PRIVACY
PLAYBOOK.

What this league stores

When Google OAuth is configured, GRIDIRON 2000 stores the name, email address, and provider identifier returned by Google so one account can be mapped to one league seat. It also stores league actions such as draft readiness and picks.

Where it lives

The starter stores league state in the server-side JSON file configured by DATA_FILE . Authentication state lives in an encrypted, HTTP-only cookie. Google client secrets remain server-side environment variables.

Football data

The server reads the commissioner-approved public RSS, Atom, and Bluesky sources and caches open nflverse schedules, injury reports, and weekly player statistics. Source text is kept only in rewriteable current state; an upstream social deletion removes that text. The metadata journal retains provenance, hashes, rules, trust tiers, and timestamps so the league can audit its own classifier.

A signed-in manager may submit a short summary, source name, optional link, and sighting type. Their display name is retained with the sighting inside this private league. Local data exports require a private bearer token. GRIDIRON 2000 does not store NFL+ or PrizePicks credentials and does not authenticate to betting or paid sports-data services.

Your controls

Ask the commissioner to remove your league assignment and stored identity. Signing out destroys your current authenticated session.