Privacy policy

1. Who is responsible

Hesi Fantasy is operated by ZIH-CHENG WEI, an individual based in Taiwan, who is responsible for the personal data described here. Contact: [email protected].

2. What we collect

• Account: your email address and a securely hashed password (never the password itself). If you sign in with Google, we receive your email and Google's account ID for you; we don't store your name or photo.
• Synced settings: if you're signed in, the settings you choose to sync — league and scoring settings, your Draft Kit board, starred and avoided players.
• Messages: what you send through the contact form — your email, message, any screenshot and, if you leave the box ticked, the app version and browser.
• Subscriptions: when Pro is available, Paddle tells us your subscription status, plan and email. Paddle handles the payment itself.
• Server logs: standard request data such as IP address, time and requested page.

3. What stays on your device

Without an account, your settings, Draft Kit and starred players stay in your browser or the desktop app and are never uploaded. Your sign-in token always stays on your device.

4. How we use it

To run the service and sync your settings, to send emails you ask for (like password reset links), to reply to your messages, to manage subscriptions, and to keep the service secure. We don't sell personal data, show ads or use your data for advertising.

5. Services we use

We share only what each service needs to do its job:

• Paddle — checkout, payments, tax and invoices, as our merchant of record. Paddle processes your payment details under its own privacy policy.
• Google — only if you choose “Continue with Google” to sign in.
• Resend — sends our emails, such as password reset links.
• Cloudflare and Vercel — network, security and hosting for the website and app.
• Ko-fi and ECPay — only if you choose to send a tip from our Support page; they handle that payment under their own policies.

These services may process data outside your country, including in the United States.

6. How long we keep it

Account data and synced settings are kept until you delete your account. Contact messages are kept for up to two years. Server logs are kept for up to 30 days unless needed to investigate abuse. Paddle keeps payment records as tax law requires.

7. Your rights

You can export your synced settings and delete your account at any time from Account settings. You can also email us to access, correct or delete your data, or to object to how we use it. If you are in the EU or UK, you can complain to your local data protection authority.

8. Cookies and storage

We don't use advertising or tracking cookies. The app stores your settings and sign-in token in your browser's local storage, and Google sign-in sets one short-lived security cookie on our server's domain.

9. Children

Hesi Fantasy isn't meant for children under 16, and we don't knowingly collect their data.

10. Contact

Questions? Email [email protected] or use our contact form.