This policy explains what RotoCore ("we", "us") collects when you use https://www.rotocore.com, why, and the choices you have. We keep it short because we keep the data we collect short.
What we collect
- Account details: your email address and a hashed password. We do not ask for your name, address, phone number or date of birth. At signup we record that you confirmed you are 18 or older and accepted the Terms, and when.
- Optimizer settings: the defaults, exposure limits and other preferences you save so they load next time.
- Purchase records: when you buy a Season Pass we store the amount, date and Stripe's identifiers for the payment so we can show you your purchase history and handle refunds. Your card number never reaches us; Stripe collects and stores it.
- Technical logs: our servers and error-monitoring service record the pages requested, the response, your IP address and browser type, and any error that occurred, so we can keep the site running and fix bugs. Failed sign-in attempts are recorded with the IP address and email used, to block password guessing.
What we don't collect
- DraftKings or other DFS credentials. We never ask for them and there is nowhere to enter them.
- Advertising or cross-site tracking data. There are no ad networks, no advertising pixels, no analytics that follow you to other sites, and we do not sell or rent your data to anyone.
Lineups you build
Lineups are generated on our servers on request and returned to your browser, where your build history is kept. Results are held on the server only briefly so your browser can fetch them, then removed. We do not review individual users' lineups or share them with anyone.
Cookies
We use only the cookies needed to run the site: a session cookie that keeps you signed in and a security cookie that protects forms from forgery. Neither is used for tracking or advertising, and both are set only for this site. Your browser can clear them at any time; you would simply need to sign in again.
Services we rely on
- Stripe processes payments and handles your card details under its own privacy policy.
- Resend delivers our emails (verification, welcome, password reset and purchase-related messages).
- Heroku and Amazon Web Services host the application and its static files.
- Sentry receives error reports so we can fix problems; reports include technical details of the failing request but not your password or payment details.
- Google Fonts serves the site's typefaces; Google may receive your IP address and browser details when the fonts load.
- Data providers (DraftKings public contest data, sportsbook odds and injury news feeds) supply the player data you see. We send them nothing about you.
We send account emails: verifying your address, welcoming you, resetting your password and confirming purchases or refunds. We do not currently send marketing email. If we start, every such message will carry an unsubscribe link and you will not receive any unless you have opted in.
How long we keep things
- Account details and settings: while your account exists.
- Purchase records: seven years, as tax and payment-dispute rules require, even after account deletion.
- Server and error logs: rolled off within 90 days.
- Failed sign-in records: cleared automatically after the lockout period.
Your choices and rights
- Delete your account yourself from your profile page. Your email address, settings and sign-in history are removed immediately; purchase records are kept as described above but are no longer linked to a usable account.
- Change your password from your profile, or reset it from the sign-in page.
- Ask for a copy of the data we hold about you, or for a correction, by emailing support@rotocore.com from your account address. We answer within 30 days.
If you are in the European Economic Area, United Kingdom or California, these rights are backed by GDPR, UK GDPR and the CCPA respectively; the same email address is the way to exercise them.
Security
Traffic is encrypted with TLS. Passwords are stored as salted hashes. Access to production systems is limited to the people who run RotoCore. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly by email.
Children
RotoCore is for adults. We do not knowingly collect data from anyone under 18, and we delete any such account we become aware of.
Changes
If this policy changes materially we will update the date above and email account holders before the change takes effect.
