What we keep, and why

• We keep your email, the league data your fantasy platform already shows you, and, only if you connect a private ESPN league, two ESPN cookies, encrypted.
• We use them for one thing: computing your league's true standings and emailing the recap on Tuesdays.
• We read from your fantasy platform. We never write to it, and we never sell or share your data for advertising.
• You can see every use of your ESPN cookies, wipe them, unsubscribe, or delete your whole account yourself, any time.

True Champion is an independent side project run by its developer. It is not affiliated with ESPN, Disney, Sleeper, or Yahoo. The site's source is at github.com/shulman33/true-champion-app and the extension's at github.com/shulman33/true-champion-extension.

Account

Your email address and, if you sign in with Google, the name and email Google shares. Sign-in links are single use. We do not store passwords.

League data

What your fantasy platform exposes for the league you imported: league and team names, weekly scores, matchups, standings, and the display names the platform attaches to teams. For Sleeper and public ESPN leagues this is public data. It is refreshed weekly and on demand.

Team claims and subscribers

When a member claims a team from the join link they enter their own email. A commissioner can also import a recipient list. We store the email, the team it is tied to, and whether it is subscribed, plus delivery events (delivered, bounced, complained) from our email provider.

ESPN cookies (private leagues only)

Private ESPN leagues need one member's ESPN session. That member gives us two cookies, espn_s2 and SWID, by pasting them or through the browser extension. Whoever holds these cookies can act as you on ESPN, so we treat them as the most sensitive thing we hold. See the next two sections.

Technical logs

Server logs with timestamps, routes, and error messages. Rate limits use a salted hash of your IP address, never the address itself. Cookie values and tokens are scrubbed from logs before they are written.

1. They are checked against your league with ESPN before anything is saved. If ESPN rejects them, nothing is stored.
2. They are encrypted at rest (AES-256-GCM) with a key that is not in the database, and are never shown on screen again, to you or to us.
3. They are decrypted only to read your league from ESPN's read endpoints: the weekly sync, a manual refresh, and a daily check that they still work.
4. Every decryption is written to an access log that you can read in Settings.
5. "Disconnect" in Settings wipes the encrypted values immediately. Signing out of ESPN also invalidates them. Deleting your account removes them.

The True Champion for ESPN extension exists because ESPN keeps your login in cookies no website can read. Here is everything it does:

• It reads exactly two cookies from espn.com, espn_s2 and SWID. No browsing history, no page content, no other sites.
• It only acts when you click "Connect ESPN" on this site, and it only answers pages on this site.
• It sends the two cookies once, over HTTPS, to this site's connect endpoint together with a single-use token the page gave it. It refuses any other destination.
• If you are signed out of ESPN it opens ESPN's login page and waits up to ten minutes for you to sign in, then finishes and closes that tab.
• It stores nothing but a short-lived "a connect is waiting" flag in session storage while it waits. It never stores or logs a cookie value, has no analytics, and loads no remote code.

Under the Chrome Web Store's terms: the extension handles authentication information (your ESPN session cookies) solely to provide its single purpose, connecting your league to True Champion at your request. That data is not sold, not transferred to third parties except as described here, and not used for purposes unrelated to that purpose, including creditworthiness or lending.

• Compute all-play records, schedule swaps, head-to-head tables, and weekly superlatives for your league.
• Send the weekly recap email to subscribed members, plus the account emails you ask for: sign-in links, "finish on your computer" links, and a notice when an ESPN connection stops working.
• Keep the service working and abuse-free: rate limits, delivery health, error investigation.

Nothing here is used for advertising, sold, or shared with data brokers. We do not build profiles of you across other sites.

Service providers that run the site on our behalf, each bound by their own terms and only for the purpose listed:

• Vercel hosts the application and its scheduled jobs.
• Neon hosts the Postgres database, including the encrypted cookies.
• Resend delivers email and reports bounces and complaints back to us.
• PostHog receives page visits, product actions, device/browser information, and error reports to help us understand usage and fix problems. Signed-in actions are linked with an account ID. We redact email addresses and credentials from these reports. Session replay is disabled.
• Google, only if you choose "Sign in with Google".
• Sleeper and ESPN receive read-only requests for your league data; ESPN requests for private leagues carry the connector's cookies.

Other members of your league can see the league's standings, team names, and who has claimed which team. They never see anyone's email or cookies.

We would disclose data if legally required to, and would tell you unless prohibited.

A session cookie keeps you signed in. PostHog uses first-party browser storage and cookies to connect visits and product actions on this site. These are not used for advertising or tracking you across other sites.

• Unsubscribe: every recap carries a one-click link; your address is kept only as "unsubscribed" so we do not email it again.
• Disconnect ESPN: wipes the encrypted cookies at once; the access log entry stays so the history is honest.
• Delete account: in Settings. Removes your account, your subscriptions, your claims, your connections, and detaches leagues you connected. Audit rows lose their link to you. This is immediate and cannot be undone.
• Delete league: a commissioner can delete a league and everything under it from the league settings.
• Inactive league data may be removed after a season ends with no members or subscribers. Backups roll off within 30 days.

True Champion is not directed at children under 13 and we do not knowingly collect their data.

When this policy changes, the effective date above changes and material changes are announced in the recap email. Questions or requests: recap@truechampion.app, or open an issue on either repository above.