Huddle History

Privacy Policy

Last updated: August 29, 2026

What We Collect

Huddle History collects only what it needs to run. Here's the full list:

  • Email address — provided when you sign in or subscribe to recap emails. Used for authentication (magic links) and sending weekly recap emails you've opted into.
  • Sleeper league data — when a league is synced, we pull publicly available data from the Sleeper API: league settings, rosters, matchup scores, transactions, and participant display names. We never access Sleeper passwords or private account details.
  • Participant claims — if you identify yourself as a league member ("I am Charlie"), we store that association. Claims are voluntary, unverified, and non-exclusive.
  • Recap subscriptions — if you subscribe to a league's weekly recap emails, we store that preference along with a unique unsubscribe token so you can opt out at any time.
  • IP address — used only for rate limiting to prevent abuse. IP-based rate-limit counters are short-lived and automatically expire.

What We Don't Collect

  • We don't use analytics or tracking cookies.
  • We don't sell, rent, or share your data with advertisers.
  • We don't collect passwords — authentication uses single-use magic links sent to your email.
  • We don't access any private Sleeper account information.

Cookies

We use a single session cookie (hh_session) to keep you signed in. It is:

  • HttpOnly (not accessible to JavaScript)
  • Secure in production (sent only over HTTPS)
  • SameSite=Lax (not sent on cross-site requests)
  • Expires after 60 days of inactivity

We do not use any third-party cookies, advertising cookies, or tracking pixels.

How We Use Your Data

  • Authentication — your email receives a magic sign-in link when you log in or take an action that requires an account.
  • Recap emails — if you subscribe, we send weekly league recap emails to the address you signed in with. Every email includes a one-click unsubscribe link.
  • League pages — synced Sleeper data is used to generate public league pages, stats, and AI-powered weekly recaps.
  • Rate limiting — your IP address is temporarily stored to prevent abuse of sign-in and subscription endpoints.

Third-Party Services

  • Cloudflare — hosts the application and database (Cloudflare Workers and D1). Subject to Cloudflare's Privacy Policy.
  • Resend — delivers transactional and recap emails. Subject to Resend's Privacy Policy.
  • Sleeper API — we read publicly available league data. We do not send your personal data to Sleeper.
  • AI providers — league recaps are generated using AI models. The data sent to these providers consists of anonymized league statistics (scores, records, matchups) — not your email or personal information.

Data Retention

  • Session tokens expire after 60 days.
  • Magic link tokens expire after 15 minutes and are single-use.
  • Rate-limit counters reset on a rolling 1-hour window.
  • Synced league data, claims, and subscriptions are retained until you delete them or request removal.
  • Unsubscribing from recap emails is a soft delete — we keep the record so you can resubscribe easily, but stop all email delivery immediately.

Your Rights

You can:

  • Unsubscribe from recap emails at any time via the link in any email, or from the league page or your account page.
  • Remove claims from your account page or any league page.
  • Delete your account — contact us and we'll remove your data.
  • Request your data — contact us for a copy of the data we hold about you.

Children's Privacy

Huddle History is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with their information, please contact us so we can remove it.

Changes to This Policy

If we make material changes, we'll update the date at the top of this page. Continued use of Huddle History after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Reach out at privacy@huddlehistory.com.