Privacy Policy
Last updated: October 16, 2026
The Field Report ("we", "us", "the app") is a fantasy football league analytics platform. Alongside league analytics, the app includes informational sports betting and odds features — such as the odds board, betting lines, and market comparisons. These betting features are provided for informational and entertainment purposes only. The app does not accept, place, process, or facilitate any wagers, and no money changes hands through the app. This policy explains what personal data we collect, why we collect it, how we process it, and what rights you have.
1. Personal Data We Collect
| Category | Data Points | Source |
|---|---|---|
| Account identity | Email, display name, avatar URL | Discord OAuth |
| League identity | Sleeper username, Sleeper user ID | User input / Sleeper API |
| Authentication | JWT session tokens, Supabase Auth (Discord OAuth) session cookies | User input |
| Network | IP addresses (rate limiting) | Automatic |
| Preferences | Dashboard preferences, draft notes, saved bet slips and odds/board settings (stored locally on your device unless synced to your account) | User input |
| Usage analytics | Page views and feature interactions (including use of the informational odds and betting board) | Automatic (Vercel Analytics / Speed Insights) |
| Diagnostics | Behavioral breadcrumbs, error telemetry, session replays (Sentry) | Automatic (consent required) |
2. Legal Basis for Processing
- Legitimate interest — Core functionality: authenticating users, fetching league data, computing analytics, and rate limiting to protect the service.
- Consent — Analytics and telemetry (Sentry error tracking, session replays). These are only activated after you accept non-essential cookies via our consent banner.
3. Third-Party Processors
| Processor | Purpose | Location |
|---|---|---|
| Sentry | Error tracking, performance monitoring, session replays | United States |
| Anthropic | AI-powered features (weekly recaps, waiver advice, matchup previews) | United States |
| Discord | OAuth authentication | United States |
| Supabase | Authentication and database (user accounts, preferences, career stats, league documents) | European Union |
| Sports odds and prediction-market data providers | Public odds and market prices, fetched by our servers | Varies by provider |
| Resend | Transactional email (e.g., commissioner alerts and account-related notifications) | United States |
| OpenAI | Optional image generation (lead story hero images) | United States |
| Sleeper API | League data (rosters, matchups, standings) | United States |
| Vercel | Hosting and edge functions | United States |
| Vercel Analytics / Speed Insights | Aggregate product usage analytics and performance metrics | United States |
Odds, lines, and betting-market data displayed in the app are supplied by third-party providers and are shown for informational purposes only. Because the app does not accept or place wagers, we do not collect payment details, wager amounts, or gambling-account information.
4. Data Retention
- Session tokens (JWT) — 7 days, then automatically expire.
- Redis cache — 7–14 days (rate limiting and API response caches).
- Database records — Retained until you request deletion. You can delete your account at any time from the Settings page.
- Sentry data — Retained per Sentry's default retention policy (90 days).
5. Your Rights
Under GDPR and applicable privacy laws, you have the right to:
- Access — Request a copy of all personal data we hold about you. Use the "Download My Data" button in Settings.
- Export / Portability — Download your data in a structured, machine-readable JSON format via the data export endpoint.
- Deletion — Delete your account and all associated data. Use the "Delete My Account" button in Settings.
- Objection — Object to processing based on legitimate interest. Contact the league commissioner.
- Withdraw consent — You can change your cookie preferences at any time by clearing the
flt_consentcookie and reloading the page.
6. Cookies
| Cookie | Type | Purpose |
|---|---|---|
| ffa_session | Essential | JWT session authentication |
| sb-* | Essential | Supabase authentication tokens |
| flt_consent | Essential | Records your cookie consent preference |
| Sentry cookies | Analytics (consent required) | Error tracking and session replay |
7. International Data Transfers
Some of our processors are located in the United States. Where personal data is transferred outside the European Economic Area (EEA), we rely on the following legal mechanisms to ensure adequate protection:
| Processor | Location | Transfer Mechanism |
|---|---|---|
| Vercel (including Vercel Analytics and Speed Insights) | United States | EU-US Data Privacy Framework (DPF) certified; SCCs as backup |
| Sentry | United States | Standard Contractual Clauses (SCCs) |
| Anthropic | United States | Standard Contractual Clauses (SCCs) |
| Discord | United States | EU-US Data Privacy Framework (DPF) certified; SCCs as backup |
| OpenAI | United States | Standard Contractual Clauses (SCCs) |
| Sleeper API | United States | Standard Contractual Clauses (SCCs) |
| Resend | United States | Standard Contractual Clauses (SCCs), per Resend's DPA |
| Sports odds and prediction-market data providers | Varies by provider | Not applicable — no personal data is sent |
| Supabase | European Union | No cross-border transfer required (EU-hosted) |
- EU-US Data Privacy Framework (DPF) — Where a processor is certified under the EU-US DPF, we rely on that framework as the primary transfer mechanism.
- Standard Contractual Clauses (SCCs) — For processors not certified under the DPF, or as a supplementary safeguard, we rely on the European Commission's Standard Contractual Clauses (EU 2021/914).
- Requesting copies — You may request copies of the relevant Data Processing Agreements (DPAs) and SCCs by contacting the league commissioner through the Discord server or the in-app messaging system.
8. Contact
For any privacy-related questions, data requests, or concerns, please contact the league commissioner through the league's Discord server or via the in-app messaging system.
9. Changes to This Policy
We may update this privacy policy from time to time. Material changes will be communicated via the league Discord server and/or an in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.