Privacy Policy

1. Introduction

This Privacy Policy explains how FantasyX, Inc. ("FantasyX," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use the FantasyX mobile application, the web application at app.fantasyx.net, and the website at fantasyx.net (together, the "Service").

FantasyX is a fantasy football platform built around a weekly re-draft format. Using the Service is voluntary, and much of what the Service does — running your league, showing your team to your league-mates, sending you draft reminders — requires processing information about you. This policy tells you what we collect and what control you have over it.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

This policy does not apply to third-party services you reach through the Service, including the app stores you download FantasyX from, or to any league-mate's use of information you choose to share in a league or chat.

2. Information we collect

2.1 Information you provide to us

• Account information. An email address and/or a mobile phone number, which we use to create and verify your account. If you sign in with Google or Apple, we receive your name, email address (or Apple's private relay address), and profile photo from that provider instead.
• Profile information. Your display name and an optional avatar image that you upload.
• League and gameplay content. The leagues and teams you create or join, your draft picks and draft queue, rosters and starting lineups, waiver claims, trades and trade votes, graveyard and revive history, watchlists, cheat-sheet entries, matchup results, standings, and season history.
• Social content. Messages, reactions, polls and poll votes, shared GIFs, and "smack" attachment cards you post in league chat, along with the time they were posted and who posted them.
• Support and privacy requests. When you contact us through the in-app support form or the "Request a copy of my data" flow, we collect your name, email address, user ID, the subject and body of your message, any screenshot you attach, and your app version and platform.
• Waitlist and marketing sign-ups. If you join the waitlist on fantasyx.net, we collect your email address and the page or campaign you signed up from. We use it for one purpose: to email you once when FantasyX launches. We do not send marketing email to waitlist addresses, and we do not use them for anything else.
• Purchase and subscription information. If you buy a paid membership, our payment processor collects and processes your payment card or account details. We do not receive or store full payment card numbers. We receive and store a record of the transaction: what you purchased, the amount and currency, the date, your subscription status and renewal date, the last four digits and brand of the card or the app store account used, and the billing country or postal code.
• Settings and preferences. Your notification preferences by category, default league, theme, biometric-lock preference, public-profile setting, analytics preference, and marketing email preference.

2.2 Information collected automatically

• Product analytics. If you have accepted analytics, we use PostHog to record in-app events such as screens viewed, features used, and actions taken (for example, that a draft pick was made), together with technical context such as device model, operating system version, app version, screen size, locale, time zone, referring page (on the web), and IP address, which PostHog may use to infer approximate location at the city level. Analytics events are tied to a pseudonymous identifier and, once you sign in, to your FantasyX user ID. We do not intentionally send names, email addresses, phone numbers, or free-text content to PostHog. If you have not accepted analytics, the PostHog SDK is never initialized and none of this is collected.
• Crash and performance data. We use Firebase Crashlytics to record crashes and non-fatal errors, including the crash stack trace, device model, operating system version, app version, breadcrumb logs, and your FantasyX user ID. Crash reporting is always on and is not covered by the analytics setting — it is what tells us the app is broken, and without it a crash that only affects some devices could go unnoticed indefinitely. It never receives your league, profile, or chat content. Crash reporting runs on the iOS and Android apps only, not on the web.
• Push notification tokens. If you allow notifications, we store the push token issued by Apple Push Notification service or Firebase Cloud Messaging for each of your devices, along with the platform (iOS or Android), so we can deliver draft, waiver, and trade alerts.
• Server and security logs. Our backend and hosting providers automatically log request metadata such as IP address, timestamps, and error information, which we use to keep the Service running and to detect abuse.
• Local device storage. The app stores preferences on your device and, where you enable biometric lock, uses your device's secure storage. Biometric data itself never leaves your device and is never accessible to us.

2.3 Information from third parties

• Sign-in providers. If you sign in with Google or Apple, we receive the identifiers and profile fields described above. Apple's Sign in with Apple returns your name only on the first authorization; you may choose to hide your real email address, in which case we receive a private relay address.
• Sports data providers. We license NFL player, game, statistics, projection, odds, and news data from third-party sports data providers. This data is about professional athletes and games, not about you.

We do not buy personal information about you from data brokers, and we do not collect precise geolocation, contacts, photos (other than an image you deliberately upload), microphone, or health data.

3. How we use information

• To create and secure your account, verify your email or phone number, and authenticate you when you sign in.
• To operate the game: run weekly drafts, process waivers and trades, score matchups, maintain graveyards and revives, run playoffs, and keep standings and history.
• To display your profile, team, and results to your league-mates as described in Section 5.
• To deliver push notifications and in-app notifications you have enabled.
• To provide customer support and to respond to your support, data access, and deletion requests.
• To process purchases, manage subscriptions and renewals, issue refunds, and keep the accounting and tax records those transactions require.
• To understand how the Service is used, measure retention and engagement, and improve and develop features. This relies on product analytics, which you can decline or turn off at any time (Section 4).
• To diagnose crashes and keep the app stable. This relies on crash reporting, which is always on (Section 4).
• To protect the Service and our users — preventing cheating, spam, abuse, fraud, and unauthorized access, and enforcing our Terms of Service.
• To send you service and transactional messages: verification codes, security notices, draft reminders, waiver results, trade offers, and changes to this policy. These are required to operate the Service and cannot be turned off while you have an account.
• To send you product and marketing email about new features, seasons, and announcements. This is on by default and you can turn it off at any time in Settings ▸ Privacy ▸ Communications, or through the unsubscribe link in any marketing message.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

4. Analytics, crash reporting, and your consent

FantasyX runs two separate telemetry systems, and they are treated differently. It is worth being clear about which is which.

4.1 Product analytics — your choice

The first time you open the FantasyX app you are shown a consent card asking whether you are willing to share usage analytics. The PostHog SDK is not initialized until you answer, and it is only initialized if you accept. A first-run user who has not answered and a user who declined are treated identically: no SDK, no events, no analytics cookies.

Your answer is stored on your device and mirrored to your account, so it follows you to a new device. The account-level setting can only force analytics off; it never turns analytics on for you.

You can change your answer at any time in Settings ▸ Privacy ▸ "Usage analytics." Turning it back on resumes collection from that point forward; it does not send historical events.

How PostHog is configured matters as much as whether it is on. Session replay, autocapture, and person profiles are all turned off, so we do not record your screen, your taps, or your keystrokes, and we do not build a stored profile of you in PostHog. IP addresses are anonymized: the raw IP is discarded rather than stored, after being used to derive the approximate location described in Section 2.2. If we turn any of these on in future, we will update this policy first.

4.2 Crash reporting — always on

Firebase Crashlytics is not covered by the analytics setting and cannot be turned off in the app. It collects only diagnostic information about failures — stack traces, device model, OS and app version, breadcrumb logs, and your user ID so we can tell whether a crash hit one account or thousands. It never receives your league, profile, or chat content, and it is not used for product measurement or marketing. This distinction is also stated in the app's Privacy Settings screen so it is visible at the point you make the choice.

Declining analytics also does not disable push notifications you have enabled, or the server logs necessary to run and secure the Service.

4.3 Marketing email

Product and marketing email is on by default and is governed by a separate setting at Settings ▸ Privacy ▸ Communications. Turning it off stops marketing email but not transactional messages, which are required to operate your leagues.

5. What other users can see

FantasyX is a multiplayer product, so some information is visible to other people by design:

• League-mates can see your display name, avatar, team name, roster, draft picks, transactions, graveyard, matchup results, standings position, and anything you post in league chat.
• Anyone with a link to your public profile page can see your display name, avatar, and — unless you turn off the "Public profile" setting — your career record and team history. Turning that setting off hides career record and team history from anyone who is not in a league with you.
• League chat content is visible to everyone in that league and is retained as part of the league's history. Do not post information in chat that you would not want your league-mates to keep.

Your email address and phone number are never displayed to other users.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as described below.

6.1 Service providers

We use the following providers to run the Service. Each processes personal information on our behalf under contract and is not permitted to use it for its own purposes.

6.2 Other disclosures

• Legal and safety. We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of FantasyX, our users, or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
• With your direction. When you choose to share content — for example by sharing a matchup or invite link outside the app.

7. Data retention and account deletion

We keep personal information for as long as your account is active and for as long as needed to provide the Service, and afterward only as long as necessary for the purposes described in this policy or as required by law.

7.1 Deleting your account

You can delete your account at any time from Settings ▸ Account ▸ Delete Account, behind a typed confirmation. Deletion is immediate and synchronous. There is no grace period, no soft-delete queue, and no recovery window — once it runs, the data described below is gone.

• Account and profile data. Your profile, sign-in credentials and linked identities, sessions, chat messages, reactions, poll votes, notifications and notification preferences, device tokens (which stops all push immediately), watchlist, cheat-sheet entries, waitlist signup, avatar image, and support attachments are hard-deleted.
• League and gameplay records. Because a league is a shared record, your team, draft picks, transactions, and match results are retained in de-identified form so your league-mates' history and standings stay intact and correct. Your team appears as "Former Manager" and is no longer linked to you or to any personal data.
• Leagues in progress. Your remaining scheduled matchups become byes, which the standings math scores as automatic wins for your opponents. Weeks already played keep their real results. Pending waiver claims, revive requests, and draft queue entries are cancelled. In a league that has not started, your team is removed outright.
• Leagues you commissioned. Commissioner duties are handed to another manager in that league. If you were the last manager, the league is torn down entirely.

7.2 Retention periods

• Account and profile data: retained until you delete your account, then deleted immediately.
• League and gameplay records: retained de-identified for the life of the league so league history survives.
• League chat messages: deleted with your account, along with your reactions and poll votes. Polls you created are removed together with their votes.
• Support requests: the stored support record is stripped of your user ID, name, and email address when you delete your account, but the copy delivered to our support inbox by email is not automatically deleted and may be retained as a business record for 24 months, at which point it is permanently expunged.
• Purchase and transaction records: retained for 7 years after the transaction to meet tax, accounting, and audit obligations, even after account deletion.
• Analytics events: collected only if you accepted analytics, and retained by PostHog under our project's retention setting. PostHog’s default setting retains user data for 7 years.
• Crash reports: retained by Firebase Crashlytics for its standard retention period, currently 90 days for crash data.
• Backups: deleted data may persist in encrypted backups for up to 30 days before being overwritten.
• Waitlist sign-ups: the email address you give on fantasyx.net is kept for 3 months and then deleted. If the launch notification has already been sent, it is deleted sooner.

8. Cookies and similar technologies

The FantasyX mobile apps do not use cookies. They use local device storage for your preferences and session, and the analytics SDK described in Section 2.2.

The web app and the marketing site use cookies and similar browser storage for: (a) strictly necessary purposes such as keeping you signed in and maintaining security; and (b) analytics, only if you have accepted analytics. We do not use advertising cookies.

8.1 What the web app stores (app.fantasyx.net)

• sb-<ref>-auth-token — localStorage. Your sign-in session. Kept until sign-out or token expiry.
• flutter.* — localStorage. App preferences, including your analytics choice. Kept until cleared.
• ph_<key>_posthog — cookie. Analytics identity. 365 days. Set only after you accept analytics.
• __ph_opt_in_out_* — localStorage. Records your opt-out.

No analytics storage is written before consent. fantasyx.net (the marketing site) is static HTML and sets no cookies at all.

No consent banner is deployed on either: the in-app consent prompt shown on first use serves that purpose.

8.2 Global Privacy Control

The web app honors Global Privacy Control. When your browser sends a GPC signal (or legacy Do Not Track), analytics stays off and cannot be enabled for that browser. GPC is a browser signal and does not apply to the iOS/Android apps, where the same choice is made through the in-app consent prompt.

9. Your choices

• Access a copy of your data. Settings ▸ Privacy ▸ "Request a copy of my data." We will respond within 7 days.
• Correct your information. Edit your display name and avatar in Settings ▸ Edit Profile, and your email or phone in Settings ▸ Contact Info.
• Delete your account. Settings ▸ Account ▸ Delete Account. See Section 7.1 for exactly what is deleted and what is retained in de-identified form.
• Opt out of analytics. Settings ▸ Privacy ▸ "Usage analytics," or send a Global Privacy Control signal from your browser on the web.
• Control profile visibility. Settings ▸ Privacy ▸ "Public profile."
• Control notifications. Settings ▸ Notifications, and your device's operating system settings.
• Unsubscribe from marketing email. Settings ▸ Privacy ▸ Communications, or the unsubscribe link in any marketing message. You cannot opt out of transactional messages while you have an account.
• Crash reporting cannot be turned off. See Section 4.2 for what it collects and why.

10. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS/TLS), encryption at rest at our hosting providers, row-level security policies restricting database access to authorized users, one-time-code verification for email and phone changes, and optional biometric app lock on your device.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulators as required by applicable law.

11. Children's privacy

The Service is not directed to children, and you must be at least 13 years old to create an account. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. Parents or guardians who believe their child has provided us with personal information may contact us at [email protected].

12. Your California privacy rights

This section applies to California residents under the California Consumer Privacy Act, as amended (CCPA/CPRA).

12.1 Categories of personal information

In the past 12 months we have collected the following categories of personal information. The sources are you, your device, and our sign-in and service providers. The business purposes are those described in Section 3, and the categories of recipients are the service providers listed in Section 6.1.

12.2 Sale and sharing

We have not sold personal information and have not shared personal information for cross-context behavioral advertising in the past 12 months, and we do not do so today. We do not sell or share the personal information of minors under 16.

12.3 Your rights

• Right to know what personal information we have collected, used, disclosed, and the categories of sources and recipients.
• Right to access a portable copy of your personal information.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to legal exceptions.
• Right to opt out of sale or sharing (we do neither).
• Right to limit use of sensitive personal information (we do not collect it for purposes requiring this).
• Right not to be discriminated against for exercising these rights.

To exercise these rights, use the in-app controls in Section 9 or email [email protected]. We will verify your request by confirming control of the email address or phone number on your account. An authorized agent may submit a request on your behalf with written permission and proof of identity. We respond within 45 days, extendable by another 45 days with notice.

California's "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing purposes.

13. Other U.S. state privacy rights

Residents of U.S. states with comprehensive consumer privacy laws have rights to confirm whether we process their personal data, access and obtain a copy of it, correct it, delete it, and opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale of personal data, or profiling with legal or similarly significant effects.

To exercise these rights, use the in-app controls or email [email protected]. If we deny your request, you may appeal by replying to our response; we will respond to appeals within 45 days and tell you how to contact your state attorney general if you disagree.

Nevada residents may submit a request not to sell covered information to [email protected]. We do not sell covered information.

14. Users outside the United States

The Service is operated from the United States and is intended for users in the United States. Personal information is stored and processed in the United States, where privacy laws may differ from those in your country.

15. Third-party links and services

The Service may link to third-party sites or content, including news articles, sports data sources, and GIFs served by Klipy. We are not responsible for the privacy practices of those third parties, and this policy does not cover them.

16. App store disclosures

Apple's App Store and Google Play require us to publish data-collection disclosures (Apple's App Privacy labels and Google Play's Data Safety form). Those disclosures describe the same practices as this policy. If you find an inconsistency, this policy governs, and we ask that you tell us at [email protected] so we can correct it.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, provide additional notice — for example an in-app notice or an email to the address on your account — before the change takes effect. Your continued use of the Service after the effective date means you accept the updated policy.

18. Contact us

Questions, requests, or complaints about this policy or your personal information:

• Support: [email protected] or the in-app support form
• Postal address: FantasyX, Inc., 110 E 35th St, New York, NY 10016