To open quickly, the dashboard keeps its last page for your league in your own browser for up to a day. It never leaves your device, and signing out deletes it.

We use no analytics or advertising trackers on the site.

Who sees it

We never sell your data or share it for advertising. It is handled only by the services that run the site, for that purpose alone:

• ESPN, which receives your ESPN session when our server reads your league and when it fetches your league's team logos from ESPN's image host, exactly as your own browser would.
• Vercel, which hosts the site, and Supabase, which hosts the database and sign-in.
• Anthropic, which writes the Week Recap and answers the assistant. Opening the Week Recap sends your league's team names, scores and the week's highlights, which can name players. Asking the assistant a question sends the question and the league data needed to answer it. Your ESPN session and your email address are never sent.
• Apple, Google or your browser vendor, only to deliver phone alerts you turned on.

Limited Use

The use of information received through the WINN4FANTASY League Connect add-on adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The ESPN session is used only to provide the add-on's single purpose: connecting your league to your WINN4FANTASY account and keeping it connected. It is not used for advertising, not sold, not used to determine creditworthiness or for lending, and not read by any person except where needed for security, to comply with the law, or with your permission to look into a problem you report.

Deleting your data

Disconnect league, in the dashboard menu, deletes the stored ESPN session outright (a real deletion, not a hidden flag). It also deletes what was kept for that league on your account: the snapshot, forecasts and results, watch list, alert settings, assistant questions and feedback notes.

It does not delete your account, the devices you turned phone alerts on for, or the Week Recap, which every manager in the league shares. The add-on keeps its token until you press Forget everything stored here. That token can only refresh a private league connected to your account, so after you disconnect it does nothing unless you connect one again.

To delete your whole account and everything with it, email us at the address below and we will do it.

Contact

Questions about this policy or your data: winn4fantasy@gmail.com

WINN4FANTASY is not directed at children under 13. If this policy changes, the date at the top changes with it.