HuddleWatch™

HuddleWatch

Privacy policy

Last updated October 10, 2026

The short version. We collect account and league information to run your call sheet, and first-party usage information to understand reliability and adoption. We do not sell your data or run ads. If you let the connector save a platform sign-in, that saved session can access your whole ESPN, Yahoo or Sleeper account, so please read Saved platform sign-ins. Account deletion removes your profile and saved sign-ins; some activity records expire separately, and payment records are kept for accounting.

What we collect

What you give us when you sign up

What you give us when you connect a fantasy platform

HuddleWatch is only useful once it can read your leagues, so connecting a platform means handing us something that lets us act as you on that platform. This is the most sensitive thing we hold, so here is exactly what it is:

We use these credentials to read your leagues, including on a schedule when you are not using the site (see League watching below), and to make the changes you explicitly confirm. We never make a roster move you did not ask for. You can remove a saved sign-in at any time, as described below, and it is deleted from our servers immediately.

Saved platform sign-ins

Some features keep working when you are not on the site: loading your ESPN leagues, League watching, and AutoSwap, which makes a swap you armed from our server at the NFL inactives. For these, HuddleWatch keeps a copy of your platform sign-in session: the cookies or token your browser uses to stay signed in to that platform. Please read this part carefully, because a saved session is not limited to fantasy football. Whoever holds it can use that platform account as you until the session ends.

How we use them. Only for fantasy requests on your behalf: reading your own leagues, sending the changes you confirm, making the AutoSwap swaps you armed, and, for Yahoo, reading that league on a schedule for League watching. We do not use them for anything else in your platform account.

How they are protected. Saved Yahoo and Sleeper sessions are encrypted with our own AES-256 key before they are stored, and are decrypted only to run your armed swaps and League watching. Saved ESPN cookies are kept in your account record. All of them are held in Cloudflare's storage, which encrypts data at rest, and can be reached only by the site's own code and by HuddleWatch's owner. They travel only over encrypted connections between your browser, our servers and the platform. We never receive your platform passwords.

How long we keep them. Saved ESPN cookies are kept until you remove them or delete your account, or until they go unused as described in the next paragraph. Each saved Yahoo session is deleted automatically 30 days after it was last saved, and a saved Sleeper session 200 days after it was last saved. While AutoSwap is on in the connector, it saves fresh copies from your browser when you open your call sheet, about once every 12 hours, which restarts those periods. That refresh saves the ESPN sign-in from that browser if it is signed in to ESPN, a Yahoo sign-in for every Yahoo team on your HuddleWatch account that the Yahoo account signed in there owns, even one you had not approved, and the Sleeper session for the Sleeper league on your account. You turn AutoSwap on in the connector itself, and approving offline access for a Yahoo team or turning on offline AutoSwap for Sleeper on your call sheet turns it on too, even if you turned it off before. A saved session also stops working whenever the platform ends it; if a saved Yahoo or Sleeper session stops working, we mark it for reconnecting, and it is still deleted 30 days (Yahoo) or 200 days (Sleeper) after it was last saved, unless you remove it sooner.

Automatic deletion of unused sign-ins. Once a day we also delete saved sign-ins on our own. A saved ESPN, Yahoo or Sleeper sign-in that has not been used for 60 days is deleted automatically: that means 60 days in which it was not saved again and you did not open your HuddleWatch call sheet or DraftAid while signed in. The first such deletions can happen from December 5, 2026, because use has been recorded since October 6, 2026. If an AutoSwap you armed still needs the sign-in then, we keep it until that AutoSwap has finished. A saved Yahoo or Sleeper sign-in that nothing can use any more is deleted too, whatever its age: when its account is gone, its Yahoo team is no longer on your account, or your account has no Sleeper league left.

How to remove them. The lasting way is the connector's setup page (Open connector setup in Manage leagues): press Remove next to ESPN, Yahoo or Sleeper. The saved sign-in is deleted from our servers at once, and the connector does not save it again on its own until you sign in there yourself (approving offline access again on your call sheet also saves it). Turning AutoSwap off in the connector stops its automatic saves; sessions it already saved stay until they expire or you remove them. Deleting your account deletes all of them.

Some controls on the site delete a saved session at once but do not stop the connector saving it again: Disconnect and delete session for a Yahoo team, or turning off offline AutoSwap for Sleeper, on your call sheet; disconnecting Yahoo; and removing a Yahoo league from Manage leagues, which deletes your saved Yahoo sessions. A sign-in removed any way other than the connector's own Remove, including ESPN, can come back the same way. While AutoSwap is on in the connector, it saves the session again at its next refresh, the first time you open your call sheet once about 12 hours have passed since the last one, for the Yahoo and Sleeper leagues still on your account. To stop that, press Remove on the connector's setup page or turn AutoSwap off in the connector. You can also end sessions at the platform itself, for example with a sign-out-everywhere option in your ESPN, Yahoo or Sleeper account settings where one is offered.

What we pull from those platforms

Your leagues, teams, rosters, matchups, projections, scores, and the transactions you make through HuddleWatch. We also keep a snapshot of your lineup before each week's games begin so the optimization history can show honestly whether your lineup was set before kickoff.

League watching

Connecting a league lets HuddleWatch read it on a schedule, whether or not you have the site open: about every 5 minutes during NFL game windows and every 15 to 60 minutes otherwise. Each read compares every team's roster and lineup with the last one and records what changed and when: players added, dropped, traded, moved into or out of a lineup, and changes in projected points. This is read only; watching never changes anything in your league.

We use this league history to power Change History, your analytics and HuddleWatch's features, and in aggregated form (for example, how often managers change lineups before kickoff) to improve the product. Because a league is shared, the history covers every team in it, including managers who do not use HuddleWatch; for those teams we record team identifiers, player moves and projections, not personal contact details. We never sell this information.

ESPN leagues are read with the ESPN sign-in you connected, Sleeper leagues through Sleeper's public data, and Yahoo leagues with your saved Yahoo sign-in once you approve offline access for that team or, while AutoSwap is on in the connector, once it saves your sign-in for that league. Disconnecting a platform stops the watching for your connection immediately; for Yahoo, while AutoSwap is on in the connector, it starts again when the connector saves your sign-in again (see how to remove them).

Payment information

Payments run through Stripe or PayPal, using the payment methods available at the provider's checkout. Your full card or bank details and PayPal password never reach HuddleWatch. We store provider customer, order, subscription and transaction identifiers, the plan and paid access period, and payment and refund status. Your payment history and the owner-only support tools can retrieve amounts, dates, subscription status and refunds from the provider used for your payment.

Account and support activity

Support tickets. When you send a ticket from the Support page, we receive what you wrote, the email address to reply to, your name if you gave it, the page you were on, and your browser type, plus your account name and email if you were signed in. We use it only to answer you and fix the problem. It is emailed to our support inbox, which is a Gmail account, and a copy is kept for up to 180 days so we can follow it up and spot repeated problems.

To help us reply, the ticket's topic and message, the page it came from, and your name and account email if the ticket has them are sent to Anthropic's AI service, Claude, which drafts a suggested reply for us. Your browser details are not sent. A person at HuddleWatch reads every draft and decides what to send you; the AI never replies to you directly.

Bug reports and suggestions. Bug reports and suggestions come from signed-in accounts: once you are signed in, the Report an issue button on every page sends us one. A report holds what you write; up to four screenshots, if you attach any; your account's name and email address, which is where a reply can go; and the details listed in the form under "What we send", each of which you can untick before you send: the address of the page you were on, with tokens, codes and email addresses taken out; the fantasy platform and sport of the league you had open; your browser, operating system, and window and screen size; the version of the site and, if it is installed, of the HuddleWatch Connector; and the last few errors your browser met on that page (an error message, or the status and path of a request that failed, never the content of a page, a cookie or a password).

Screenshots are shrunk and re-encoded in your browser before they leave it, which removes hidden details such as where a photo was taken, and you can black out any part of one first; what you black out is not sent. "Capture this tab" takes one picture of the page when you press it and records nothing else. A screenshot shows whatever was on your screen, so look at it before you attach it.

Only HuddleWatch's owner reads these reports, through the administrative tools described under Security below. A notice that a report arrived is emailed to our support inbox, which is a Gmail account, with what you wrote and the details above but never the screenshots; those stay in our own storage and are shown only to you, when you are signed in to the account that sent them, and to us. Bug reports, suggestions and their screenshots are not sent to Anthropic or any other AI service. We may write back: a reply appears on your My reports page, and we may also send it by email to your account's email address. Every reply is written and sent by a person. To limit abuse we count reports per account and per network address; the address is kept only as a one-way scrambled value, for no more than two days.

We record successful account sessions, refund authorization activity, and each unlocking of the owner's administrative tools, so support can investigate account and payment issues. Refund records include the amount, internal support reason, status, and authorizing administrator. These activity records expire after one year, with two exceptions: our log of refunds, which also holds the customer's name and email, is kept for about 13 months, and the record of each refund request that stops a refund being sent twice is kept with our payment records. None of them contain passwords, fantasy-platform credentials, or session tokens.

What we do not collect

First-party analytics: page loads send a page path, referrer and browser-local flags (first visit ever, first visit today, first visit this month) that let us count visitors without identifying any of them. We store aggregated daily page/source counts and signed-in counts, not IP addresses or individual browsing histories in these analytics counters. The browser flag is kept in local storage, not an advertising cookie. Aggregate counters are retained for up to 400 days. A daily account activity mark for call-sheet requests expires after 100 days. Connector detection dates already recorded on accounts are retained with the account; new optional connector usage reporting requires consent in supported connector versions. These measurements are not shared with advertising services.

No advertising identifiers, no third party analytics, no tracking pixels, no session recording, no cross site tracking, and no location data. The site runs no ad trackers and no third-party analytics scripts. Your browser does fetch some content directly from other companies' servers: fonts from Google Fonts, public NFL scores from ESPN, your own fantasy team's picture and your own avatar as set on ESPN and Sleeper, and on Yahoo for Yahoo leagues (other teams in your leagues are shown as initials, so their pictures are not loaded), and the PayPal logo on PayPal payment buttons. Like any web request, these show that company your IP address and browser details, but they carry none of your HuddleWatch account information; see Who we share it with. We do not buy data about you from anyone.

Do Not Track

Some browsers can send a Do Not Track signal. HuddleWatch does not track you across other websites and does not allow third parties to place tracking scripts on ours, so the site works the same way whether or not your browser sends the signal. The same goes for Global Privacy Control signals: we do not sell or share personal information, so there is nothing for them to opt out of.

The HuddleWatch Connector browser extension

The connector supports desktop Chrome, Edge and Firefox. It runs on the supported fantasy-platform pages and HuddleWatch, and reads their fantasy API endpoints. It also supports our huddlewatch.pages.dev deployment address. Its single purpose is to connect your own ESPN, Yahoo and Sleeper fantasy football accounts to HuddleWatch, including live draft rooms.

What it reads: the league, roster and draft pages you are already signed in to and viewing, and, for ESPN, your existing sign-in session so HuddleWatch can load the leagues you belong to. It never sees, stores or transmits your platform password. What it sends: league and draft data to huddlewatch.com for your account only, and the picks you choose or that Auto-Pick makes for you, to the platform through its own draft controls. It sends nothing anywhere else.

AutoSwap. If you turn on AutoSwap in the connector, it saves your ESPN, Yahoo and Sleeper sign-in sessions to your HuddleWatch account so a swap you armed can run from our server at the NFL inactives, even with your browser closed, and refreshes them while AutoSwap is on. They are used only to check and make the swaps you armed in your own leagues and, for Yahoo, for League watching. What each saved session can access, how it is protected, how long it is kept and how to remove it are explained under Saved platform sign-ins. A sign-in removed on the connector's setup page is not saved again automatically until you sign in there again yourself. Turning AutoSwap off stops the automatic saves. We never receive your platform passwords.

The connector transmits league data, participant names/identifiers and matching draft-room URLs to HuddleWatch. ESPN session cookies are transmitted to and stored by HuddleWatch only after you approve the connection; they do not stay solely in the extension. Optional detection reporting records that the connector was available on a given day. Firefox lets you control optional technical-data consent in its extension settings; declining does not disable league connections. The connector contains no advertising or remotely loaded executable code. Removing it stops new browser-side transfers; account data already saved remains until removed or expired.

Cookies

HuddleWatch sets one cookie, called hw_session, which is what keeps you signed in. It is marked HttpOnly and Secure so it cannot be read by scripts, and it expires after 30 days or when you sign out. That is the only cookie we set, and we do not use it to follow you anywhere else.

Your browser's own local storage also holds a few small conveniences that never leave it except as described above: whether this browser has visited before, today and this month (for the visitor counts), where you first came from (sent once, with signup), the league you last opened, and the Sleeper username you last typed. Clearing your site data removes them.

Where it is stored

Account records live in Cloudflare's key value storage and database, and the site itself runs on Cloudflare's network. Access is restricted to the site's own code and to HuddleWatch's owner.

Who we share it with

We do not sell your personal information, and we do not share it for advertising. We do not disclose it to anyone except the following companies, each of which only receives what it needs to do its job:

We may also disclose information if the law requires it, or where it is necessary to investigate fraud or protect someone's safety.

How long we keep it

Account data is kept for as long as your account exists. Saved platform sign-ins are kept as described under Saved platform sign-ins. Cached league data expires on its own, most of it within 30 days; weekly roster history and the lineup snapshots taken before each week's games are kept for up to 400 days so past weeks can be shown. League history recorded by League watching is kept while any HuddleWatch account has that league connected, and deleted within 12 months after the last one disconnects it; aggregated statistics that identify no team or person may be kept longer. Sign-in sessions expire after 30 days. Support tickets are kept for up to 180 days. Screenshots on a bug report or suggestion are deleted 12 months after it is marked fixed or closed, and no later than 24 months after the last activity on it; the written report and its conversation are kept while your account exists. You can ask us to delete a report sooner at the address under Contact. Other records: account activity records for one year; our refund log for about 13 months. Our record of each payment and refund (the amount, date, plan, the provider's transaction reference and receipt link, and the email on the account) is kept for seven years for tax and accounting, including after an account is deleted.

Deleting your account

Open Settings and choose Delete account, then confirm. It takes effect immediately and cannot be undone. It deletes your profile (name, email address, password hash and sign-up confirmations), every saved platform sign-in for ESPN, Yahoo and Sleeper, your connected leagues, your armed AutoSwap picks and your preferences, and the bug reports and suggestions you sent with their conversations and screenshots, and it ends every signed-in session.

Some records are kept after deletion: our payment and refund records and the plan and access period each payment bought, for tax and accounting as described above. Stripe and PayPal also keep their own records of your payments under their own policies. Support tickets, account activity records, cached league data and League watching history are not removed at once; they expire on the schedules above. If you have a monthly or annual subscription, cancel its renewal in Plan & billing before you delete your account. If you would rather we did it for you, email us from the address on your account.

Your rights

Wherever you live, you can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email us and we will respond. We will not charge you for it and we will not treat you differently for asking.

If you live in California, you additionally have the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of, but the right to ask still stands.

Children

HuddleWatch is for adults. You must be 18 or older to create an account, and we ask you to confirm it when you do. It is not intended for anyone under 18, and we do not knowingly collect information from children under 13. If you believe a minor has created an account, tell us and we will remove it.

Security

Passwords are hashed, never stored in readable form. Traffic is encrypted in transit. Session cookies cannot be read by page scripts. The owner's administrative tools, which can see customer and payment records, open only with a separate PIN and a one-time code sent by email, for a limited time, and every unlock is logged. No system is perfect, and we will tell affected users promptly if we ever discover a breach involving personal data.

Changes

If we change this policy in a way that materially affects you, we will update the date at the top and email account holders. Continuing to use HuddleWatch after a change means you accept the updated policy.

Who we are

HuddleWatch is operated by MoneyMalone, LLC, a California limited liability company doing business as HuddleWatch. It is the controller of the information described on this page.

Contact

Questions about privacy, or a request about your data, go to [email protected]. Our contact details:

Back to HuddleWatch

Bugs and suggestions

Report a bug

What are you sending?

Screenshots optional, up to 4

Drop, paste or choose imagesAdd screenshotsThey are shrunk in your browser, and you can black out anything private before you send.

    What we send

    Always: what you write, your screenshots, and your account (name and email) so a reply can reach you. The rest helps us see what you saw. Untick anything you would rather keep.

      Only the HuddleWatch team sees your report and screenshots. We use them to fix the problem and to answer you, and for nothing else. See our Privacy Policy. A question about your account or a payment? Open a support ticket instead.

      My reports