Privacy Policy

Who we are

FanPoolHQ is operated by FanPoolHQ, based in Québec, Canada.

Person in charge of the protection of personal information (Privacy Officer): Steve Caya. Contact: support@fanpoolhq.com

Use of the service is also governed by our Terms of Service.

Information we collect

• Account: email address, an optional name, a securely hashed password (for password sign-in), your language, and an optional bio and avatar. If you sign in with Google, we receive your Google profile name, email address and profile image.
• Terms acceptance: the date you accepted our Terms and the version you accepted.
• Activity timestamps: when you last signed in and were last active. These are shown to the commissioner of your leagues.
• League data you create: teams, rosters, trades, drafts, pools, settings and related activity.
• Content you post: forum posts, comments, announcements and messages.
• Support tickets you send us and our replies.
• League invitations: the email address a commissioner enters to invite someone who does not have an account yet.
• ESPN / Yahoo import credentials: encrypted, used only to perform the import, and deleted when the import ends — within 24 hours at most.
• Technical data: your IP address is used transiently for rate limiting and security and is not stored in our database. Error reports contain technical details about the failure.

Who can see your information

• Members of your leagues see your display name, avatar and team.
• Your email address is visible to the commissioners of leagues you belong to, not to other members.
• If a commissioner makes a league or pool public, your display name, avatar and team appear on public pages that anyone can view.
• Forum posts are visible to all signed-in users.
• A commissioner can connect a Discord webhook that posts league activity (display names, team and player names) to their Discord server.

Why we use it

To operate the service and your leagues; to authenticate you; to send transactional emails (verification, password reset) and the notification emails you control in your settings; to protect the service against fraud, abuse and security threats; to monitor and fix errors; and, only with your consent, to measure usage (analytics) and show advertising.

We do not sell your personal information.

Cookies and similar technologies

Strictly necessary: keep you signed in, secure your session and remember basic preferences (theme, language, active league). These are always active because the site cannot function without them.

Analytics (only with your consent): PostHog and Google Analytics 4 help us understand how the app is used so we can improve it. PostHog also records sessions — the pages you visit, where you click and scroll — so we can see where people get stuck. Anything typed into a form field is masked and never recorded.

Error monitoring: Sentry receives error reports tagged with a random user identifier (no name or email). It does not record sessions.

Advertising (only with your consent): Google AdSense on public pages and for members of free leagues.

We use Google Consent Mode with every category denied by default until you choose. Fonts are served from our own domain, so no font request reaches Google.

Google AdSense and third-party advertising

We use Google AdSense to display advertisements. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.

Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

You can opt out of personalized advertising by visiting Google Ads Settings, and you can opt out of a third-party vendor’s use of cookies for personalized advertising at aboutads.info. Where required, we serve non-personalized ads by default until you consent.

Service providers

We use these providers (processors) to run FanPoolHQ. Each receives only what it needs for its purpose.

• Vercel — hosting and file storage for avatars and logos (United States). Uploaded images are served from public URLs.
• Neon — database (United States).
• Upstash — cache and rate limiting (United States).
• Resend — email delivery (United States).
• Pusher — real-time draft updates (United States).
• Sentry — error monitoring (United States).
• PostHog — analytics and session recording, with consent (United States).
• Google — Analytics and AdSense with consent, and Google Sign-In if you use it (United States).
• Discord — only if your commissioner connects a webhook.
• ESPN / Yahoo — only if you use a league import.

Transfers outside Québec and Canada

Your information is stored and processed in the United States. Before transferring it we assessed the transfer (privacy impact assessment) and rely on the contractual data-protection commitments of our providers. Information held in the United States may be accessed by authorities there under US law.

How long we keep it

• Account data: while your account is active.
• Import credentials: 24 hours at most. Import jobs: 30 days.
• Expired league invitations: 90 days.
• Email delivery logs: 365 days. Notifications: 365 days.
• Deleted accounts are anonymized immediately: name, email, avatar and bio are removed. Content you posted in leagues and the forum remains, attributed to “Deleted user”, to preserve league history.
• Email addresses that opted out of our emails are kept on a do-not-email list so we can keep honouring the opt-out.
• Backups roll off on our providers’ schedules.

Your rights

• Access the personal information we hold about you, and have it corrected.
• Withdraw your consent, including for cookies (button below).
• Delete your account yourself: Settings → Account → Delete account.
• Data portability: Settings → Account → Download my data (JSON).
• Ask us to stop disseminating your information or to de-index any hyperlink attached to your name (Law 25).

To exercise a right, email support@fanpoolhq.com. We respond within 30 days.

You can also complain to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

Children

FanPoolHQ is not intended for anyone under 14. If we learn that we collected information from a child under 14 without parental consent, we delete it.

Email

Transactional emails (verification, password reset, security notices) are part of the service. Notification emails are optional and controlled in your settings; every notification email includes a one-click unsubscribe link. Invitations sent to people without an account include a link to never be emailed by us again.

Security and confidentiality incidents

We protect your information with encrypted connections, hashed passwords, encrypted import credentials and access controls. We keep a register of confidentiality incidents and, where an incident presents a risk of serious injury, we notify the Commission d’accès à l’information and the people affected.

Changes to this policy

We will post any change on this page with a new date. For material changes we will notify you and ask you to review them on your next visit.