How QuantRoster Works

In your browser, never sent to us unless you use a feature that needs it:

• a random device ID. It isn’t tied to your name; it’s tied to your email only if you sign in on this browser. It’s how the site recognizes your browser’s saved leagues;
• the leagues you connected: each one’s platform, league ID, name, season, size and your team, when you connected it, whether it came from this browser or your account, and, if you found it by your Sleeper username, your Sleeper user ID;
• your scoring settings;
• your view preferences;
• any projection adjustments you make on the lineup board. Those stay in your browser.
• if you sign in, a token that keeps you signed in on this browser, and a note of any of your account’s leagues you disconnected here, so they aren’t brought back. Signing out removes the token;
• a live draft in progress, so a reload can pick it up: its settings, your draft slot, the picks made so far, a random access token for that draft, and, for a draft that follows Sleeper, that draft’s ID and your Sleeper user ID. Ending the draft removes it;
• when you first opened the site and when you last said “Not now” to installing it, so we don’t ask too often, and when a page last reloaded itself after one of its files failed to load;
• where you were on a page (its tab, view and how far down), so Back returns you there. This is kept only until you close the tab;
• copies of the pages you opened, of the site’s own files, and, for up to 15 minutes, of the answers our API gave those pages (for a connected league that includes its lineup, waivers, matchup and history), so the site still opens when your connection is slow or gone;

Clearing your browser’s site data removes all of it.

On our servers:

• League connections. When you connect a Sleeper league or enter one by hand, we save the league’s ID, name, season, scoring, size and your team, and when you first connected it and last used it. For a league entered by hand we also save the roster you typed. These records are keyed to your device ID, or to your account once you sign in. For a league you enter by hand we store the device ID itself; connection records hold only a one-way hash of it, or of your account’s key. We keep these records until you ask us to delete them; disconnecting a league removes it from your browser, not from our servers.
• A live draft. While you run a live draft our API holds it in memory: the picks you log, the league’s size, scoring and your draft slot, a random token your browser made for that draft, and the IP address it was started from. It is never written to our database, and it is dropped after a day without use or when the API restarts.
• Email, if you sign up for updates. Your address, when you signed up, and whether you confirmed it. We email an address only after its owner confirms it through the link we send, and only for what you signed up for, such as the January grade of this season’s boards. An address that is never confirmed is deleted 30 days after its last confirmation link expires. Every email has an unsubscribe link, and unsubscribing deletes your address at once. The links we send are stored only as one-way hashes, with when each was sent, when it expires and when it was used.
• Your account, if you sign in. Your email address, when you first and last signed in, and the leagues you save to it. We keep your account until you ask us to delete it. Sign-in works by an emailed link. When you ask for a sign-in link we save the address you typed and when the link was sent, when it expires and when it was opened. We delete that record an hour after the link expires. We store only one-way hashes of the links and of your signed-in session, never a password. With each sign-in we keep when it began, when it was last used, when it ends (30 days on) and when you signed out. We delete that record 30 days after the sign-in ends. When you sign in on a device, that device’s saved leagues move to your account. The sign-in link carries a one-way mark of the browser that asked for it, so that only that browser moves its leagues without asking you first.
• Request logs. Each request’s IP address, time and page pass through our hosting providers’ logs, which they keep for a limited time. Our own API’s lines in those logs also say which league a request was for (its ID and your team’s number), a live draft’s ID, and, when you sign in, your account’s number. We use them only to keep the service running and to limit abuse. To limit abuse our API also counts requests by IP address, in memory, for up to an hour; the counts are never stored.
• Usage statistics. Vercel Web Analytics counts page views without cookies and without identifying you.

Other services we use:

• Railway, which hosts our API and database;
• Vercel, which hosts the website and runs its analytics;
• Resend, which delivers our emails (sign-in links, sign-up confirmations and the updates you ask for).