Effective November 3, 2026
Salary Cap Football (the website at salarycap.football and its iPhone app) is run by Jason Stoudt, operating as Stoudt Labs (“we”). This policy explains what we collect, why, who processes it, and the choices you have.
What we collect and why
| Category | What | Why |
|---|---|---|
| Account | Email address, name, a hashed password (never the password itself), and the identifier Google or Apple gives us if you sign in with them. | Signing you in and running your account. |
| Profile | Display name, username, profile photo or avatar choice, favorite team, time zone, and an optional phone number. | Showing your profile to your league; the visibility settings in Profile control who sees it. |
| League play | Team names, weekly lineups and rosters, scores, standings, league chat messages and reactions. | Running the game. This is shared with the other managers in your league. |
| Notifications | Push notification tokens for your devices, and a log of notifications we sent (title and status; chat text is not stored in the log). | Sending the notifications you turn on. |
| Feedback | What you write in the feedback or idea forms, with your IP address and browser type. | Reading and following up on feedback, and spotting abuse. |
| Invitations and waitlist | The email address of anyone a commissioner invites; the email or phone number given to the waitlist on the home page. | Sending the invitation, or telling you when a spot opens. |
| Diagnostics | Error reports and performance traces, and for some sessions a privacy-masked replay of the screen (text is masked and images are blocked). | Finding and fixing bugs. |
| Usage analytics (only if you accept) | Anonymous page views and clicks. Not linked to your account. | Understanding which features are used. |
We do not sell your information, use it for advertising, or share it with data brokers. We do not track you across other companies’ apps or websites.
Who processes it for us
These services process data only to provide their service to Salary Cap Football:
| Service | What it does |
|---|---|
| Supabase | Database and file storage for everything above. Profile photos are stored at public links. |
| Vercel | Hosts the website and app, and keeps short-lived request logs. |
| Resend | Sends email: password resets, league invitations, commissioner announcements. |
| Sentry | Error reports, performance traces and masked session replays. |
| PostHog | Anonymous usage analytics, only after you accept analytics. |
| Push services (Apple, Google, Mozilla, Microsoft) | Deliver notifications to your device; a notification carries its text, such as a league name and a chat preview. |
| Google and Apple | Sign-in, if you choose it. When you delete your account we ask Apple to revoke Sign in with Apple. |
| ESPN | Player photos load from ESPN’s image servers, which see your device’s IP address. We send ESPN no information about you. |
If you connect an AI assistant to your account (Profile, Connected AI), that assistant can read your leagues, the week’s player pool and your lineup, and can save lineups for you. It does not receive your email or other managers’ details. You can disconnect it at any time. We may also disclose information when the law requires it.
What other managers see
Managers in your league see your display name, profile photo, team name, lineups, scores and chat messages. They are not shown your email address. If you have not set a display name or name, the part of your email before the “@” is shown as your name, so set one in Profile if you would rather it were not.
Cookies and storage on your device
| Item | Purpose |
|---|---|
| Sign-in cookies | Keep you signed in (up to 30 days) and protect forms. Required. |
| Your analytics choice | Remembers whether you accepted analytics, for one year. |
| Analytics cookie | Set only if you accept analytics. |
| Device storage | Your theme and layout settings, unsent chat messages and unsaved lineup drafts, so nothing is lost if your connection drops. Unsent chat is cleared when you sign out. |
Analytics are off unless you accept them.
How long we keep it
- Your account and league history: while your account exists.
- Password reset links expire after 60 minutes; sign-in handoff codes after minutes.
- A connected AI assistant’s access lapses after 60 days unused.
- When you delete your account, your personal information is removed straight away (see below). Error reports and server logs are kept by the services above for their standard periods.
Your choices and rights
Delete your account
In the app, go to Profile, Privacy, Delete Account. Deleting removes your email address, name, password, sign-in links, profile, photo, preferences, devices and connected assistants, and revokes Sign in with Apple if you used it. Your past scores and chat messages stay in your leagues so other managers’ standings do not change, but they are shown as “Former manager” and are no longer linked to your account details. A league you run passes to another member, and a league with nobody else in it is deleted.
Other requests
You can edit your profile and visibility settings in Profile at any time. To ask for a copy of your information, a correction, or deletion of anything not covered above (such as feedback you sent or a waitlist entry), email jason@stoudtlabs.io. We answer within 30 days. Depending on where you live, you may have further rights under laws such as the GDPR or the California Consumer Privacy Act; we honor these requests wherever you live.
Children
Salary Cap Football is not directed to children under 13, and we do not knowingly collect their information. If you believe a child under 13 has an account, email jason@stoudtlabs.io and we will delete it.
Security
Data is encrypted in transit, passwords are stored only as salted hashes, and personal data is read and written only by our servers. No system is perfectly secure; if a breach affects you, we will tell you.
Changes
We will update this page and its date when our practices change, and for a significant change we will also tell you in the app or by email.
Contact
Jason Stoudt, operating as Stoudt Labs. jason@stoudtlabs.io