Privacy Policy

Last updated: March 12, 2026

YFB Copilot ("we", "our", or "the app") is a Yahoo Fantasy Baseball companion tool that helps managers optimize lineups, track rosters, and prepare for drafts. This policy explains what data we collect, how we use it, and your rights.

1. What Data We Collect

We collect only what is necessary to operate the app:

Yahoo OAuth tokens — an access token and refresh token issued by Yahoo when you log in. These allow us to read your fantasy baseball league and roster data on your behalf.
Yahoo profile data — your Yahoo GUID, display name, and profile image URL, used to identify your session and personalize the UI.
League and team data — your fantasy leagues, rosters, and transactions, fetched from the Yahoo Fantasy Sports API on demand.

We do not collect passwords, payment information, or any data unrelated to fantasy baseball.

2. How We Use Your Data

To authenticate you with Yahoo and maintain your session.
To retrieve your fantasy baseball leagues, rosters, and player data from Yahoo.
To generate lineup recommendations, draft analysis, and waiver wire insights.

We do not sell, rent, or share your data with any third parties.

3. How We Store Your Data

OAuth tokens are stored in a secure Redis cache (Upstash) keyed to your session ID. Tokens expire automatically and are refreshed as needed.
Profile data (name, display image) is persisted in Google Firestore to provide continuity across sessions.
All data is stored in Google Cloud infrastructure (us-central1 region).

4. Yahoo OAuth

YFB Copilot uses Yahoo's official OAuth 2.0 authorization flow. When you click "Sync with Yahoo," you are redirected to Yahoo's own login page — we never see your Yahoo password. Yahoo issues us a limited-scope access token after you grant permission.

5. Data Retention

OAuth tokens are retained only for the duration of your active session and expire within Yahoo's token lifetime (typically 1 hour, with refresh tokens valid for longer). Profile data in Firestore is retained until you request deletion.

6. Your Rights

You can revoke this access at any time in your Yahoo account security settings.

7. Changes to This Policy

We may update this policy as the app evolves. Significant changes will be noted with an updated date at the top of this page.