LEGAL

PRIVACY POLICY

Last updated: September 2026

PointStack Fantasy Hub, LLC ("PointStack," "we," "us," or "our") operates the PointStack web application. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

The short version: we collect only what's necessary to run the service. We don't sell your data. If you connect a Yahoo Fantasy account, we use Yahoo's official API to sync your league, roster, matchup, and scoring settings, and we store the OAuth access/refresh tokens Yahoo issues for that connection — never your Yahoo password. For every other platform, PointStack is manual entry — you enter your leagues, rosters, DFS lineups, and prop bets yourself. Either way, we pull live NFL stats from our sports-data provider to score your entries for you. We use Google Analytics site-wide and some free public pages display third-party ads — see "Analytics, Advertising & Cookies" below.

INFORMATION WE COLLECT

When you create an account and use PointStack, we collect:

Account information — your email address, password (hashed, never stored in plaintext), and optional display name
League, roster, and matchup data you enter — team names, roster slots, and player selections you manually add for each league you track
Yahoo Fantasy account data (if you connect Yahoo) — if you choose to connect a Yahoo Fantasy account, we receive an OAuth access token and refresh token from Yahoo (never your Yahoo password) and use them to pull your league name, roster, matchup, and scoring settings from Yahoo's API
DFS lineups and prop bets you enter — player selections, salary/slot info, prop lines and directions, and the odds and bet amounts you optionally log to track profit/loss. For DFS, this also includes contest results you enter or import — rank, percentile, buy-in, and payout.
Payment information — we use Stripe to process payments. We store only your Stripe customer ID. Card numbers and billing details are handled entirely by Stripe and never touch our servers.
Usage data — basic server logs (request timestamps, errors), plus site analytics collected via Google Analytics (see "Advertising & Cookies" below).

If you sign up for the waitlist, we collect only your email address.

HOW WE USE YOUR INFORMATION

To authenticate you and maintain your session
To display the leagues, rosters, DFS lineups, and prop bets you've entered or connected — manually, or synced from Yahoo Fantasy — and to match the players in them against live NFL stats from our sports-data provider so you can track scoring in real time
If you connect Yahoo, to authenticate with Yahoo's API on your behalf and refresh your access token when it expires, so your synced league keeps updating without you having to reconnect
To process your one-time payment and verify your subscription status
To send transactional emails (account confirmation, payment receipts, pre-season reminders). We do not send marketing email without your explicit opt-in.

HOW WE STORE YOUR INFORMATION

Account data and the league/roster/DFS/prop data you enter are stored in Supabase, a managed database platform with encryption at rest and in transit. If you connect Yahoo, your OAuth access and refresh tokens are stored there as well, so we can keep your synced league up to date without asking you to reconnect every session.

Payments are processed by Stripe. Their privacy policy governs how they handle your billing information.

Transactional emails are sent via Resend. Your email address is passed to Resend solely for the purpose of delivering that message.

Live player and game stats used to score your entries are provided by a licensed sports-data provider. We do not send your personal account information to this provider — only the player/team identifiers needed to look up stats.

If you upload a DraftKings contest-standings CSV to log a DFS result, that file is parsed entirely in your browser. It typically contains other contest entrants' display names and ranks — we use that data only on your device, to calculate your own rank, percentile, and player-ownership stats. We never upload the file itself or other entrants' data to our servers; only your own result (rank, percentile, buy-in, payout) is saved.

ANALYTICS, ADVERTISING & COOKIES

We use Google Analytics across pointstack.app to understand how visitors use the site — pages viewed, general location, device/browser type, and referral source. Google Analytics uses cookies and similar technologies to collect this data. We do not use it to identify you individually, and it is not linked to your PointStack account.

Certain free, public pages (such as our Rankings and NFL Games pages) also display ads served by Google AdSense. Google and its partners may use cookies to serve ads based on your prior visits to this or other websites. The logged-in dashboard does not display third-party ads.

You can learn more about how Google uses this data, and manage your ad personalization and analytics settings, at Google's Ads Policy page and via the Google Analytics Opt-out Browser Add-on.

FANTASY PLATFORM DATA

Yahoo Fantasy: if you click "Connect Yahoo," you're sent to Yahoo to sign in and authorize PointStack through Yahoo's official Fantasy Sports API. We never see or store your Yahoo password. Yahoo issues us an OAuth access token and refresh token, which we store to fetch your league, roster, matchup, and scoring settings on your behalf and keep them updated. You can disconnect a synced Yahoo league at any time from the Manage Leagues panel, which removes the connection and its stored tokens.

Other platforms: PointStack does not connect to, log into, or sync with Sleeper, ESPN, Fantrax, CBS Sports Fantasy, or any DFS or sportsbook platform on your behalf, and we do not store any login credentials, cookies, or OAuth tokens for those platforms. Any league, roster, lineup, or prop data from those platforms displayed in PointStack is data you entered yourself.

PointStack is an independent tool and is not affiliated with, endorsed by, or sponsored by Sleeper, ESPN, Yahoo, Fantrax, CBS Sports, any DFS operator, any sportsbook, or any of their parent companies. Fantasy data for synced Yahoo leagues is provided by Yahoo Fantasy.

DATA SHARING

We do not sell, rent, or trade your personal information. The only third parties that receive your data are the infrastructure services necessary to operate PointStack (Supabase, Stripe, Resend, our sports-data provider), Yahoo's Fantasy Sports API (only if you connect a Yahoo account, and only your OAuth token — never your PointStack password or other account data), Google Analytics, and the ad services on our free public pages (Google AdSense), each only to the extent required for those services to function.

DATA RETENTION

Your account data is retained while your account is active. If you delete your account, your data is removed within 30 days. Stripe retains payment records per their own retention policies and applicable financial regulations.

YOUR CHOICES

Remove a league, lineup, or prop — you can remove any manually entered league, DFS lineup, or prop bet at any time from the Manage Leagues panel or the relevant tracker.
Disconnect Yahoo — you can disconnect a synced Yahoo league at any time from the Manage Leagues panel, which deletes the stored OAuth tokens for that connection.
Delete your account — email us at support@pointstack.app and we will delete your account and associated data.
Access your data — you may request a copy of the data we hold about you by emailing us.

CHILDREN'S PRIVACY

PointStack is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

CHANGES TO THIS POLICY

We may update this policy as the service evolves. We will post the updated policy here with a revised date. Continued use of PointStack after changes constitutes acceptance of the updated policy.

CONTACT

Questions about this policy? Email us at support@pointstack.app.