The fine print
Privacy Policy
Last updated September 8, 2026
What this is
Duffy Sports Club is a private, invite-only beta for playing fantasy sports formats among friends. There are no ads, no payments, and no public product. Nobody is buying your data, because there is nobody to sell it to.
Your account
Signing up with an email address stores that address and a hashed password in Supabase Auth. We never see the password itself.
Signing in with Google instead gives us the email address, name and profile picture from your basic Google profile. That is all. No access to Gmail, Drive, contacts, calendars, or anything else you own.
What your leagues store
The stuff a league needs to work: your display name, any per-league name you set, which leagues you are in, your drafts, picks, rosters, lineups, trades and steals, scores and standings.
We also keep a “last seen” timestamp so a live draft room can show who is actually sitting in it.
Where it lives
The database and the authentication service are run by Supabase on AWS in the US East region. The site itself is hosted by Vercel in the US. Both keep operational server logs, and those logs include IP addresses.
No analytics, no trackers
There is no analytics package on this site. No advertising, no third-party cookies, no session recording, no pixels. The app's only dependencies are Next.js, React and Supabase's client libraries.
The one cookie is the one that keeps you signed in.
NFL data flows one way
We fetch public scores, stats and projections from Sleeper and ESPN to run scoring. That traffic goes out asking about football games. We never send either of them anything about you.
One thing worth saying plainly
Player photos load from sleepercdn.com and team logos from a.espncdn.com. That means your browser talks to those services directly whenever a page shows a headshot or a logo, and they can see your IP address and browser the same way any embedded image would. We don't control what they log.
Who can see your data
The people in your leagues see your display name and how your teams are doing. That is the whole point of a league.
Nobody outside a league you have joined can see it. League pages are gated on membership by row-level security in the database, not just by hiding a link.
Keeping it and deleting it
Your data stays as long as your account does. Email the address below and we will delete the account and the data attached to it.
Children
This is not intended for anyone under 13.
Changes
Any change gets posted on this page with a new date at the top.