Privacy Policy

Overview

Flaim reads your ESPN, Yahoo, and Sleeper fantasy leagues to power its analysis. The only thing Flaim can write is its own list of your leagues, when you ask it to refresh; it never changes anything in your leagues on ESPN, Yahoo, or Sleeper. This privacy policy explains how we collect, use, and protect your information when you use Flaim, the Flaim Chrome Extension, and the Flaim Fantasy service.

Flaim is operated by Flaim Fantasy LLC, a New York limited liability company. When this policy says "we" or "us," it means Flaim Fantasy LLC.

Information We Collect

Account Information

When you sign up for Flaim, we collect basic account information through our authentication provider (Clerk), including your email address.

Signup Attribution

To understand which outreach helps people discover Flaim, we store a limited first-touch record when a new account is created. It may include the first landing page path, the referring website's hostname, and allowlisted campaign tags such as UTM values or an explicit referral code. We do not store the full referring URL, arbitrary query parameters, or browsing history.

We also record a general device type and operating system (for example, "phone, iOS") so we know which apps people use to find Flaim. We don't store your browser details or device model.

ESPN Credentials (Chrome Extension)

If you use the Flaim Chrome Extension, we collect your ESPN session credentials (SWID and espn_s2) when you explicitly click "Sync to Flaim" in the extension. These are session identifiers that allow us to fetch your fantasy league data from ESPN on your behalf.

• SWID: A unique identifier for your ESPN account
• espn_s2: A session token for accessing ESPN's fantasy APIs

We do not collect your ESPN username or password. The extension only reads session credentials that ESPN has already set in your browser.

Yahoo Credentials (OAuth)

If you connect a Yahoo account, we store OAuth refresh tokens issued by Yahoo through a standard authorization flow. These tokens allow us to fetch your Yahoo fantasy league data on your behalf. We do not collect your Yahoo username or password.

Sleeper Connection Data

If you connect Sleeper, we store your Sleeper username so we can look up your public league data through Sleeper's public API. We do not store a Sleeper password or token.

AI App Connections

When you connect an AI app, such as ChatGPT, Claude, or a custom connector in Perplexity, Gemini, Grok, or Muse, to your Flaim account, we store a connection record for that app so Flaim can recognize it on later requests: which app it is, and when the connection was made and last renewed. We also keep a record of each request a connected app makes: which tool it used, when, which app made the request, whether it succeeded, and how long it took. When the app provides it, the record also notes the general kind of app or device the request came from (for example, "ChatGPT iPhone app" or "web browser") and the app's version number, but not your device model, operating system version, or browser details. We do not log the question you asked or the AI's answer.

Email

We use your email address to run your account and, from time to time, to send product updates about Flaim, such as new features, newly supported sports, and service notices. Every product-update email includes an unsubscribe link, and unsubscribing does not affect your account. We never sell your email address to advertisers or data brokers.

How We Use Your Information

We use your platform connection data (ESPN session credentials, Yahoo OAuth tokens, and Sleeper username) solely to:

• Fetch your fantasy league rosters, scores, and standings
• Provide analysis and recommendations for your fantasy teams
• Display your league information within the Flaim application

We do not use your connection data for any other purpose.

Your AI App

When you connect an AI app, such as ChatGPT, Claude, or a custom connector in Perplexity, Gemini, Grok, or Muse, to your Flaim account, Flaim sends that app the league data it requests on your behalf: things like your roster, matchups, standings, available players, recent league moves, league rules, and league history. This only happens when you ask for it, in a prompt or by using a control such as the league widget's refresh button.

Flaim never sends the AI app your ESPN session credentials, your Yahoo tokens, or your Flaim account details. When you refresh Sleeper leagues, the result includes the Sleeper username you connected, which Sleeper already shows publicly. Once your league data reaches the AI app, it is processed by the AI provider you chose, under that provider's own terms and privacy policy.

Data Transmission and Storage

Transmission

All data is transmitted over HTTPS (TLS 1.2+), ensuring encryption in transit. The Chrome extension talks only to flaim.app and to clerk.flaim.app, Flaim's sign-in service run by Clerk, over secure connections.

In your browser's extension storage, the extension keeps your Flaim sign-in session and a little popup state: the status of your ESPN history import and whether you dismissed the rating prompt. It never stores your ESPN cookies there. When you open the popup while signed in to Flaim, it reads the two ESPN cookies (SWID and espn_s2) to check that you're signed in to ESPN. They are sent to Flaim only when you click Sync.

Storage

Your platform connection data is stored in our database (Supabase) with the following security measures:

• Encryption at rest: Stored data is encrypted at rest by our database provider (Supabase)
• Server-side access checks: Flaim's servers read a user's data only on that user's behalf, and the database is never reachable from a browser
• Access controls: Database access is restricted to Flaim's own server-side services

Data Retention

We retain your platform connection data only as long as needed to provide the service:

• ESPN credentials: Retained until you disconnect.
• Yahoo tokens: Retained until you disconnect your Yahoo account. Tokens auto-refresh; revoking access in Yahoo immediately invalidates them.
• Sleeper username: Retained until you disconnect Sleeper from your account.
• Account data: Deleting your account through your account menu (Manage account, then Security, then Delete account) starts permanent deletion. Your connected ESPN, Yahoo, and Sleeper credentials and your saved league data are purged once the verified deletion event is processed, normally within seconds.
• Usage records after deletion: Some usage records are pseudonymous rather than anonymous: they remain linked to your Clerk account identifier rather than your name or email. Raw usage-event records are kept for up to 90 days; daily usage summaries derived from them are kept indefinitely for product analytics. We also keep a permanent record that your account existed and when it was deleted, so we can continue to block any future attempt to write data under that identifier.
• Marketing email: When you delete your account, we unsubscribe your address from product-update email as part of preparing our next send. If you delete your account just as an email is going out, you may still receive that one. We keep only an unsubscribed record with our marketing email provider so the address is not re-added. You can also use the unsubscribe link in any marketing email at any time.
• Signup attribution: A first-party cookie keeps the limited first-touch record for up to 30 days before signup. If an account is created, that record is retained with the Clerk account until the account is deleted.
• Remove credentials: Visit flaim.app/leagues to manage or remove your platform credentials.
• Delete account: Open your account menu, choose Manage account, then Security, then Delete account.

Third-Party Sharing

We do not sell or rent your personal information or platform credentials, and we do not share them with third parties for their own marketing. Your data is used to provide Flaim's services to you. Our service providers (Clerk for authentication and account email, Supabase for data storage, Cloudflare and Vercel for hosting and compute, Resend for transactional product email, Plunk for product-update email, and Fastmail for human correspondence) process data only as necessary to operate the service. See Your AI App above for how your league data reaches the AI app you connect. The one exception to all of this is a business transfer, described below.

Chrome Extension: Limited Use

Flaim's use of information received from the Flaim Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In plain terms, here is what that means for the data the extension handles: your ESPN sign-in cookies (SWID and espn_s2) and your Flaim sign-in session.

• We use it only to connect and read your ESPN fantasy leagues.
• We never use it for advertising, and we never sell it.
• We transfer it only as needed to provide that feature, to keep Flaim secure, or to comply with the law. Business transfers have extra limits, described below.
• No person reads it unless you ask or agree, for example when you ask for help with a support problem, or when it's needed for security or legal reasons. Our support tools only check whether ESPN credentials are saved for an account; they never show the credentials themselves.

Business Transfers

If Flaim is ever involved in a merger, acquisition, or sale of all or part of its business or assets, including in a bankruptcy or similar proceeding, your account information and platform connection data may transfer to the new owner as part of that transaction, except for Chrome extension data, which has the stricter rules described next. Before a deal closes, we may share information with a prospective buyer only as needed for them to evaluate it, under a confidentiality agreement. The new owner would have to keep honoring this policy for the information it receives. If it wanted to use your information in a materially different way, it would need your consent first, and we would tell you by email and on this page.

Data received from the Flaim Chrome extension is handled more strictly. It would transfer to a new owner in a merger, acquisition, or sale of assets only after we get your explicit consent first, and we would not share it with a prospective buyer to evaluate a deal.

Your Rights

You have the right to:

• Disconnect the extension at any time and remove stored credentials via flaim.app/leagues
• Request a copy of your stored data
• Request deletion of your account. See Data Retention above for what is removed and what is retained afterward.

Platform Affiliation Disclaimer

Flaim is not affiliated with, endorsed by, or sponsored by ESPN, The Walt Disney Company, Yahoo, Sleeper, or any of their subsidiaries. ESPN is a trademark of ESPN, Inc. Yahoo is a trademark of Yahoo Inc. We access fantasy data with your explicit consent using the credentials you provide.

Children's Privacy

Flaim is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@flaim.app and we will promptly delete it.

Legal Compliance

If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data on the legal basis of your consent (provided when you connect your fantasy platform accounts) and our legitimate interest in operating the service. You have the right to access, correct, or delete your personal data, and to withdraw consent at any time by disconnecting your accounts.

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) to request disclosure of the categories of personal information we collect, the purposes for collection, and to request deletion of your data. We do not sell personal information. To exercise these rights, contact us at privacy@flaim.app.

Changes to This Policy

We may update this privacy policy from time to time. We will post the new policy on this page and update the "Last updated" date. For significant changes, we will also let account holders know by email.

Contact Us

If you have questions about this privacy policy or your data, please contact us at: privacy@flaim.app