Your privacy

Your app email and provider credentials are private. Your chosen username and eligible published team results are public by default. You can turn public participation off in Account; your attribution then disappears from rankings, benchmarks and live share pages. A co-owned team can remain public under another participating owner. ESPN browser imports remain private and excluded from public rankings. State is optional and self-reported; we do not request your precise location.

Security and abuse prevention

Account creation and username-availability checks use hashed network-address identifiers and request counters to limit repeated requests. These identifiers are used for security, not advertising or location analysis. They are not treated as anonymous merely because they are hashed. The daily cleanup process removes counters whose latest activity window is more than two days old; ongoing requests can extend retention.

Operational service logs

Cloudflare and Supabase retain operational logs to authenticate accounts, investigate errors, measure request performance and protect the service. Depending on the request, these logs include network addresses, browser or app information, requested paths, request timing and response status, security diagnostics, account or session identifiers, and approximate location derived from IP addresses. These records can be linked to your account or device. Cloudflare Workers request logs are sampled and kept for up to 7 days. Authentication-session records have separate retention tied to the session lifecycle.

Native iPhone app

The native FantasyMatrix app uses the same account and private results service. Sign-in and refresh tokens are stored in device-only Keychain storage, accessible while the device is unlocked. Theme preferences, a selected team identifier and blocked public-user identifiers and display labels are saved in local app preferences. Loaded league results remain in memory. Account exports are created only when you request one and choose where to save it; downloaded copies remain under your control. The app does not request contacts, precise location, camera, microphone or an advertising identifier.

ESPN sign-in in the native app takes place on ESPN and Disney pages inside a temporary browser. FantasyMatrix does not read your ESPN password or session-cookie values. After your explicit action, it reads the selected current-season league through ESPN and asks you to confirm the teams and data import. Only normalized league rules, team/player names, completed scores, lineups and related league facts are sent to FantasyMatrix. Temporary browser storage is discarded when the connection closes. ESPN and Disney receive network information when serving their pages. If you create or update a provider account in this browser, they may ask for your name, email address, regional details and optional promotional-email choices. Those details and choices go to the provider under its own privacy policy; FantasyMatrix does not receive them through the league-import flow. A private ESPN session is not retained on the FantasyMatrix server; automatic private refresh is not promised.

Account in the native app includes public-participation settings, provider disconnect, account export and permanent account deletion with password confirmation. Deletion removes your identity, provider links and public eligibility; shared league facts can remain for other independently connected members and encrypted backups expire within 28 days. Reports use the same private support service described below. Blocked public users are hidden on that device; blocking does not change the statistical population or another member’s access. Server-side valid-score and app-open events remain account-linked product analytics even though the native app includes no advertising or analytics SDK.

Public ESPN league links

If ESPN makes your league publicly readable, you can connect by league URL on a desktop browser. New ESPN syncing on mobile is coming to the FantasyMatrix iPhone app in its next update. Once connected on desktop, your saved results are available on any device. After you confirm your team and consent, FantasyMatrix reads rules, completed-week lineups, native scores and matchups directly from ESPN without credentials. A public link does not prove ownership, so every team in a publicly readable league is ranked on the public Leaderboard and Benchmark by team name only, never by ESPN username, with crude words masked. Consented public-link imports refresh on Tuesdays and Thursdays without an open browser; errors preserve the last saved snapshot. Disconnect stops these updates.

ESPN browser imports

FantasyMatrix ESPN Connect reads current-season football league links on ESPN pages when you request a connection. ESPN handles sign-in; the helper never reads your password or session-cookie values. Your browser sends its existing session only to ESPN. After you select a league and confirm your team and consent, it transfers league identifiers, league/team names, rules, player names, lineup slots and eligibility, and completed-week native scores over HTTPS to your FantasyMatrix account. These provisional imports do not enter public rankings. Refresh requires your browser and ESPN session. Browser session storage holds tab IDs, a league locator and connection progress. Connection attempts expire after ten minutes; closing the browser clears this temporary storage. It stores no provider password, cookie values or FantasyMatrix sign-in token. League/team names may contain personal information. We use this data only for the requested import, saved results and league analysis. We do not sell it, use it for advertising or creditworthiness, or collect unrelated browsing history. Cloudflare runs the FantasyMatrix service that processes the import requests, and Supabase stores the account-linked results on our behalf. We do not send imported league results to advertising services. We retain the saved import while your account is connected. Disconnect or account deletion removes your link; the league snapshot is deleted when no connected account needs it. Uninstalling the extension removes browser access but does not delete an already saved import or sign you out of ESPN. Manage ESPN imports.

Sleeper connections

Enter a Sleeper username to find current-season teams through its public, read-only API. We store selected league rules, team names, completed-week scores and lineups for your private dashboard. We collect no Sleeper password or access token. Username lookup does not verify team ownership. Every team in an imported Sleeper league is ranked on the public Leaderboard and Benchmark by team name only, never by Sleeper username, with crude words masked; turn off public participation in Account to stop your imports from publishing a league. Results refresh after completed weeks and again for corrections. Disconnect removes your links; a shared league snapshot remains only while another connected user needs it. Manage Sleeper imports.

Yahoo connections

When approved Yahoo access is available, you authorize read access on Yahoo and choose your current-season teams. We encrypt access and refresh tokens on our server so completed-week results can refresh without keeping your browser open. We save league rules, team names, weekly results, player points and historical starter, bench and IR lineups. Yahoo passwords and league-member contacts are not collected. Imported Yahoo results stay private while public comparison validation is pending. Disconnect removes local tokens and your import links; a shared snapshot remains only while another authorized member needs it. You can also remove the app grant in Yahoo Account Security. Manage Yahoo connections.

CBS connections

When you sign in on CBS in the FantasyMatrix iPhone app or with our Chrome extension, CBS handles the sign-in and FantasyMatrix never receives your CBS password. With your explicit consent we read your CBS football team list and the access token CBS gives each of your league pages, check each token with CBS, and keep only the ones that work, encrypted as described below. If you choose the email and password option instead, your CBS username and password pass over HTTPS through FantasyMatrix’s server to CBS for sign-in. We do not save the password. We encrypt the returned CBS access token and session cookies on our server, bound to your FantasyMatrix connection, to read your football team list and, for leagues you choose to import, your league’s settings, completed-week scores and lineups. We discard CBS profile/contact fields and do not read cookies from your browser. League and team names may contain personal information; they are shown only in your signed-in account. Cloudflare processes these requests and Supabase stores the encrypted session on our behalf. A pre-draft waiting room does not prevent sign-in. Results import is still being verified. Disconnect or account deletion removes the retained session; it does not sign you out of CBS itself. Manage CBS connection.

You control your connections

Disconnecting stops new imports and removes local credentials. Revoke any remaining remote grant in your provider’s account settings. Imported Sleeper leagues, and ESPN leagues our server can read publicly, are ranked anonymously on the Leaderboard by team name only, without provider usernames. Crude words in team names are masked. Shared league facts may remain while another member keeps the league connected.

Product analytics and support

We record daily account activity for page usage, valid Matrix Score responses and opening your saved results (website or app) to understand adoption, retention and reliability. Account-linked activity is retained for up to 400 days and removed when you delete your account. Optional browser page tracking respects Do Not Track and Global Privacy Control. Signup campaign attribution stores only a broad source such as Instagram, direct or the iPhone app, using temporary tab storage on the website. Anonymous homepage traffic is stored as daily source totals without visitor identifiers. We do not record your screen or send these events to advertising platforms.

Bug reports and feedback are stored in our private support inbox. The owner can read your report, contact information and account details to help you. Signed-in reports are removed on account deletion; closed reports and guest reports expire after 400 days without updates. Open account reports remain while support is needed. Your account export includes your reports and retained activity. Do not submit passwords, tokens or verification links.

Public-content moderation

We keep private moderation decisions, reasons and an audit history linked to the affected account to enforce our public-conduct rules. These records remain while that account exists and are removed when that account is deleted. Deleting a reporter’s account or support ticket removes the report link, but does not remove a restriction or decision history for another account. Protected recovery copies expire on the schedule below.

Recovery backups

We keep encrypted database backups in a private GitHub operations repository for recovery. Daily copies expire after seven days; weekly copies expire after 28 days. Only the operator can access the backups and the separately stored recovery key. Deleted information may remain in those protected copies until they expire and is not used for ordinary product access.

Export and deletion

Use Your account to download your information or delete your app account with your current password. Deletion removes your identity, claims and personal preferences. Data still authorized by another member may remain anonymously. Previously downloaded share images cannot be recalled; live result links reflect current availability.

For privacy questions or data requests, contact FantasyMatrix at lukealban3@gmail.com. Resend delivers account confirmation, recovery and security emails on our behalf. Email delivery has abuse and capacity limits. This policy covers the FantasyMatrix website, ESPN Connect extension and native iPhone app when installed. The iPhone app is available on the US App Store. Updated October 15, 2026.

Numeric data attribution

NFL numeric data: nflverse contributors, licensed under CC BY 4.0. Numeric fields are mapped into our event dictionary; editorial text and images are excluded. Internal research datasets are separate from user results and never appear as imported teams.