Privacy

HoopAgent is an independent tool. Not affiliated with or endorsed by ESPN, Disney or the NBA. HoopAgent is an invite-only beta that plans a fantasy basketball team in an ESPN league. This page says what it keeps about you. See also the beta terms.

• Your email and sign-in details, through our sign-in provider, to identify your account and send your daily notice.
• If you join the beta list on the landing page: your email and the date, until your invite or your request to delete it.
• Your league and team data from ESPN: league settings, team names, rosters, free agents, schedules and scores. A name you chose for your team or league is stored as it appears on ESPN.
• Your ESPN sign-in values (the espn_s2 and SWID cookies), only if you choose to connect a private league. They are kept encrypted in a secrets vault, separate from the rest of your data. Only the background job that reads your league can decrypt them, and every read is logged (the log records when, never the value). The sign-in step that stores them is still being built; today HoopAgent reads public leagues from a link, without cookies.
• Your settings: display name, time zone, goal, and whether you want notices by email or on the web.
• What HoopAgent produced for you: lineup plans, notices and whether an email was delivered or read.

Only to run HoopAgent for you: read your league, plan your lineup and waiver moves, show them, and email you the notice. If you approve a move, HoopAgent makes it on ESPN with your sign-in values, as in the terms. We do not use your data to train models.

You, and the people who run HoopAgent when they need to fix something. We do not sell your data, show ads, or share it for marketing. Other users never see your league, team or email. The one thing published about many users together is anonymous counts of how many leagues roster a player; it is shown only when at least 50 leagues are in the count, carries no league, team or user ids, and a per-league opt-out is planned; until it ships, ask us and we exclude your league. The page that shows these counts is not built yet.

Companies that handle data for us, and no one else:

• Supabase: database, sign-in and the encrypted vault.
• Vercel: the website. Our API host: the server that runs the plans (named here when the owner picks one).
• An email provider for notices (named here when chosen).
• PostHog (usage statistics) and Sentry (error reports), described below.
• ESPN itself receives requests for your league data, the same way your browser would.

• Your data stays while your account exists. League data fetched with your sign-in values is kept only while at least one member of that league has an account; a league will be deleted 7 days after its last member leaves (that cleanup job is still being built; until then we delete it by hand on request).
• Deleting your account removes your account, settings, notices, delivery records, invites, and the encrypted ESPN sign-in values and their vault copy. The database side is built and tested; the in-app delete button is still being built, so for now email the person who invited you to the beta and we delete it by hand.
• Disconnecting ESPN on its own deletes only the stored sign-in values.
• Daily database backups keep deleted data for up to 7 days (vault secrets inside a backup stay encrypted). The anonymous player counts above stay.
• You can also change your ESPN password to cut off any stored sign-in values at once.

The site sets no advertising or tracking cookies, and no cookies at all today. Accounts are still being built; when sign-in arrives it will use one session cookie that the site needs to work. A few settings, such as your last picked team and a flag that you already connected a league, are saved in your browser's local storage and are not sent to us.

We count page views and a few product events, such as connecting a league, to learn which parts of HoopAgent are used. Events carry the page path and simple flags only: no league names, team names, player names, ESPN links or login details.

No cookies and no tracking identifier are used for this. The one thing kept in your browser is a one-bit marker in local storage saying your first connected league was already reported, so that event is sent once; it holds no identifier and is not sent to us. We do not record sessions or screens, we do not build profiles of people, and your IP address is not stored. If your browser sends Do Not Track, nothing is sent.

When something breaks, the app and its server send an error report with the error message, the code location and the browser type. Cookies, request bodies and user details are removed before sending.

Questions, a copy of your data, or deletion: write to the person who invited you to the beta. If this page changes in a way that matters, we will say so in your next notice. This is a plain-language summary written without a lawyer; it is not legal advice.