Last updated: 11 September 2026
| What | Where | Why |
|---|---|---|
| Your local league setup Scoring, roster slots, chosen draft position, draft board state, and Start/Sit's week choice and player pins |
Your browser Relevant calculation inputs are processed transiently by this server |
Saved in your browser's local storage so the site remembers your setup. Scoring and roster settings are sent to POST /api/rankings when a tool calculates player values; the Draft Board also sends drafted player names when it recalculates remaining-player values. The app uses those inputs for the response and does not save them as a user record or activity history. A separate, optional bug-report attachment is described below. |
| A bug report you send Only if you fill in the "Report a bug" form and press Send |
A file on this server | So the bug can actually be fixed. Holds what you typed, the page you were on, and — unless you untick the box — your league setup. Also forwarded to a private chat channel so it gets read. Nothing else, and nothing at all unless you send one. |
| Yahoo connection token Only after you choose to connect Yahoo |
Encrypted record on this server | Lets the optional, read-only Yahoo connection survive a visit or browser restart. The record holds OAuth tokens, not league or roster data, and expires after 30 days or is deleted sooner when you disconnect. |
That is the complete list of information the app writes to persistent storage. An ordinary rankings request is processed without creating a user table, login, profile, app pageview log, or history of what you searched or drafted. The persistent exceptions are a bug report you deliberately send and an optional Yahoo connection you deliberately authorize.
Every page has a "Report a bug" button. Nothing is sent anywhere while you are just looking at it — the form only submits when you press Send, and there is nothing recorded about you either way if you never touch it.
Most bugs here are only reproducible in the league they happened in — the same board is scored differently in a 12-team half-PPR league than in a 10-team Superflex one. So the form offers to attach your league setup: the scoring and roster settings already saved in your browser and, if you synced a league, its platform, name and league ID. A Sleeper sync can also include the username you entered. A Yahoo sync attaches only the word “Yahoo” — no Yahoo league name or ID is ever included in a report.
All of it is listed in the form, in full, before you send, and there is a checkbox to leave every bit of it out and send only what you typed. That list is the whole of it — it does not attach your roster, your draft board, or anything else held in your browser. On a browser with nothing saved yet, there is nothing to attach and the form says so.
The email box is optional and only exists so a reply is possible. Leave it blank and the report is anonymous. An address given there is used to reply to you about that report and for nothing else — no list, no newsletter, no other email ever.
A report is read by one person. It is saved to a plain file on this server and also forwarded to a private chat channel (currently Discord) so that it is actually seen rather than sitting in a file nobody remembers to open — which means the text of your report, and anything you chose to attach to it, passes through that chat provider's servers and is subject to their policies. Nothing else on this site is sent to them, and nothing is sent at all unless you press Send.
To stop the form being used to flood that channel, submissions are rate-limited per sender: the sender's IP address is hashed with a random value that is regenerated every time this server restarts, kept in memory only for ten minutes, and never written to the file, sent onward, or stored anywhere. The report itself carries no IP address.
This site sets no tracking or analytics cookies. Your saved settings use browser local storage, which is not a cookie. The values needed for a ranking calculation are sent in that calculation's request as described above.
Yahoo authorization uses three functional, HttpOnly cookies. A random OAuth state cookie protects against cross-site request forgery, and a return-path cookie remembers which internal tool to reopen; both expire after 10 minutes and are deleted at callback. After a successful connection, an opaque connection-ID cookie identifies the encrypted server-side token record. It expires after 30 days or is deleted when you disconnect. All three use SameSite=Lax, are Secure in production, and are never used for advertising, analytics, or cross-site tracking.
When you enter a Sleeper username to sync a league, roster or live draft, this server calls Sleeper's public API on your behalf and passes the result straight back to your browser.
You can also import a public ESPN league by entering its league ID or ESPN league URL. Active tools request the current season automatically, and League History requests every public season ESPN still provides. This site does not accept ESPN browser cookies, account credentials, or private-league access.
None of that data is written to disk or to a database. Sleeper responses are held in bounded process-memory caches to avoid repeated identical upstream requests: live draft picks for 1.5 seconds (unused entries are swept after an hour), rosters and current League History data for one minute, league data and league transactions (read only to summarize winning FAAB bids) for five minutes, username lookups for ten minutes, NFL state for one hour, and the shared NFL player list for six hours. Completed-season League History responses can remain for the life of the process because those public results no longer change; that cache is bounded and can clear sooner, and everything disappears on restart. ESPN public-league responses are cached in bounded process memory for one minute.
Start/Sit also reads the public NFL schedule (kickoff times and whether each game has started) from ESPN's public scoreboard, so it can lock lineup slots once a game begins. That request names only a season and week — nothing about you or your league is sent. The schedule is cached in bounded process memory for one minute while games are live or about to start, and fifteen minutes otherwise.
Requests sent to Sleeper or ESPN are also subject to that platform's own privacy policy, which is outside this site's control.
Yahoo sync is optional and starts only when you choose to connect your Yahoo account. Yahoo shows its own authorization screen; AdvantEdgeHQ never receives your Yahoo password. The connection requests read-only Fantasy Sports access.
During authorization, this site sets the two short-lived cookies described above: one protects the flow from cross-site forgery and one remembers the internal return page. On success, it sets the third cookie containing only an opaque connection identifier. The Cookies section gives their exact lifetimes and attributes.
The server stores Yahoo OAuth access and refresh tokens encrypted at rest so the connection can continue to work. It does not store your Yahoo league, roster, matchup, or player data anywhere — not on disk, not in a database, and not in an in-memory cache. Every piece of it is requested from Yahoo at the moment a tool needs it and discarded once the response is sent to your browser. This is required by Yahoo’s API terms as well as being this site’s preference. Disconnecting deletes the encrypted token record. Yahoo data and authorization are also subject to Yahoo's own privacy policy.
Unless you sent a bug report or connected Yahoo, the app keeps no persistent server-side record about you. Transient ranking inputs disappear after the response, and public league-sync caches disappear on their stated schedule or when the process restarts. A Yahoo token record expires after 30 days; disconnecting deletes it sooner. Clearing browser site data removes the corresponding browser cookie. Anything else the site remembers about your setup lives in your own browser — clearing browser site data for this domain removes it immediately and entirely.
If you did send a bug report and want it removed, ask through the same form and it will be deleted — from the file and from the chat channel it was forwarded to. Reports are kept only for as long as the bug is worth tracking.
The site is delivered through its hosting provider and Cloudflare, which receive ordinary connection and request metadata to serve and protect it under their own policies. The site also loads its typeface from Google Fonts, which means your browser makes a request to Google's servers when a page loads. Player projections and average draft position data are sourced from FantasyPros and imported as files — that process involves no data about you. Donations, if you choose to make one, are handled entirely by Buy Me a Coffee on their own site under their own policies; this site never sees payment details. A bug report you submit is forwarded to a private Discord channel, as described above. League sync sends read-only requests to the platform you select: public requests to Sleeper or ESPN, or authorized requests to Yahoo after you connect it. Nothing else you enter in the app is passed to a third party.
If what the site collects ever changes, this page changes with it and the date at the top is updated.