Privacy

What we collect

When you create an account:

• Email address and username. Your email identifies the account and is how we would reach you.
• A password, stored only as a one-way hash. We cannot read it and cannot tell it to you.
• A Sleeper username, if you choose to give one, so we can match your fantasy identity.

As you use the site:

• A wallet. Either a Solana address you connect yourself, or one we generate and hold for you (see custody below).
• Your cards, and the packs you have opened.
• Your balance and a record of every movement in it — funds added, packs bought, prizes paid, marketplace sales.
• Your contest entries, including the lineups you submit and how they scored.

If you sign in with Google or Discord, we receive your email address and basic profile from them and nothing else. We do not receive your password with them, and we cannot act on your behalf on those services.

Custody, and what that means

You can hold your cards in your own Solana wallet, or let us hold them for you. If you choose the second, we generate a wallet and store its key so the site can move cards on your instruction. That is real custody: it means we hold the ability to move those cards, and you are trusting us with it. If that is not a trade you want to make, connect your own wallet instead — the option is on the sign-up form and in your account at any time.

The blockchain part

Cards are minted on Solana, a public blockchain. Ownership, transfers and sales are permanently visible to anyone, and we cannot delete or alter them. Your email is never put on-chain, but a wallet address that has been linked to you elsewhere can be traced to the cards it holds. This is how public blockchains work and it is worth understanding before you buy anything.

Who else sees your data

Only where the service cannot work without it:

• Crossmint — wallets and the card purchase flow. If you add funds by card or Apple Pay, Crossmint runs that payment and any identity checks it requires. We never see your card number.
• Neon — the database your account lives in.
• Vercel — hosting, which sees ordinary request logs.
• Helius — reads the Solana blockchain on our behalf.
• Sleeper — public NFL statistics. We send them player names, never yours.
• OpenAI — writes the GM commentary. It receives game and lineup data, not your identity.

We do not sell your data, and we do not share it for advertising.

What you can ask for

Email roddy@roster.rip and we will tell you everything we hold about you, correct anything wrong, or delete your account.

Two honest limits on deletion. Anything already recorded on Solana cannot be removed by us or by anyone. And we keep the financial ledger — what was paid in and out — because we are required to be able to account for money that moved.

Children

This site is not for children. You must be at least 21 to hold an account.

Changes

If this changes in a way that affects you, we will say so on the site rather than quietly editing this page.