Privacy

What we collect

Commissioners sign in with an account (managed by Clerk); we store your email. Connecting Fantrax stores your Fantrax secret ID encrypted at rest (AES-256-GCM) — it is never logged, never sent to any AI service, and never reaches a browser. From Fantrax we sync league structure: team names, rosters, and player identities.

Your league spreadsheetis read either from a link-viewable Google Sheet or, if you share it with our service account, via Google’s API with read-only access. We store the cap data it contains: contracts, salaries, cap adjustments, draft picks, and the GM labels written in it.

Leaguemates need no account. An invite link sets a signed cookie holding only league and team identifiers — no name, no email.

AI processing

When you first link a sheet (and again only if its format changes), the spreadsheet’s cell contents are sent to Anthropic’s Claude API to detect where contracts, years, and totals live. Routine syncs never call AI. Your account details and platform secrets are never included — only the sheet’s own contents.

Who can see league data

Anyone holding a valid invite link for your league can view its cap dashboard — that is the product. Commissioners control invite links; treat them like a group-chat invite. League data is never public, never indexed, and never shown to other leagues.

Infrastructure

Data lives with our providers: Vercel (hosting), Supabase (database), Clerk (commissioner accounts), Anthropic (format detection, as above), and Google (sheet access). We don’t sell data, run ads, or use third-party analytics trackers.

Cookies

Clerk session cookies keep commissioners signed in. The gm_member cookie (leaguemates) lasts 90 days and contains signed league/team identifiers only. No advertising or cross-site cookies.

Deletion & contact

Email contact@underscoregm.com to delete your league (removes all synced sheet and roster data) or your account. Your spreadsheet itself always remains yours, in your Google account — we only ever hold a synced copy.