Privacy Policy — Win the Numbers

Effective date: August 21, 2026

Contact: spaine9powell@gmail.com

Win the Numbers ("the app," "we," "us") is a dynasty fantasy football analytics app. This Privacy Policy describes what information the app collects, how we use it, who we share it with, and the choices you have. It applies to the Win the Numbers iOS app and the backend services that support it.

This app and this policy are directed at users in the United States. If we expand to other countries, we will update this policy to address the laws that apply there (for example, the EU's GDPR) before doing so.

Information we collect

Account information (only if you create an account). You can use the app as a guest without creating an account. In guest mode we never create an account record for you: no email address, no profile, and none of your watchlist, settings, or league list is stored on our servers. Guest use is not fully anonymous, however, and we would rather say so plainly: the app fetches fantasy league and statistics data through our own servers instead of calling Sleeper or ESPN directly, so the league and player IDs you look up appear in our server request logs, and your device's IP address reaches our servers and is used to apply per-client rate limits. We do not use either to build a profile of you. One exception: player photos are loaded by your device directly from Sleeper's image server (sleepercdn.com), not through us, so viewing a player sends your device's IP address and that player's ID to Sleeper. That happens for guests and signed-in users alike. If you create an account, we collect your email address and, if you sign in with Apple, the name and email address Apple chooses to share with us (you may use Apple's private email relay). Accounts, authentication, and account data storage are handled by our database and authentication provider, Supabase.

Content you add. For signed-in users, the app syncs three things to our servers so they're available across your devices: (1) the identity of the Sleeper fantasy leagues you import — the league name, season, and Sleeper league ID only; we do not copy your league's rosters, matchups, or transaction history to our servers; (2) the players on your watchlist; and (3) your in-app settings. For guests, all three stay on your device only and are never synced to our servers (see the note above about request logs and IP addresses, which applies to everyone).

ESPN Fantasy Football data (optional). If you choose to import an ESPN league, we request only the league ID for public leagues. For a private ESPN league, ESPN requires your session cookies (espn_s2 and SWID) in order to read the league on your behalf. If you provide them, they are sent to our servers over an encrypted connection, encrypted again before being stored, and kept only so the app can refresh that league's data for you. They are never stored on your device in readable form, never shared with anyone, and never used for anything other than reading the ESPN leagues you asked us to import. Disconnecting ESPN in the app, or deleting your account, deletes them. Note that the credentials are stored once per account rather than per league, so disconnecting removes access to all of your ESPN leagues at once, not just one. You can use the rest of the app without ever providing them.

Advertising data (via Google AdMob). The app shows optional rewarded video ads so that free users can temporarily unlock certain features. Our advertising partner, Google AdMob, may collect device identifiers (including your device's advertising identifier, if tracking is allowed), IP address, general device/app information, and ad-interaction data to select and measure ads. Before any ad is shown, the app requests your tracking permission (Apple's App Tracking Transparency prompt) and, where applicable, presents Google's consent choices. If you decline tracking, you still receive the full in-app reward — ads are simply not personalized. Google's own privacy policy governs its processing of this data: https://policies.google.com/privacy and https://support.google.com/admob/answer/6128543.

Subscription data (via RevenueCat + Apple). If you purchase the optional ad-free subscription, the purchase is processed by Apple through the App Store — we never receive or store your payment card or Apple ID credentials. We use RevenueCat as our subscription-management processor: RevenueCat receives an app-user identifier (your account id if signed in, otherwise a random anonymous id), the product you purchased, and Apple's purchase/renewal receipt data, and returns your entitlement status so the app can turn ads off. We also record, per purchase, the subscription terms we disclosed to you and that you agreed to them (an auto-renewal consent record kept as required by law). RevenueCat's privacy policy governs its processing: https://www.revenuecat.com/privacy.

What we do NOT collect. We do not collect precise or approximate location data, health data, contacts, or browsing history outside the app, and we never receive or store your payment card number or bank details (see "Subscription data" above for the one payment-adjacent data flow we do have). We use no analytics or crash-reporting SDKs of any kind — the advertising SDK described above and the subscription processor described above are the only third-party SDKs that receive device or purchase data. We do not knowingly collect information from children under 13, and we do not ask for or collect birthdates or other age signals. The app is not directed to children (see "Children" below).

How we use information

• Provide the app: authenticate your account, sync your imported leagues (identity only), watchlist, and settings across your devices, and compute player values, rankings, and analytics.
• Show and measure rewarded ads, since the app's free tier is supported by optional ads rather than by selling your information.
• Process the optional ad-free subscription: verify your entitlement, restore prior purchases, keep the required auto-renewal disclosure/consent record, and remind you before an annual renewal.
• Send essential account communications (e.g., email verification, password-reset emails). We do not send marketing email.

We do not use your information for any purpose other than what's described above, and we do not share your league rosters, watchlist, or account information with anyone except Supabase (as our infrastructure provider, acting on our instructions) and, for advertising data specifically, Google AdMob as described above.

Do we sell or share your information? (California and other state privacy rights)

We do not sell your personal information for money or other valuable consideration, and we have never done so.

Some state privacy laws (including California's CPRA) define "sharing" broadly enough that providing your advertising identifier to Google AdMob to serve personalized ads could be considered "sharing" for cross-context behavioral advertising, even though no payment changes hands. To be transparent about this regardless of legal threshold: if you allow tracking, your device's advertising identifier may be used by AdMob to personalize ads. If you decline or later revoke tracking permission (iOS Settings → Privacy & Tracking → Win the Numbers), AdMob serves only non-personalized ads and this sharing does not occur — with no loss of any in-app reward or feature.

Comprehensive state privacy laws such as the CCPA/CPRA currently apply only to businesses that meet specific size or data-volume thresholds, which this app does not yet meet. Regardless, we intend to honor the spirit of these rights as we grow: as our user base approaches the thresholds that would legally require it, we will add a dedicated "Do Not Sell or Share My Personal Information" control and a formal access/deletion request process for state residents, and will update this policy accordingly. You can always exercise the practical equivalent today — decline tracking (above) and/or delete your account (below) — regardless of where you live.

Where your information lives

• Account and synced content (email, and any name Apple shares, league identity, watchlist, settings): stored in our database provider Supabase's Postgres database, protected by row-level security so that only your own account can read your rows. This includes your subscription entitlement status and, for signed-in users, the per-purchase auto-renewal consent records. Your session tokens are stored on your device in the iOS Keychain (via secure, encrypted device storage) — never in plain app storage.
• ESPN private-league credentials (only if you connect a private ESPN league): stored encrypted in our Supabase database, readable only by our backend service and never exposed to the app or to other users.
• Subscription processing: RevenueCat (entitlement management) and Apple (payment processing).
• On-device data (guest mode, or a signed-in user's local cache): stored locally on your device and removed when you delete the app.
• Fantasy data displayed in the app (player stats, projections, league data you look up): sourced from third-party sports-data providers and proxied through our backend servers. These lookups are keyed only by the data being requested (e.g., a league or player ID) and are not tied to your account or stored with your personal information.

Retention and deletion

If you have an account, we keep your account data for as long as your account exists. You can delete your account at any time directly in the app (Settings → Account → Delete Account). Deleting your account permanently and immediately deletes your account and all associated data — profile, league list, watchlist, settings, entitlements, and subscription consent records — from our servers, and clears the app's local data on your device. This is a one-way action; we do not offer account recovery after deletion. Server-side data caches used to serve the app (e.g., cached statistics) contain no personal information and expire automatically on their own schedules. Note: records of subscription transactions that Apple and RevenueCat keep for their own tax, accounting, and legal obligations are outside your app account and are retained by those processors under their own policies.

Your choices

• Use the app as a guest. No account is created, and none of your watchlist, settings, or league list is stored on our servers. This is not the same as nothing leaving your device: see "Account information" above for the request logs, IP address, and direct-to-Sleeper photo loads that apply to everyone, and "Advertising data" for what Google AdMob may collect if you choose to watch a rewarded ad.
• Decline or revoke ad tracking at any time (iOS Settings → Privacy & Tracking) to receive only non-personalized ads — this never reduces or removes any in-app reward.
• Ad consent choices: where Google's consent framework presents additional options, you can revisit them through the in-app consent prompt.
• Delete your account and all associated data at any time, in-app (Settings → Account → Delete Account).
• Questions, requests, or concerns: email us at spaine9powell@gmail.com.

Children

Win the Numbers is a general-audience fantasy football analytics tool and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or provided us with personal information, please contact us at spaine9powell@gmail.com and we will delete it.

Subscriptions and payments

Win the Numbers offers an optional, auto-renewing ad-free subscription, purchased and billed entirely through the Apple App Store. We never receive or store your payment card or Apple ID credentials. See "Subscription data (via RevenueCat + Apple)" above for what purchase-related data we and our subscription-management processor, RevenueCat, receive, and "Where your information lives" for where that data is kept. You can cancel or manage your subscription at any time through Apple's subscription management (Settings → [your name] → Subscriptions on your device), and you can restore a prior purchase in-app.

Changes to this policy

We will update this policy whenever our data practices materially change, and we will revise the effective date above when we do. We will note material changes in the app and/or on this page before or as they take effect.