Privacy Policy

Last Updated: October 18, 2026

SquatchyPicks (squatchypicks.com), operated by SpiralOrbit LLC ("SquatchyPicks," "we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Services. It is written to describe what the site actually does. If you do not agree, please do not use the Services.

1. Scope and Data Controller

This Policy applies to personal information we collect when you visit squatchypicks.com, use our applications or APIs, or communicate with us. SpiralOrbit LLC (operating as SquatchyPicks) is the "controller" of your personal information under applicable data-protection laws.

SpiralOrbit LLC operates other products, but your SquatchyPicks account is not shared with them. There is no single sign-on between SquatchyPicks and any other SpiralOrbit product; your account, sign-in records and linked fantasy platforms are kept in SquatchyPicks' own database, and payments run through a Stripe account dedicated to SquatchyPicks. The one thing SquatchyPicks does take from a sister product is advertising: the ad images shown on the free tier are served from media.aibandstudio.com, a domain of SpiralOrbit's AI Band Studio (see Section 5.1).

2. Information We Collect

2.1 Information You Provide

• Email address: the only account credential. Sign-in is by a single-use link or code that we email to you; there is nothing else to set, remember or leak, and there is no Google, Microsoft or other social sign-in.
• Sleeper handle: the Sleeper username or user ID you enter to sync your leagues. We use it to retrieve public, read-only league, draft, and roster data from Sleeper's API. A Sleeper handle can be used without an email account at all.
• Other fantasy-platform credentials, if you connect them. If you choose to connect another fantasy platform, we hold the credentials or cookies that platform requires to read your league (for example, cookies you paste from your own browser, the access and refresh tokens a platform issues after you approve us, or credentials taken from a league link you paste). These are stored encrypted in your browser session and, if you are signed in, encrypted with your account, until you disconnect it or ask us to delete your data. They let us read league, draft and roster data on your behalf; we never ask you to log in to any of these services through us.
• Payment information: billing details are entered on and processed by Stripe. We receive and keep Stripe's customer and subscription identifiers and the status of your plan. We do not store card numbers.
• Preferences & settings: selected leagues, scoring/format settings, saved composite weights, the ads on/off preference for Pro members, and your cookie choice.
• Ask-the-Guru requests: when you press "Ask the Guru" during a draft, the current state of that draft board (players taken, your roster, your league's scoring) is sent to Anthropic's Claude model to produce the recommendation. Other managers in the draft appear in that request only as "Team 1", "Team 2" and so on; the league name is not sent. Ask the Guru needs an account with a verified email. See Section 5.1.
• Communications: messages, support requests, and feedback you send us.

2.2 Information About Other Managers in Your Leagues

When you load a league or draft, the platform returns the other managers' display names, team names, platform user ids and draft picks. We show them to you on the draft board and use them to predict upcoming picks. If you are signed in and open a manager's tendencies in a draft that manager is in, we read that manager's public Sleeper draft history to rank the players they tend to take, and keep the result in a cache for up to 7 days. Our observed-ADP store keeps the picks made in drafts but not who made them. A manager who wants this data removed can contact privacy@squatchypicks.com.

2.3 Information Collected Automatically

• Sign-in records: each time you sign in with a magic link or connect a Sleeper account or another fantasy platform you choose to connect, and at most about twice a day while you keep using the site, we record the time, your IP address and your browser's user-agent string. If location lookups are switched on, we look up each IP address's approximate location (city and country) in an offline geolocation database that runs on our own server, and keep that result; the IP address is not sent to anyone for this. These records are used for the operator's sign-in map, abuse detection and rate limiting. Events from visitors with no account or Sleeper handle are not recorded.
• First-touch attribution (only if you accept cookies): the first time a browser that has pressed Accept arrives from outside the site we note the referring site and page (without its query string), the landing page and any utm_source, utm_medium, utm_campaign and utm_content tags on the link. If that browser later creates an account, those values are written onto the account once and are not updated afterwards. They tell us which campaign brought you here.
• Device & log data: device/browser type, IP address, access times, referring URLs, and error/performance logs from our hosting provider.
• Usage data: pages and features used, drafts viewed, clicks, and navigation paths. Google Analytics only collects this if you have accepted analytics cookies; see Section 7.
• Cookies and similar technologies: see Section 7.

2.4 Information From Third Parties

• Sleeper and other fantasy platforms you choose to connect: league, draft, roster and player data associated with the handle or credentials you provide.
• Stripe: payment status, plan and subscription state, and fraud indicators.
• Google Analytics and Meta: usage reports and advertising performance reports. These arrive as aggregate reports; the underlying data those companies collect from your browser is described in Sections 5.1 and 7.

We do not purchase personal data from data brokers.

3. How We Use Your Information

4. Legal Bases for Processing (EEA/UK/Switzerland)

• Performance of contract: to provide the Services, operate your account, and process payments.
• Legitimate interests: to secure and improve the Services, prevent abuse, and market similar services to existing customers, where not overridden by your rights.
• Consent: for analytics and advertising cookies and for marketing; you may withdraw consent at any time.
• Legal obligations: to meet accounting, tax, and other legal requirements.

5. Information Sharing and Disclosure

5.1 Service Providers and Advertising Partners

These are the companies that receive personal information from SquatchyPicks, and what each one gets.

Ask at privacy@squatchypicks.com if you want to know more about any of them.

5.2 Legal, Business Transfers, and Consent

We may disclose information to comply with law or lawful requests, to protect rights and safety, and to enforce our Terms. In a merger, acquisition, financing, or sale of assets, information may transfer as part of the transaction. We may share information for other purposes with your consent.

6. Data Retention

There is no self-service delete button yet. Email privacy@squatchypicks.com from your account address and we will delete your personal data, or send you a copy of it, within a reasonable period (we target 30 days). A deletion covers your account, linked Sleeper handles and platform credentials, sign-in records, Ask-the-Guru history, saved preferences and weights; payment records Stripe must keep for tax and legal reasons are kept for the period in the table above. If you only ever used a Sleeper handle and never gave us an email, write to the same address with the handle; we may ask you to show you control it (for example by changing your Sleeper display name to a word we send you).

7. Cookies and Tracking Technologies

Nothing from Google or Meta loads until you accept. On your first visit a cookie bar offers two equal choices, Reject and Accept. Until you press Accept, the pages we send you contain no Google Analytics or Meta code at all, and nothing about your visit is sent to either company. If you press Reject, or simply ignore the bar, it stays that way. If you buy a subscription without having accepted, we do not send Meta a record of your purchase, and we do not store your IP address, browser details or Meta identifiers with your payment for that purpose.

You can change your answer at any time with the "Cookie choices" control at the bottom of every page. If you withdraw an earlier Accept, we tell Google and Meta to stop, remove their cookies from this site where your browser lets us, and reload the page without them.

Global Privacy Control (GPC) is honored automatically. If your browser or an extension sends a GPC signal, we treat it as your answer: the cookie bar does not appear on its own, nothing loads, and the Meta pixel and our server-side reporting to Meta stay off for you even if you later press Accept. If you do choose Accept through "Cookie choices", only Google Analytics runs, as measurement only, with advertising storage, advertising identifiers and ad personalization denied. You can also control cookies through your browser settings; disabling essential cookies may affect functionality. We do not currently respond to "Do Not Track" signals, as no uniform standard has been finalized.

8. Your Rights and Choices

• Access, correction, deletion, portability, restriction, objection, and consent withdrawal, subject to legal exceptions and depending on your location.
• Marketing email: we do not currently send marketing email. If we start, we will ask for your permission first, and every marketing email will carry an unsubscribe link. Transactional emails (sign-in links, billing notices) are sent as needed.
• Advertising opt-out: Reject on the cookie bar, "Cookie choices" in the footer, or a Global Privacy Control signal (Section 7).
• Disconnect a platform: remove the stored credentials for another fantasy platform you connected on the Setup page at any time.
• Account controls: review and update account information on the Account page.

To exercise these rights, contact privacy@squatchypicks.com. We may verify your identity and will respond within the timeframes required by law (generally 30–45 days).

9. Data Security

We use reasonable technical and organizational measures: encryption in transit (TLS) and at rest on Microsoft Azure, single-use sign-in links and codes that expire in minutes, rate limits on sign-in and platform-connect requests, access controls and monitoring. Because sign-in is by emailed link, there is no stored account secret for you to lose or for us to leak. The credentials or cookies for other fantasy platforms you give us are stored encrypted, in our database and in your session cookie, and can read your leagues on those platforms, so disconnect them on the Setup page if you stop using SquatchyPicks. No method of transmission or storage is completely secure; you provide information at your own risk.

10. Children's Privacy

The Services are intended for adults (18+; see the Terms of Service) and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact privacy@squatchypicks.com and we will delete it promptly.

11. International Data Transfers

Your information is processed in the United States, where we and the providers in Section 5.1 operate, which may have different data-protection laws than your country. Where required, we implement appropriate safeguards such as Standard Contractual Clauses and data-processing agreements.

12. U.S. State Privacy Rights

Residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana and other states with comprehensive privacy laws have rights to know, access, correct, delete, and port their personal information, to opt out of targeted advertising, the sale or sharing of personal information, and profiling, and to non-discrimination for exercising these rights.

We do not sell personal information for money. We do "share" it (California) and engage in "targeted advertising" (other states) in one way: if you accept advertising cookies, Meta collects data about your visit and purchase as described in Section 5.1, and we use it to show our own ads to recent visitors. The categories involved are identifiers (cookie ids, hashed email, IP address), internet activity (pages viewed, purchase) and device information. To opt out, press Reject on the cookie bar, use "Cookie choices" in the footer, or send a Global Privacy Control signal, which we honor as an opt-out (Section 7). We have not sold or shared the personal information of anyone we know to be under 16. To exercise any other right, contact privacy@squatchypicks.com. Nevada residents may opt out of the sale of covered information (we do not sell it).

13. European Privacy Rights (GDPR/UK GDPR)

If you are in the EEA, UK, or Switzerland, you have the rights in Section 8 plus the right to lodge a complaint with your local supervisory authority. We process data on the legal bases in Section 4 and honor consent withdrawal without affecting prior lawful processing. For data-protection inquiries, contact privacy@squatchypicks.com.

14. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date shows the latest revision. For material changes we will provide additional notice (e.g., a prominent notice on the site or an email). Where required by law, we will obtain your consent. Continued use after changes take effect constitutes acceptance.

15. Contact Us