Legal
Last updated July 23, 2026
This Privacy Policy explains what information Points Per Rival ("PPR", "we", "us") collects, how we use it, and the choices you have. It applies to pointsperrival.com and related services.
When you register or claim a team, we store your email address, username, display name, and a securely hashed version of your password. We never store your password in plain text.
Requesting access through our "Get Access" page collects your name, email, and (optionally) phone number, plus whether you commission or play in fantasy leagues and how many. If you leave a message or question on that form, we store that text too. Submitting the form provisions a PPR account for you, which stays inert — unable to sign in — until you verify your email.
We store profile details you choose to add (such as a bio or avatar) and the fantasy data entered into PPR — team names, weekly scores, rosters, standings, and league history.
Some platforms (currently ESPN) require your own session credentials to read a private league on your behalf — for ESPN, this is the espn_s2 and SWID cookies from your ESPN account. We encrypt these before storing them (AES-256-GCM), never display them back to you or anyone else after you submit them, and use them only to sync the league you connected. You can disconnect a platform at any time, which removes the stored credential.
To operate and secure the service we log technical information such as IP address, timestamps, and basic request metadata. Failed authentication attempts are logged with IP and timestamp for abuse prevention.
If you check the marketing consent box on the Get Access form, we may email or text you product updates, release notes, and launch news. This is off by default, opt-in only, and you can withdraw consent at any time by contacting us (see Your Rights) or using the unsubscribe link in any marketing email.
We do not sell your personal information.
PPR uses a single essential, httpOnly session cookie to keep you signed in. It is not used for advertising or cross-site tracking. Disabling it will prevent you from logging in.
We rely on a small set of trusted providers that process data on our behalf. Each is bound by its own terms and privacy practices:
As features roll out, we may also connect to Yahoo Fantasy Sports (via their official OAuth login — we never see your Yahoo password), an NFL scores provider (for live scoring), and Anthropic's Claude AI (to generate optional matchup recaps). This policy will be updated as those services go live.
We keep your information for as long as your account is active or as needed to provide the service. You may request deletion of your account and associated personal data at any time (see Your Rights). Some records may be retained where required for security or legal reasons.
We protect data with scrypt password hashing plus a server-side pepper, httpOnly session cookies, database-backed rate limiting on sensitive endpoints, audit logging of sensitive actions, and security headers including a content security policy. No system is perfectly secure, but we work to safeguard your information.
You may request access to, correction of, or deletion of your personal data, disconnect a platform credential (e.g. ESPN cookies), or withdraw marketing consent at any time. To exercise these rights, contact admin@pointsperrival.com from the email associated with your account.
PPR is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will remove it.
We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above. Continued use of PPR after an update constitutes acceptance of the revised policy.
Questions about your privacy? Reach us at admin@pointsperrival.com.
