Privacy Policy

Last updated August 25, 2026.

What we collect

Account info: your email and password (handled by Supabase Auth -- we never see or store your raw password).
ESPN credentials: the espn_s2 and SWID values from your browser's ESPN session, captured only when you explicitly connect a league or enable Auto-Pilot. These are encrypted (AES-256-GCM) before they're ever written to our database, and are only decrypted in memory, transiently, to make a request to ESPN on your behalf.
Billing info: if you subscribe to Auto-Pilot, payment is handled entirely by Stripe -- we never see or store your card details.
Extension auth token: a random token (not your password) stored locally in your browser via chrome.storage, used to authenticate the extension to our backend.

We don't use third-party analytics or ad-tracking of any kind.
We don't sell your data, ESPN credentials, or fantasy team information to anyone.
We don't read or write anything on espn.com beyond your own fantasy football league and team.

The 4th & Long browser extension requests permission to read cookies on fantasy.espn.com. This is used exactly once per connection: after you click "Connect" on an explicit consent screen describing what's being captured, it reads your espn_s2/SWID session values so our backend can act on ESPN on your behalf (viewing your roster, and -- only if you turn on Auto-Pilot -- setting your lineup or making waiver moves). It is never read silently, never on any other site, and never from a background process without that consent step having happened first.

You can revoke Auto-Pilot access and delete a connected league at any time from your Account settings. To delete your account entirely, contact us at the address below and we'll remove your account, connected leagues, and stored credentials.