Privacy Policy

1. Overview

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the Fantasy Manager mobile application and website (together, the "Service"). We process your data lawfully, fairly, and transparently in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Fantasy Manager is an AI-assisted analytics tool for fantasy football, provided for informational and entertainment purposes only. It is not affiliated with, endorsed by, or sponsored by the NFL, Sleeper, ESPN, Yahoo, or any team, league, or player.

2. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Lukas Schachtmaier & Johann Warkentin GbR (honeyapps)
Represented by: Lukas Schachtmaier, Johann Warkentin
Rosenstraße 19
38550 Isenbüttel
Germany
Phone: +49 174 9783003
Email: info@honeyapps.de
VAT ID (§ 27a UStG): DE461049022

Full provider identification is available in our Imprint.

3. Data we collect

Account & profile

• Email address and authentication identifier (via email, Sign in with Apple, or Google Sign-In). With Sign in with Apple you may share only Apple's private relay address.
• Display name and, if provided, profile picture.
• Your Sleeper username and user ID when you connect a Sleeper account.
• If you connect an ESPN league by logging in with ESPN: your ESPN member ID (SWID) and the ESPN session cookie (espn_s2) that lets us read your leagues. You log in on ESPN's own page — we never see your ESPN password. The session cookie is stored only on our servers, encrypted (AES-256-GCM), used only to read the leagues you connect, and deleted when you disconnect ESPN or delete your account. If you connect a public ESPN league by its link instead, we store only the team you selected.
• If you connect a Yahoo league (beta, by invitation only): you sign in on Yahoo's own page — we never see your Yahoo password. Yahoo then gives us an access token and a refresh token that let us read your Yahoo Fantasy leagues. The tokens are stored only on our servers, encrypted, used only to read the leagues you connect, and deleted when you disconnect Yahoo or delete your account.
• Subscription tier and in-app preferences and settings.

Fantasy football data

• Leagues, rosters, matchups, transactions, and related data retrieved from the Sleeper API, from ESPN or from Yahoo for the accounts and leagues you connect.
• Your interactions with AI features (questions, requested analyses, lineup and trade inputs).

Information about other members of your league. When you connect a Sleeper league, the league data we retrieve necessarily includes information about the other managers in that league — their public Sleeper username and display name, avatar, roster composition, win/loss record, and their league transactions as Sleeper publishes them to all league members (trades, waiver claims and, in FAAB leagues, winning bids and remaining budget). From these transactions we derive league-internal summaries — for example how a manager typically trades or how much FAAB they usually spend — to support your waiver bids and trade offers. We process this data because it is an inseparable part of your league (Art. 6(1)(f) GDPR — our and your legitimate interest in providing league analysis), display it to you in the app, and include it in AI-generated analyses (e.g. matchup previews). These summaries are only ever shown to members of the same league. We do not use other managers' data for any other purpose, and we do not contact them. We do not use other managers' data for any other purpose, and we do not contact them. If you are such a league member and want your data removed from a user's account, contact info@honeyapps.de.

Platform waitlist. If your league runs on a platform we do not support yet (for example ESPN or Yahoo) and you ask to be notified when it is supported — in the app or on our website — we store your email address (in the app: the address of your account), the platform you named, where you signed up, whether you would like to test an early version, and the time of sign-up. We use this only to tell you when your platform works, to invite you to a beta test if you asked for it, and to count demand in aggregate. We do not send newsletters or advertising to this address.

Usage, device & technical data

• Product usage and event data to operate and improve the Service.
• Recommendation history: which lineup, waiver and trade recommendations we showed you, and — by comparing them with your league's transactions — whether you followed them and how they turned out. We use this to grade our recommendations, show you your track record, and personalise future recommendations. Aggregated, non-identifying totals (e.g. how many recommended pickups beat the starter they replaced) may be shown to all users.
• Device information (model, operating system, app version) and, if you opt in, a push-notification token.
• Server, security, and diagnostic logs, including IP address, processed by our infrastructure providers to deliver and secure the Service.

Subscription & purchase data

• Purchase and subscription status. In-app purchases are processed by Apple (App Store) or Google (Google Play) and managed via RevenueCat. We do not receive or store your full payment card details.

We do not knowingly collect special categories of data (Art. 9 GDPR); please do not submit such information through the Service.

4. Purposes and legal bases

Provision of the Service (Art. 6(1)(b) GDPR – performance of a contract):

• Creating your account, connecting leagues, and generating rankings, lineups, trade and waiver analysis.
• Processing your fantasy inputs to generate AI-assisted output.
• Verifying purchases and unlocking paid features.

Consent (Art. 6(1)(a) GDPR):

• Push notifications, if you enable them. You can withdraw consent in your device settings at any time.
• The platform waitlist (see section 3), if you join it. You can withdraw at any time by emailing info@honeyapps.de; deleting your account removes an in-app entry automatically.

Legitimate interests (Art. 6(1)(f) GDPR):

• Improving the Service, analytics, abuse prevention, rate limiting, and support.
• Grading and personalising recommendations based on your recommendation history, and deriving league-internal summaries of other league members' public transactions (see section 3).
• Error monitoring to detect and fix technical faults.
• Security and fraud prevention.
• Enforcing the free plan's one league per season (see section 7).

Legal obligation (Art. 6(1)(c) GDPR): compliance with legal obligations and enforcement of our terms.

5. AI processing

Some features send relevant fantasy context to our AI processor (Anthropic PBC, USA — "Claude") to generate a response. Depending on the feature, this context can include: your rosters, matchups, league settings and standings; your question and the recent conversation history, including summaries of your previous Copilot conversations; your in-app personalization profile (e.g. risk tolerance, experience level, preferred level of detail); display names of other managers in your league; and a pseudonymous user identifier used for rate limiting and abuse prevention. We never send your email address, password, or payment details to the AI provider. Under our agreement with Anthropic, API data is not used to train AI models. AI outputs are generated automatically, may be inaccurate, and are provided for informational and entertainment purposes only. We keep technical AI-usage telemetry (model, token counts, latency) for up to 90 days; it is deleted earlier if you delete your account.

6. Third-party services

Supabase (database & authentication)
Provider: Supabase Inc., 970 Mission Street, San Francisco, CA 94103, USA
Server location: EU (Ireland)
Privacy: https://supabase.com/privacy
Purpose: storage of account and fantasy data, user authentication.
Basis for third-country transfer: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Vercel (web hosting & CDN)
Provider: Vercel Inc., San Francisco, USA
Privacy: https://vercel.com/legal/privacy-policy
Purpose: hosting of the web service and the app's server API, edge/server logs (incl. IP address). Server functions run in the EU (Dublin, Ireland).
Basis for third-country transfer: EU Standard Contractual Clauses.

Upstash / Vercel KV (caching)
Provider: Upstash, Inc., USA (integrated via Vercel)
Privacy: https://upstash.com/trust/privacy.pdf
Purpose: caching and rate limiting to keep the Service fast and secure. Stores short-lived counters and cache entries keyed by a pseudonymous user ID or, for unauthenticated invite previews, the IP address; no profile data.
Basis for third-country transfer: EU Standard Contractual Clauses.

Sentry (error monitoring)
Provider: Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
Server location: EU (Frankfurt, Germany)
Privacy: https://sentry.io/privacy/
Purpose: detection and diagnosis of technical errors in the web service and server API. When an error occurs, technical data (error message, stack trace, affected URL, browser/device type, timestamp) is transmitted. Session replay is disabled; we do not send your email address, roster content or payment data.
Basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, secure Service); third-country transfer on the basis of EU Standard Contractual Clauses.

Anthropic (Claude – AI processing)
Provider: Anthropic PBC, San Francisco, USA
Privacy: https://www.anthropic.com/legal/privacy
Purpose: AI processing for assistant, rankings, and analysis features. Receives the fantasy context needed to generate output; not your email, password, or payment data.
Basis for third-country transfer: EU Standard Contractual Clauses.

RevenueCat (in-app purchases)
Provider: RevenueCat Inc., San Francisco, USA
Privacy: https://www.revenuecat.com/privacy
Purpose: management of subscriptions and purchases. Receives a pseudonymous user ID and subscription status. Payment data is not shared with RevenueCat.
Basis for third-country transfer: EU Standard Contractual Clauses.

Apple App Store & Sign in with Apple
Provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
Privacy: https://www.apple.com/legal/privacy/
Purpose: app distribution, in-app purchase payment processing, and optional sign-in. Payment is handled solely by Apple; we receive no payment data. Sign in with Apple provides a pseudonymous ID and, if you allow it, your (possibly relay) email.

Google Play (Android distribution & in-app purchases)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy: https://policies.google.com/privacy
Purpose: distribution of the Android app and payment processing for in-app purchases. Payment is handled solely by Google; we receive no payment data.

Google Sign-In
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy: https://policies.google.com/privacy
Purpose: optional sign-in. Provides a pseudonymous Google account ID, your email, and possibly your display name.

Sleeper (fantasy data)
Provider: Blitz Studios, Inc. (Sleeper)
Purpose: at your request, we retrieve your league, roster, and matchup data from the Sleeper API for the accounts you connect. We are not affiliated with Sleeper.

ESPN (fantasy data)
Provider: ESPN Enterprises, Inc., USA
Purpose: at your request, we retrieve your league, roster, matchup, transaction and draft data from ESPN for the leagues you connect — for private leagues with the ESPN session you created by logging in with ESPN. The login itself happens on ESPN's page and is governed by ESPN's privacy policy. We are not affiliated with ESPN, the NFL or Disney.

Yahoo (fantasy data, beta)
Provider: Yahoo Inc., USA
Privacy: legal.yahoo.com
Purpose: at your request, we retrieve your league, roster, matchup and transaction data from the Yahoo Fantasy Sports API for the leagues you connect, using the access you granted on Yahoo's sign-in page. The sign-in itself is governed by Yahoo's privacy policy. We are not affiliated with Yahoo.

Expo (app delivery & push notifications)
Provider: 650 Industries, Inc. (Expo), USA
Privacy: https://expo.dev/privacy
Purpose: app delivery infrastructure and transport of push notifications (if enabled). Push messages are delivered to your device via Apple Push Notification service or Google Firebase Cloud Messaging; in the web version, via your browser vendor's push service.

Vercel (hosting of this policy)
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Purpose: hosting of the public version of this Privacy Policy on honeyapps.de. Standard hosting logs (IP, user agent, timestamp) are processed.
Basis: Art. 6(1)(f) GDPR (legitimate interest in publicly providing legally required information).

Supabase, Vercel, Upstash, Sentry, Anthropic, RevenueCat and Expo process data on our behalf and on our instructions (Art. 28 GDPR). Apple, Google, Sleeper, ESPN and Yahoo act as independent controllers for their own services. We do not sell your personal data.

7. Data retention

We keep your data while your account is active and as needed to provide the Service. When you delete your account, your personal data is removed from our production systems immediately. Residual copies in server logs, diagnostics, and encrypted backups are purged on a rolling schedule within at most 90 days. One exception: to keep the free plan at one league per season, we keep a one-way hash (SHA-256) of your fantasy platform account ID (e.g. your Sleeper user ID) together with the league you chose for the free plan and the season. It contains no email address and no link to your Fantasy Manager account; it only lets us recognise a re-created account as the same free-plan user. It is deleted after that season ends (by March 1 of the following year). Waitlist entries are deleted within 30 days after we have sent the launch notification for your platform, when you withdraw, or at the latest 12 months after sign-up. We retain limited records longer only where the law requires it (accounting and tax obligations, defense of legal claims).

8. Your rights

Under the GDPR you have the right to:

• Access (Art. 15) – information about the data we hold.
• Rectification (Art. 16) – correction of inaccurate data.
• Erasure (Art. 17) – you can delete your account in-app or by contacting us.
• Restriction (Art. 18) of processing.
• Data portability (Art. 20) – you can export your data in the app under Settings.
• Objection (Art. 21) to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)) at any time.

To exercise your rights, contact info@honeyapps.de. We will respond without undue delay and within 30 days (Art. 12(3) GDPR).

9. Security & data storage

We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), row-level access controls in our database, secure on-device token storage (Keychain / encrypted storage), and least-privilege access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Your primary data is hosted in the EU.

10. Local storage & cookies

The mobile app uses secure device storage to keep you signed in and cache data for offline use. The website uses strictly necessary cookies and local storage for authentication and core functionality; these are required and are not used for cross-site advertising.

11. Children

Fantasy Manager is not directed to children. You must be at least 17 years old to use the Service (see our Terms of Service). We do not knowingly collect personal data from anyone under this age; if we learn that we have, we delete it immediately.

12. Supervisory authority

Our competent data-protection supervisory authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany
Email: poststelle@lfd.niedersachsen.de
Web: https://lfd.niedersachsen.de

You also have the right to lodge a complaint with any other supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available here and in the app. For material changes we will notify you by email or in-app notice.

14. Contact

For privacy questions or to exercise your rights:

Lukas Schachtmaier & Johann Warkentin GbR
honeyapps · Rosenstraße 19, 38550 Isenbüttel, Germany
Email: info@honeyapps.de