← dfsroto

dfsroto data policy — "no lawsuits ever", as code

Every network call in this repo goes through src/policy/fetch.ts. It refuses, at runtime, anything below.

  1. Canonical input is the user's own DraftKings CSV. DK publishes an "Export to CSV" link on every contest. The app is fully functional with only that file. Nothing in the paid path depends on us fetching from DK.
  2. Public DK JSON is a convenience layer only. www.draftkings.com/lobby/getcontests and /lineup/getavailableplayers* — unauthenticated, the same URLs DK's own lobby page loads. Rate-limited to one request per 30 s per host. Never run from a datacenter IP.
  3. Denylist, enforced: api.draftkings.com, sportsbook*.draftkings.com, *.underdogfantasy.com, *.prizepicks.com. These are bot-walled by their operators; the wall is the answer. No proxies (HTTP_PROXY/HTTPS_PROXY/ALL_PROXY set → refuse to start), no stealth, no spoofed browser fingerprints.
  4. Never authenticated. policyFetch strips Cookie and Authorization headers. No logged-in scraping, ever.
  5. Honest User-Agent. dfsroto/<version> (+dfsroto.win/policy). If a host blocks that UA, we stop, we do not disguise. (Bisected 2026-09-16: DK's WAF rejects any UA containing https:// — a scanner-signature rule; curl/8.7.1 and no-UA both pass. So: no URL scheme in the string. Still named.)
  6. Home-IP guard. Ingest refuses to run unless egress IP matches DFSROTO_HOME_IP (or DFSROTO_ALLOW_ANY_IP=1 is set explicitly for local dev with cached data).
  7. Tool, not operator. dfsroto sells projections and lineups. It never takes entries, holds funds, or sets odds. No sportsbook affiliate links (state vendor registration territory).
  8. Open sources we lean on and why they are open: ESPN's public scoreboard (carries DK lines as provider), Pinnacle guest API, official MLB/NHL league APIs, nflverse (open data on GitHub), Kalshi's documented public API (CFTC-regulated exchange; open data is its business model).

Test: test/policy.test.ts asserts every denylisted host is refused and every allowlisted host is rate-limited.