Privacy Policy

Cuellar Labs LLC, a Texas limited liability company doing business as LeagueSaga (“LeagueSaga,” “we,” “us,” or “our”), operates LeagueSaga and is responsible for the personal information described in this policy.

1. Scope

This Privacy Policy applies to the LeagueSaga marketing site, product application, Import Helper, support channels, and related services. It does not control a third-party service, such as ESPN, Yahoo, Sleeper, Stripe, Slack, Discord, GroupMe, WhatsApp, GitHub, Cloudflare, or an AI provider. Read that service’s privacy policy before you use it.

2. Account and Contact Information

We collect your email address, display name, account status, preferences, and sign-in records. If you contact us, we receive your name, email address, message, and any information that you choose to send. Do not send passwords, access tokens, ESPN session values, or other secrets to support.

3. Fantasy League Information

We process league names, team names, member names or display names, avatars or logos, rosters, matchups, scores, settings, draft picks, transactions, trades, standings, and season history. We also process notes, rankings, draft boards, league messages, feedback, exports, and other content that users create.

A commissioner or league member can import information about other people in the league. The person who imports the league must have permission to do so and should tell league members that LeagueSaga will process their league information. League members can contact us if they want help with access, correction, or deletion.

4. Provider Connections

If you connect a provider, we process the identifiers and authorization details needed for the feature. Yahoo uses OAuth access and refresh tokens. Sleeper imports use public account and league identifiers and do not use a Sleeper password. Private ESPN imports can use ESPN session values. Saved provider credentials are encrypted and are limited to authorized league administrators.

We use provider information to find the leagues available to you, import selected history, refresh data, diagnose a failed import, and enforce league access. Provider terms can limit how this information may be used or retained. We may remove provider information or disable an integration to meet those requirements.

5. Import Helper

The LeagueSaga Import Helper uses a separate, non-persistent ESPN browser session on your computer. Your ESPN password is entered on ESPN’s site. Raw ESPN cookies stay in the helper and are not uploaded to LeagueSaga. The helper sends only the league information that you review and choose to upload. It can also contact GitHub’s public releases service to check for an update.

6. Billing and Transaction Information

Stripe processes payments and can collect your name, billing address, tax location, payment method, and transaction information. LeagueSaga receives customer, subscription, plan, status, invoice, and limited payment-event details. LeagueSaga does not store a complete payment-card number or card security code.

7. AI Information

If you use an AI feature, we can store your question or prompt, conversation history, generated response, feedback, facts and citations used in the response, model name, token counts, and technical quality records. To generate a response, LeagueSaga can send your prompt, recent conversation context, and relevant league facts to the AI provider configured for the Service, such as OpenAI, Google, or OpenRouter. Do not submit secrets or information that you are not authorized to share with that provider.

8. Messaging and Notification Information

If you connect Slack, Discord, GroupMe, WhatsApp, browser notifications, or a similar service, we process workspace, server, group, channel, thread, user, and installation identifiers; encrypted connection credentials; commands and message text; generated recaps or previews; delivery status; and error details. The connected service receives the content that you ask LeagueSaga to send.

9. Device, Security, and Usage Information

We collect request identifiers, dates and times, browser or device information, IP addresses in security audit records, hashed IP addresses in product analytics, feature events, success or failure status, and diagnostic details. We use this information to operate the Service, prevent abuse, investigate incidents, understand feature use, and improve reliability. We do not place advertising trackers on the marketing site.

The product can store sign-in state, preferences, and selected offline league snapshots in your browser. The Import Helper can store local settings and privacy-safe diagnostic logs on your computer. You can clear browser data or use the helper controls to remove local data.

10. Marketing Forms and Referrals

Contact forms collect the details that you enter. Referral forms collect the referrer’s name and email, the commissioner’s name and email, and optional league notes. Only give us another person’s contact details if you have permission. Hosted forms use Cloudflare Turnstile, which processes browser, device, and network signals to detect automated submissions. Form details are delivered to our email system and are not stored in a separate marketing database.

11. How We Use Information

We use information to:

• create accounts, authenticate users, and protect sessions;
• import, store, analyze, display, and export league history;
• provide AI, messaging, notification, and collaboration features;
• process trials, subscriptions, taxes, renewals, cancellations, and refunds;
• send service, security, support, and optional community communications;
• prevent fraud, enforce access rules, and investigate security events;
• measure and improve performance, reliability, and feature use; and
• comply with law and protect users, LeagueSaga, and others.

12. When We Disclose Information

We disclose information only as needed to:

• hosting, database, storage, email, monitoring, and security providers;
• Stripe for billing and tax functions;
• the provider that you connect, such as Yahoo or a messaging service;
• the configured AI provider when you use an AI feature;
• other members of your LeagueSaga league, based on their role and access;
• professional advisers, insurers, auditors, and transaction counterparties; and
• government authorities or other parties when law or safety requires it.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising, and we do not use personal information for targeted advertising. We can use aggregated or deidentified information if we take reasonable steps not to identify a person from it.

13. Retention

We keep account and league information while the account or league is active. We keep provider credentials until they expire, you disconnect them, the league or account is deleted, or a provider rule requires earlier removal. Import links and authorization tokens expire quickly. Generated download links also expire.

We keep billing, tax, fraud-prevention, security, support, and legal records for the period needed for the stated purpose or required by law. Providers can keep their own records under their policies. Backups can retain deleted information for a limited recovery period before normal rotation removes it. We review retention periods and remove information that is no longer needed.

14. Your Choices and Requests

In Account Settings, you can update account details, manage community preferences and subscriptions, revoke sessions, disconnect provider access, download a copy of certain account data, and permanently delete your account. Active paid subscriptions must be canceled first so that billing is not left active after deletion.

Depending on where you live, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to appeal a denied request. You may also have rights to opt out of certain sales, targeted advertising, or profiling. LeagueSaga does not use those three practices as described in this policy. Send a request or appeal to support@leaguesaga.com. We will verify the request and respond as applicable law requires. An authorized agent may submit a request where law permits.

15. Email Choices

You can turn off optional community announcements in Account Settings and can use the unsubscribe method in a marketing email. We can still send account, security, billing, and service messages that are needed to operate your account.

16. Security

We use access controls, encryption for stored provider credentials, transport encryption, restricted logs, and other administrative and technical safeguards. No system is completely secure. If you believe your account or data is at risk, contact us promptly and do not send the suspected secret in your message.

17. United States Processing

LeagueSaga is operated in the United States. Our providers can process information in the United States and other countries where they operate. Those countries can have data-protection rules that differ from the rules where you live.

18. Age Limit

The Service is for adults. You must be at least 18 years old to create an account or use the Service. We do not knowingly collect personal information directly from a child. Contact us if you believe a child has provided personal information.

19. Policy Updates

We may update this policy. We will post a new date and give reasonable notice if a change materially affects how we use personal information.

20. Contact

Cuellar Labs LLC operates LeagueSaga. Send privacy requests and questions to support@leaguesaga.com.