The Front Office

Privacy Policy

Last updated 13 November 2026

The Front Office is a fantasy football app at thefrontoffice.com, run by The Front Office Inc. (“we”, “us”). This policy says what we collect about you, why, who sees it, how long we keep it and what you can do about it. The short version: we collect what the app needs to run your leagues, we don't sell it, we don't show ads, and we don't track you around the web.

1. What we collect

Your account

  • Your email address and password. You sign in with them; there is no sign-in through Google, Apple or other services. Your password is stored scrambled (hashed) by our sign-in provider, and nobody can read it, us included.
  • When your account was made and when you last signed in.

What you put in the app

  • Your team names, your @name (it is the same in every league you're in) and any logo you upload for a team or a league.
  • League chat messages, your votes on contract offers and any note you add to a vote.
  • Photos and voice messages you send in a league's chat. We shrink each photo and remove what the phone kept inside it, such as where it was taken and the camera's details. The app uses your microphone only while you are recording a voice message, and your camera only through your phone's own camera when you choose to take a photo; your phone asks you first.
  • How far you have read your league's chat: the newest message you had on screen, and when, kept for each team and updated as you read.
  • A note you send when asking to join a league (for example, your name and who invited you).
  • Your moves in each league: lineups, draft picks and bids, waiver claims, trades and trade offers, and anything else you do in a league.
  • League dues: whether you have paid. If you are a commissioner, the payment link, instructions and any cryptocurrency receiving addresses you give for your league's dues.
  • Answers you give on trade idea cards, and any reason you type with them.
  • Your Confidence Man picks, in a league that plays it.
  • In a mock draft: the name you type for your seat and the picks made in it (in an auction, the players put up, the bids and the passes).

From your device

  • Your internet (IP) address, for security. It is checked when you sign in, to stop automated sign-ups and password guessing, and passed to our sign-in provider for the same purpose. If you type a wrong league code, we keep your address with that attempt for one day, to stop people guessing codes. When you take a team, we keep a scrambled fingerprint of your connection (not the address itself), so a commissioner can see when two teams were claimed from the same connection.
  • If you turn on phone or browser alerts, the address your device's alert service gives us to deliver them.
  • Our hosting provider's ordinary request logs, which include addresses and the pages asked for.

We don't collect your real name (unless you type it somewhere), your phone number, your location, your contacts or your birth date. We don't use analytics or advertising tools.

2. How we use it

  • To run the app and your leagues: scores, rosters, drafts, trades, contracts, chat and everything else.
  • To send you the emails and alerts the app sends: sign-in and password links, notices when your sign-in email changes, join requests and their answers, draft-day budget warnings, the daily summary and alerts you turn on.
  • To keep the app safe: stopping spam sign-ups, password and code guessing, and one person taking several teams in a league.
  • To improve the app. For example, we read the answers given on trade idea cards to make the ideas better. When a new account is made, the people who run the app are told, with its email address.
  • To answer you when you write to us, and to follow the law.

3. Who sees what

Inside the app

  • Everyone in your league sees your team names, @name, team logo, rosters, lineups, scores and moves, the league's chat and how far each team has read it (your team's logo sits beside the last message you have seen), votes and their notes, the commissioner's dues payment details, and the league's commissioner log, which records changes and names the teams and @names involved. Where unpaid dues limit what a team can do (in a draft, for example), the league can see that too.
  • Trade offers are seen only by the teams in them until a trade goes through; then the league sees the trade. Some league features show past offers to the league once a trade is settled.
  • Confidence Man picks are seen only by you until that game kicks off; then everyone in the league sees them. Before then the league sees only how many picks you have made that week.
  • Mock drafts belong to no league. Anyone with a mock draft's link can watch it and see the name you typed for your seat and your picks (in an auction, your bids and passes), never your email. A rehearsal of your league's next draft can be made only by one of its managers; it copies your league's team names, the players each team keeps and its draft money into the room, where anyone that manager gives the link to can see them.
  • Your league's commissioner also sees your sign-in email when you ask to join or while the league is filling, your join note, whether you have paid dues, and when two teams were claimed from the same connection. A commissioner can download a backup of the league's record, which includes @names, team names, notes and the commissioner log, but not emails or chat.
  • Photos and voice messages in a league's chat are seen only by the people running a team in that league, who open them with their own sign-in; they are not at a public address.
  • Logos you upload are stored at public web addresses, so anyone given that address can open the picture.
  • The people who run the app can see the app's data when they need to, to run it, fix it and keep it safe.

Companies that help us run the app

They handle your information only to provide their service to us:

  • Supabase: our database, sign-in, file storage and live updates (servers in the United States).
  • Vercel: hosts the app and runs its scheduled jobs (servers in the United States).
  • Cloudflare: the “are you human” check on the sign-in page, which sees your address and browser.
  • Resend: sends our emails, so it handles your email address and what each email says.
  • Apple, Google, Mozilla and Microsoft: deliver phone and browser alerts, which are encrypted on the way.
  • Anthropic: helps write trade ideas where they are turned on. It receives only numbers about rosters, records and contracts, with teams and players replaced by letters. Never names, emails, @names or anything you typed.
  • OpenAI: draws some of the app's artwork from NFL team colours. Nothing about you is sent.

Sleeper and ESPN. We get NFL scores, stats and news from them; we never send them anything about you. Player photos and team logos load in your browser straight from their servers, so they see your address, as any website you visit does.

Nobody else

We don't sell your information or share it for advertising. We give it to others only if the law requires it, to protect people or the app from harm, or if the app or The Front Office Inc. is sold or merged. In that case this policy's promises go with your information.

4. Cookies and what's kept on your device

  • A sign-in cookie keeps you signed in on that device until you log out.
  • A few small cookies remember things for you: the league page you were on (for a day), an invite you opened before signing up (for a week) and how you like Matchup shown.
  • Your browser keeps some settings (alerts, draft sounds, your draft queue, which cards you've seen) and a copy of your list of leagues, so the app opens quickly. That copy is used for 14 days at most and wiped when you log out.

There are no advertising or tracking cookies. Because we don't track you across websites, there is nothing for a browser's “Do Not Track” or Global Privacy Control signal to switch off.

5. How long we keep it

We keep your information while you have an account. You can delete your account at any time from Your account, “Delete my account”. That deletes your sign-in (email and password) and your alert addresses, and takes you out of every league. Your teams stay in their leagues, with their players and contracts, for a new manager.

Because leagues are shared with other people, some of what you did stays in them after you go: chat messages (under the team's name; each league keeps its newest 1,000, and a photo or voice message is deleted with its message), past votes and notes, trades and other league history, the commissioner log, your @name as the team's former manager, and the connection fingerprint from when you took the team. Answers you gave on trade idea cards are kept too, and a logo you uploaded stays in storage at its address. If you want any of this removed, write to us and we'll delete or anonymise what we can without breaking other people's league records.

Other things go on their own: wrong league-code attempts after a day, records of which cards you have seen after 120 days, Confidence Man picks after two seasons, a mock draft a week after its last pick, and our sign-in provider's security log after 30 days. Backup copies are replaced over time.

6. Your choices and rights

  • Change your email or password from Your account.
  • Turn off the daily summary email with the “Stop these emails” link in it, or from your league's menu. Some emails always go, because the app needs them: sign-in and password links, security notices, join requests and their answers, a notice if you become a league's commissioner, and draft-day budget warnings.
  • Turn alerts off in the app or in your device's settings.
  • Delete your account, as above.
  • Ask us for a copy of your information, or to correct or delete it, by writing to league@thefrontoffice.com. We'll answer within 30 days, and you won't be treated differently for asking. Depending on where you live, the law may give you more rights; we honour them.

7. Children

The app is not for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has an account, tell us and we'll delete it. Users under 18 need a parent or guardian's permission (see the Terms of Use).

8. Keeping it safe

Everything travels encrypted (HTTPS). Passwords are hashed, the database only lets each person reach what the app allows them to, and our keys are kept on the server. No system is perfectly safe, so we can't promise nothing will ever go wrong. If something does that affects your information, we'll tell you as the law requires.

9. Where your information is kept

In the United States. If you use the app from another country, your information is sent to and kept in the United States.

10. Changes to this policy

We'll change this policy when the app changes what it collects or how it uses it. The date at the top says when it last changed. If a change is important, we'll tell you in the app or by email before it takes effect.

11. Contact us

Questions or requests about your information: league@thefrontoffice.com. The Front Office Inc. runs The Front Office.