Privacy

DSFFL.com is a private site for the twelve managers of the Disney Sports Fantasy Football League, run by the league commissioner. This page says plainly what the site keeps about you, where it is stored, who can see it, and how to have it removed. There is no advertising, no analytics tracking, and nothing is sold or shared for marketing.

What we hold

• Your account: email address, display name, role (commissioner or manager), an optional avatar, and your password, which is stored only as a hash and is never visible to anyone, including the commissioner.
• Your dues account id: the key that matches you to your row in the commissioner's dues ledger, so the Account page can show your balance. It is not a payment credential.
• Push subscriptions: if you turn on alerts, one record per device holding the browser's push address, the encryption keys the browser generates, the browser name, and when it was last used. Turning alerts off on that device deletes it.
• Comments and reactions you post on stories, with the time you posted them.
• Sign-in attempt counters: to slow down password guessing, the site keeps short-lived counters keyed by a hash of the email and network address involved. They expire within an hour and hold no readable email or address.
• League data: team names, rosters, scores, draft results and history, read from the league's Yahoo pages and the commissioner's records. This is the league's shared record, not personal data, but your name is attached to your team in it.

Where it lives

Your data is stored with Supabase and served by Vercel, both in the United States. We also use SMTP2GO to send sign-in and password emails, the Apple, Google and Mozilla push services to deliver alerts (each alert is encrypted to your device), Google Sheets for the commissioner's dues ledger, Cloudflare for nightly backup copies of the site's media files, and Anthropic and OpenAI to draft stories and covers from league data. None of them receive your email address or password except the email sender, and nothing about you is sent to the AI services.

Who sees it

Every signed-in member can see every member's display name, comments and reactions. Email addresses are readable by signed-in members through the site's data layer, as they already are in the league group chat. The commissioner can see everything above, including the dues ledger and push subscription records. Nobody outside the league has an account. Story pages show a headline and cover to anyone with the link so that links unfurl in chats; the article itself needs a sign-in.

Cookies and device storage

The site sets the sign-in session cookie and nothing else. Your browser also keeps two small local flags: whether you have dismissed the home-screen install prompt, and whether alerts are on for that device. There are no advertising or analytics cookies.

How to leave

Email commish@dsffl.com. The commissioner deletes your account, which removes your email, display name, avatar, dues account id and push subscriptions immediately, and removes your comments and reactions. Your team's results stay in the league record, because they are the league's history. Copies in the rolling backups age out within thirty days.

Changes

If what the site holds changes, this page and its date change with it, and the commissioner will mention it in the league chat.