Privacy Policy
Last updated: 22 September 2026
The short version
- To play, we need your email address. That is the only personal detail we ask for.
- We set one cookie, and its only job is to keep you signed in.
- There is no advertising, no analytics and no tracking of any kind on this site.
- We do not sell or share your information, and there is no third-party script on any page.
- You can delete your account and everything in it by asking us.
Who is responsible
This site is operated by Fuzzy Sports (“we”), who is the data controller for the information described here. For anything in this policy — including a request to see or delete your data — write to hello@fuzzysports.com.
What we collect, and why
| What | Why | Kept |
|---|---|---|
| Your email address | It is how you sign in. We email you a link instead of asking for a password, so the address is the credential. It is also how we would reach you about the league. | Until you delete your account |
| A display name | So other managers in your league can tell whose portfolio is whose on the standings. | Until you delete your account |
| What you do in the game — trades, holdings, cash, dividends and your position in the standings | It is the game. A record of every trade is also what makes weekly settlement auditable, so we can show why you were paid what you were paid. | Until you delete your account |
| What you write on your league’s discussion board | So the other managers in that league can read it. Only members of the league can see its board. | Until you delete it — deleting erases the text, not just hides it — or your account is deleted. The league’s owner can also delete posts on its board. |
| If you run a league: the email addresses you invite, and any message you add to the invitation | To email each person their invitation (with your message, under your name), to send it again if you ask, and so you can see who has accepted. While an invitation is still open we also email that person, with a link to take their seat, when the league opens for trading and if it reaches its start week without enough managers — each at most once. | Until the league is deleted. Withdrawing an invitation stops its link working but keeps the record, so you can see you sent it. |
| A sign-in cookie | To keep you signed in between pages. See the next section. | 30 days after you last use the site and 90 days at most, or until you sign out |
| If you sign in from a league invitation: a scrambled (hashed) form of your email address and the invitation you followed | So that clicking the sign-in link we email you takes you back to the league you were invited to, even on a different device. We store a one-way hash, not the address itself. | Deleted when you click the link, and ignored after 25 hours in any case |
| Server logs held by our hosting provider, which typically include IP addresses | Keeping the service running and diagnosing faults. Our own application code never reads or stores your IP address; these logs are produced by the infrastructure underneath it. | Per our host’s retention policy |
That is the complete list. We do not ask for your real name, your address, your date of birth, or any payment details — and we could not use payment details if we had them, because nothing in this game costs money or pays out money.
Cookies
This site sets exactly one cookie, and it is strictly necessary for the service to work:
| Name | Purpose | Expires |
|---|---|---|
fsg_session |
Records that you signed in, so that every page knows who you are. It contains a user
identifier and an expiry, signed by us so it cannot be altered or forged. It is marked
HttpOnly, so the page’s own JavaScript cannot read it, and
SameSite=Lax, so another website cannot cause it to be sent. |
30 days after you last use the site, and never more than 90 days after you signed in |
We use no analytics cookies, no advertising cookies and no third-party cookies. Nothing on this site follows you anywhere else, and no page loads a script, font, image or style from another company’s server — a Content-Security-Policy on every response forbids it outright.
This is also why you were not shown a cookie banner. Under the ePrivacy rules a banner asks your permission for cookies that are not essential, and there are none here to ask about. A banner in that situation would be theatre: it would train you to dismiss a box that protects nothing. If we ever add advertising or analytics — neither is in place today — we will ask properly, before setting anything, and update this page.
Who else handles your data
We keep the list of companies involved as short as we can. Today it is two:
- Supabase hosts our database and sends the sign-in emails. Your email address, display name and game records are stored there. When you ask for a sign-in link, Supabase is what delivers it.
- Our hosting provider runs the server that serves these pages, and produces the infrastructure logs described above.
Both act as processors on our instructions. Neither is permitted to use your information for their own purposes. Depending on where these services run, your data may be processed outside your country, including in the United States.
Player names, statistics and schedules come from public sources (nflverse). That is a one-directional pull of public sporting facts into this site — nothing about you is sent anywhere as part of it.
Why we are allowed to hold it
If the UK or EU GDPR applies to you, our legal bases are: performance of a contract for your account and everything you do in the game, since we cannot run a league for you without them; and our legitimate interests in keeping the service secure and working, for the infrastructure logs. We do not rely on consent, because we do not do anything with your data that would require it.
Your rights
You can ask us to show you what we hold about you, correct it, delete it, export it in a portable form, or restrict or object to what we do with it. Write to hello@fuzzysports.com and we will respond within one month.
Deleting your account removes your email address, display name and game records. One caveat we would rather state than bury: deleting a manager mid-season affects the league other people are playing in, so we may retain an anonymised trace — a record that a trade happened, with no person attached — where that is needed to keep other managers’ settled results correct. Nothing in that trace identifies you.
If you are in the UK or EEA and think we have got this wrong, you can complain to your national data protection authority. We would rather you told us first.
Children
This game is not intended for children under 13, and we do not knowingly collect anything from them. If you believe a child has given us their information, write to [CONTACT EMAIL] and we will delete it. See also the age requirement in the Terms of Service.
Security
We never see or store a password, because there isn’t one — signing in is a link emailed to an address you control. Your session cookie is signed and cannot be read by JavaScript. Traffic to the site is encrypted in transit. No system is perfect, and we will not pretend otherwise; if a breach affects you, we will tell you.
Changes
If we change this policy we will update the date at the top. If a change actually matters — a new category of data, a new company handling it, or anything that would need your consent — we will say so clearly rather than quietly reposting the page.