Legal
Privacy Policy
This page says what data BetFantasy.ai holds, why it holds it, and how to get rid of it. It describes the site as it is built today, not what it might do later.
Effective
Who we are
BetFantasy.ai is operated by Obsidian Ridge Holdings, LLC, based in Sheridan, Wyoming, United States. We are the party responsible for the data described on this page. Questions and requests go to privacy@betfantasy.ai.
BetFantasy.ai is a fantasy football draft assistant. It is not a sportsbook, it accepts no wagers, and it holds no money. We collect no payment details of any kind, because there is nothing to pay for.
What we collect
| Category | Examples | Why we hold it | How long |
|---|---|---|---|
| Draft data | League settings, your picks, drafted flags, board preferences | So the board you built is still there when you come back | Until you delete the draft or the session behind it |
| Account details (optional) | Email address, display name, and a password hash held by Supabase | To sign you in and keep your drafts attached to you across devices | Until you delete the account |
| Anonymous session | A Supabase user id with no email, name, or password attached | To give a signed-out visitor owner-only access to their own draft | Until the session is cleared or the draft is deleted |
| Consent choice | The bf_consent cookie: granted or denied, plus the timestamp | To honour your analytics choice and to avoid asking again on every visit | 180 days, then we ask again |
| Analytics events (only after you accept) | Page views, referrer, approximate location, device and browser, the _ga cookie ids | To count visits and see which pages people actually use | GA4 defaults: cookies 2 years, event data 14 months |
| Email you send us | Your address and whatever you write to support or privacy | To answer you | Until the thread is closed and no longer useful |
We do not collect payment data, government identifiers, precise location, or contact lists. We do not buy data about you from anyone, and we do not sell or share your data for advertising. There are no ads, affiliates, or sponsors on this site.
Anonymous sessions
A draft is a lot of work to rebuild, so it has to belong to someone. When you first do something in the app, such as changing league settings or marking a player drafted, we mint an anonymous Supabase session for you. It is a user id with nothing attached to it: no email, no name, no password. Your draft rows are then locked to that id by database row-level security, so only your session can read or change them.
The session is created on your first interaction with the app, not when a page loads. Reading this page, the home page, or any other marketing or legal page sets no session cookie at all.
If you later create an account, the same draft data carries over to it. If you delete the draft, or clear the session cookie without ever creating an account, the anonymous id has nothing left behind it and the data is gone with it.
Analytics
We use Google Analytics 4, loaded through Google Tag Manager. Tag Manager is the only analytics transport in the browser; nothing else measures you, and there is no second tracker running behind it.
Analytics is denied by default, everywhere, for everyone. Until you accept, Tag Manager is not loaded, no request is made to Google, and no analytics cookie exists on your device. That is Google Consent Mode running in its basic form: the tags do not fire at all rather than firing in a reduced mode. Accepting sets the choice in a first-party cookie named bf_consent, described on the cookie policy.
When analytics is on, GA4 records page views and basic technical context: referrer, device, browser, and an approximate location. Google derives that location from your IP address and does not log or store the address itself. We have not enabled Google Signals, ads personalisation, remarketing, or any advertising integration, so nothing measured here is used to target you.
You can change your mind at any time from Cookie settings, and turning analytics off stops the tags loading on your next page view.
Third parties
- Supabase hosts the database and the authentication system. Your league settings, picks, and account details live there.
- Cloudflare hosts and serves the site. It sees the normal request data any web host sees, including IP addresses, for delivery and abuse prevention. Its Turnstile service also runs the “are you a bot” check on our forms, which sends Cloudflare your IP address, browser, and the page you were on.
- Google provides Analytics and Tag Manager, and receives nothing until you accept analytics.
- Resend delivers our email. That means account emails such as sign-up confirmations and password resets, and — if you use the form on the contact page — the message you wrote and the address you gave us, so we can reply to it.
That is the whole list. We read public ADP and sportsbook data from other providers to build the board, but we send them nothing about you.
Your rights
You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. You can withdraw analytics consent at any time without giving a reason, and doing so does not affect anything else on the site.
- Analytics: use Cookie settings in the footer, or the link on the cookie policy.
- Account and draft data: delete them from your account page, or email us and we will do it.
- Everything else: email privacy@betfantasy.ai. We answer from the address you write from, so we do not need any other identification.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out of either to offer you.
Children
BetFantasy.ai is not directed to children. You must be at least 13 years old to use it. We do not knowingly collect data from anyone under 13; if you believe a child has given us data, write to privacy@betfantasy.ai and we will delete it.
Security
The site is served over HTTPS. Draft and account rows are protected by row-level security, so a session can only reach its own data. Passwords are handled entirely by Supabase authentication and are never visible to us. No system is perfectly secure, and we would rather say that plainly than promise otherwise.
Where your data is
Our hosting and database providers operate in the United States, and our audience is primarily in the United States. The site is reachable worldwide. If you use it from outside the US, your data is processed in the US under this policy.
Changes to this policy
If we change what we collect or who we send it to, we update this page and move the effective date at the top. Material changes to analytics reset your consent choice, so you get asked again rather than being opted in quietly.
Contact
Privacy requests: privacy@betfantasy.ai. Everything else: support@betfantasy.ai. See also the cookie policy and the terms of service.