Privacy Notice

What we collect

We collect and keep only what the service needs to run and to understand how the beta is used:

• Your account: username, email address, the invite link you joined with, when you joined and last signed in, and that you confirmed the age requirement and accepted these notices (with their date). Your password is stored only as a salted scrypt hash, never in plain text, and never reaches the computer that stores your account.
• The lineups you build and the choices behind them: the slate and contest, strategy preset, number of lineups, and any players you lock, exclude or limit.
• A history of your builds, so you can see them later: the lineups, their projected points, and, once games finish, actual points. If a lineup exactly matches an entry in that contest’s published results, we also record where it finished and any winnings shown there.
• DraftKings entry files (DKEntries.csv) that you choose to upload. The file is processed to produce the export or late-swap file you download. We do not intentionally save the uploaded file.
• Usage records: which pages of the site you open and which actions you take (signing in, building lineups, exporting or late-swapping), each with the time and your username. We use them to see whether the beta is being used and to find and fix problems. They are collected by the site itself, not by any analytics company, and page addresses are recorded without their query strings.
• Basic server logs. For each request they record your username, the request method and path, the response status and timing. Sign-in attempts are logged; when a failed attempt uses a name we do not recognise, we log only a short fingerprint of it. Our hosting provider may also record IP addresses. We use IP addresses for sign-in, sign-up and request rate limiting, which is held in memory and not stored by us.
• Preferences saved in your own browser (for example the slate date, display density, and your locks and exclusions for a slate). These stay on your device and are not sent to us until you build.

How we use it

To run your account and build your lineups; to email you what your account needs (a welcome message when you join, and password-reset links you ask for); to understand how the beta is used and improve it; and to keep the service secure. We do not send marketing email during the beta.

Where it is stored

The website runs on Railway. Requests from the website are relayed through a Cloudflare tunnel to the operator’s own computer, which runs the projection and optimizer service and stores your account, your usage records and your builds under your username. Your build history is kept in a database that is either hosted by Railway or on the operator’s computer. The operator can access the data stored under your account.

We do not use advertising or third-party analytics or tracking scripts, and the site loads no third-party scripts.

Payments

The beta is free and we collect no payment details. If paid plans are introduced, payments will be handled by Stripe: you would enter card details on Stripe’s own page, and we would receive only a record of the subscription (for example plan, status, and the card brand and last four digits), never your full card number. This notice will be updated before that happens.

Cookies

The site sets one cookie, a sign-in session cookie. It is signed, readable only by the server (not by page scripts), and lasts 12 hours. It holds your username, role, expiry time and account type, and nothing else. There are no advertising or tracking cookies; the usage records above rely on this same sign-in cookie and nothing more.

Who we share it with

We do not sell personal data. We do not share it for advertising. It is handled only by the providers that run the service for us: Railway (website hosting), Cloudflare (the tunnel to the operator’s computer), Resend (delivery of account emails; it receives your email address and the message) and, if paid plans launch, Stripe (payments). It may also be disclosed if the law requires it.

How long we keep it

Account data and build history are kept while your account is open. Usage records are kept for up to about 13 months, then deleted. Backups may hold copies for a further period.

Your choices

You can ask for a copy of your data, a correction, or for your account and data to be deleted by emailing support@tipofflab.com from the address on your account. We act on deletion requests within 30 days.

The service is for adults of legal age for paid fantasy contests where they live; it is not meant for anyone under 18.

Changes

We may update this notice as the service changes. The date at the top shows when it was last updated; significant changes will be shown on the site or emailed to you.

Contact

Questions, or want your data deleted? Email support@tipofflab.com (also the Contact link in the footer).