Skip to content
Pundex

Privacy

Last updated .

Pundex is a personal, non-commercial fantasy football project, run by its owner and open by invitation. This page says what it keeps, why, who else handles it, and how to have it deleted. Questions go to support@pundex.app.

If you ask for an invite

  • Pundex keeps the address you give, your note, and a scrambled form of your IP address (an HMAC under a key only Pundex holds), used to limit requests to three an hour.
  • Cloudflare Turnstile checks that you are a person; Cloudflare receives your IP address to do it.
  • Your request is emailed to the owner.
  • Requests are deleted 90 days after they arrive, whatever the outcome. If you are invited, your address moves to the invite list.

When you sign in

  • By email link: Supabase, which runs Pundex's sign-in, keeps your address and sends the link.
  • With Google: Pundex asks Google only for your email address and whether Google has verified it, plus Google's ID for your account. It keeps the address and that ID to recognise you next time. It does not ask for your name, photo, contacts or any other Google data. It does not keep Google's access token. It passes Google's sign-in token only to Supabase, to start your session, and shares nothing it gets from Google with anyone else.
  • Your session is kept in your browser's local storage, with your theme and the last league you opened. While you sign in with Google, one cookie holds a random check value for up to ten minutes and is deleted when you return.

Your leagues

  • A Sleeper league is read from Sleeper's public API using your Sleeper username, which Pundex keeps with your Sleeper display name.
  • An ESPN league needs your ESPN cookies (espn_s2 and SWID). They are stored encrypted (AES-256-GCM) under a key held only by Pundex's own systems, used to read your leagues from ESPN, and never shown again. A league you share with other Pundex members is kept in sync with whichever member's cookies ESPN accepts, so yours may read it for all of you. Pundex may also use them to read ESPN's weekly player projections, which feed everyone's rankings; that request carries nothing about your league. Remove them on Settings at any time.
  • For each league Pundex keeps its name, its teams and each manager's display name as the platform shows them, rosters, matchups and scores, and its picture.

What Pundex writes for you

  • Briefs and trade reviews are written by an AI model. The model sees your league's name, the team and manager names involved, and the rosters. It never sees your email address.
  • Briefs run on the model you choose on Settings, or on Pundex's default, Google's Gemini. They use your key for that model's provider if you saved one, and Pundex's otherwise. Trade reviews only ever use your own key.
  • Pundex's weekly player analyses, shared by everyone, carry the names of imported leagues to Pundex's default model, under Pundex's key. They carry nothing else about you.
  • Keys you paste on Settings are stored encrypted the same way and never shown again.
  • Your brief is emailed to your address through Resend.

Who else handles your data

  • Supabase: the database and sign-in.
  • Cloudflare: hosting, request logs, Turnstile, the image host, and receiving mail sent to pundex.app.
  • Resend: sending email.
  • Google: sign-in with Google, and the default AI model.
  • The AI provider you choose on Settings, if any.
  • Sleeper and ESPN: your league's data.
  • GitHub: runs Pundex's scheduled jobs, which read the database.

Each keeps its own operational logs under its own terms.

What Pundex does not do

No ads, no analytics, no tracking pixels, no mailing list. Nothing is sold or shared for marketing.

What is public

The front page shows one week of Pundex's rankings and one brief from the owner's own league, with every team and manager name replaced. Nothing else of yours is public. Another Pundex member of the same league sees that league as any of its managers does on the platform: its teams, rosters and scores. They never see your briefs, waiver plans, trade reviews, keys, cookies or settings, and no other user can see your leagues.

Keeping and deleting

  • Your account, leagues and settings are kept while you have an account.
  • Pundex's job records are deleted after 90 days.
  • Email support@pundex.app to have your account deleted. That removes your account and sign-in, your briefs, waiver plans and trade reviews, the leagues no other Pundex member keeps, keys, cookies, settings, invitation and invite requests, and takes your address out of Pundex's job records.
  • Copies in the providers' own logs age out under their terms.

Changes

A change to this page updates the date above.