Privacy Policy

Gridiron GM is operated by Appstryk, LLC, which is the controller of the information described here.

Three kinds of thing, and nothing else:

• Account. When you sign in with Google or Apple we receive a stable user identifier and an email address. That is the whole of it — we do not receive your password, contacts, calendar or profile photo. If you sign up with an email address and a password instead, our authentication provider stores that password only as a salted hash; it is never visible to us and we cannot read it back.
• League data. The leagues you connect or enter: league name, scoring rules, team count, draft slot, and which players are on which roster. When you connect a platform league we also store its public identifier so we can re-sync it.
• Contact preferences. A mobile number, but only if you provide one to receive alerts, plus whether you have opted in to texts and email.

We also keep basic operational records — sync successes and failures, and server logs containing IP address and request path — to keep the service working and to prevent abuse.

We also never receive your password to any service, including the fantasy platform you connect. We do not use advertising trackers, third-party analytics pixels, or cross-site cookies. We do not build a profile of you for advertising, and we do not sell or rent personal information to anyone.

Apple Private Relay. If you sign in with Apple and choose to hide your email, we receive a relay address instead of your real one. That works perfectly well for us — we use it only to contact you, and your identity is the account identifier, not the address.

• To run the service — your league is what the whole product operates on.
• To keep you signed in across devices.
• To take payment and to honour refunds.
• To send alerts you asked for, and only those.
• To keep it working and secure — diagnosing failures, preventing abuse.

We use a small number of infrastructure providers. They act on our instructions and are not permitted to use your data for their own purposes.

We may disclose information if legally required, or to protect the rights and safety of our users. If the business is ever transferred, your data would move with it under this same policy, and we would tell you first.

When you connect a league, we read only what that platform already makes public through its own interface — league settings, rosters, draft picks and display names. We never ask for your platform password, and we cannot make changes to your league. Requests go through our servers so we can cache them; that also means the platform sees our infrastructure rather than your device.

• Account and leagues — until you delete them or ask us to.
• Payment records — as long as tax and accounting law requires, typically seven years.
• Server logs — a short operational window, then discarded.

You can access, correct, export or delete your information. Email privacy@appstryk.com and we will respond within 30 days. Deleting your account deletes your leagues, rosters and contact details; we keep only what payment records the law requires.

Texts and email. Reply STOP to any text to stop them, or HELP for help. Every email has an unsubscribe link. Opting out of marketing does not stop essential messages about a payment you made.

Depending on where you live you may have additional rights — for example under the California Consumer Privacy Act — including the right to know what we hold and to delete it. We honour those requests from everyone, not only where legally required. We do not sell or share personal information as those terms are defined under California law.

We use cookies for one thing: keeping you signed in. They are set only after you sign in, are not readable by scripts, and there are no advertising or analytics cookies to consent to. If you never sign in, we set none.

Data is encrypted in transit and at rest. Access to your rows is enforced by the database itself, not only by application code, so a bug in our code cannot expose another user’s league. Session cookies cannot be read by JavaScript. We test that separation between real accounts as part of our build.

No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant regulator without undue delay.

The service is for adults 18 and over. We do not knowingly collect information from children. If you believe a child has provided us information, email privacy@appstryk.com and we will delete it.

If we change this policy materially we will tell you before it takes effect. Questions or requests: privacy@appstryk.com.