Effective 2026-09-17. Plain English on purpose. If anything here is unclear, ask: hello@dfsroto.app.
The short version
Your DraftKings files are parsed in your browser and never leave it. We do not have accounts, passwords, or a mailing list. Analytics are cookieless. Stripe handles payment; we keep a device token and a hashed email for restoring a pass. That is the whole list.
What we store
A device token — a random id your browser generates and keeps in its own storage, used only to look up whether that browser holds a pass.
Pass records — plan, expiry, the Stripe session id, and a one-way hash (SHA-256) of the email on your receipt so a pass can be restored on another device. We cannot turn the hash back into your email.
Contest aggregates you choose to contribute — ownership tables, duplicate counts, and the top 1% of lineups from a contest standings file, with usernames and entry ids removed in your browser before sending. These are public on the winners page.
Analytics — self-hosted Plausible, no cookies, no cross-site tracking, no personal identifiers; page views and a few product events (a build, an export, a pass viewed). Your IP is used to resolve a country and is not stored.
Your settings — projection edits, locks, and build settings stay in your browser's local storage. They are never sent to us.
What we never store
Card numbers (Stripe holds them), passwords (there are none), your DraftKings username, your salary or lineup files, your lineups, your email in plain text.
Third parties
Stripe processes payments under its own privacy policy. Cloudflare serves the site and stores the records above. Google Fonts serves the typefaces. Data sources (ESPN, Pinnacle, Kalshi, nflverse) receive requests from our servers, not from you.
Retention
Pass records expire with the pass plus a grace period. Contest aggregates are kept indefinitely as part of the public archive. Analytics are aggregated and kept indefinitely.
Your rights
Email hello@dfsroto.app to have a pass record or a contributed contest removed, or to ask what we hold that could be linked to you (with a device token or receipt, it is at most the pass record). Residents of California, the EU/UK and other jurisdictions with data-protection law have the rights those laws give; we honor them without needing to be asked twice.
Children
dfsroto is for adults. We do not knowingly collect anything from anyone under 18.
dfsroto is independent software and data, operated from Texas, USA. Not affiliated with, endorsed by, or sponsored by DraftKings, Kalshi, Pinnacle, ESPN or the NFL; their names are used only to identify the data. Terms · Privacy · Data policy