Skip to content
Gloatroom
Log inOpen your Room

Privacy

Last updated October 16, 2026

Gloatroom is a private Room for your fantasy league: the whole product is built around the idea that what happens in your Room stays in your Room. This page says, in plain language, what we collect, why, where it lives, and how to get it out.

What we collect

  • Your account. An email address or phone number (whichever you sign in with), and, if you use Google sign-in, your name and email from Google. We never see or store passwords; sign-in is by emailed magic link, texted code, or your Google account.
  • Your Room. Messages, reactions, pinned posts, and images you share in The Room; your display name; your Room membership and role.
  • Your league data. Connect reads from Sleeper's public API: we look up the username or numeric ID you enter. The username is not verified as yours. We read and store league names, league settings, rosters, team names, standings, weekly matchup scores, trades, and waiver and add/drop transactions, including roster and player IDs. This includes past seasons back to 2017 where available. We read members' public display names and team names to label teams. For your link, we store the username, user ID, display name and avatar URL. League data refreshes on a schedule. Imported Sleeper league data belongs to the Room and is kept while the Room exists. Disconnecting removes your link, including the stored username and ID, but does not delete league data. Imported leagues keep refreshing from Sleeper's public data after you disconnect. Your claimed team stays linked to your account in the Room. Deleting your account removes your link, not the Room's shared history. Sleeper leagues connect for NFL and NBA. Yahoo, ESPN and other providers do not connect. MLB and NHL have no provider connection. Historical Yahoo imports and encrypted connection rows remain preserved, but Gloatroom no longer creates, refreshes, or uses Yahoo connections.
  • Notifications. If you turn on push notifications, your browser gives us a delivery address (a push subscription) plus your notification preferences. Turning notifications off deletes the subscription.
  • Visit counts. When you open certain pages or use the league builder, the page tells our own server which page or step it was, when, and which campaign tag the link carried (for example utm_source=whatsapp), along with a random ID made fresh each time the page loads. There is no cookie, nothing saved on your device and no link to your account. Counts are kept in our hosting provider's logs, which also hold standard request details such as IP address. Our server uses your IP address only to stop abuse with a short rate limit.

We do not run ads, sell data, or use third-party analytics or tracking scripts. Anonymous visits to this website set no cookies.

What we can't do

Provider access is read-only by design. We cannot set lineups, make trades, place waiver claims, or change anything in your provider account. Leagues you run on Gloatroom are managed inside Gloatroom itself. Provider credentials stay on the server and are never sent to your browser.

Where it lives

These services process data on our behalf (our subprocessors):

  • Supabase: database, authentication, realtime chat, and image storage. Every table is protected by row-level security: members of one one Room cannot read another Room's data.
  • Vercel: hosts the website and application.
  • Google: optional sign-in. Google Sheet league imports are unavailable; previously imported league data remains preserved.
  • Sleeper: the public, read-only API supplies NFL and NBA league data through Connect. No Sleeper password or API token is required.
  • Your browser's push service (for example Google or Apple's): delivers push notifications if you opt in.

How long we keep it

The Record Book is the point: league history, records, and receipts are kept for as long as your Room exists, so a season played in 2026 is still there in 2036. Chat and images follow the Room the same way. Imported Sleeper league data belongs to the Room and is kept while the Room exists. Disconnecting removes your link, including the stored username and ID, but does not delete league data. Imported leagues keep refreshing from Sleeper's public data after you disconnect. Your claimed team stays linked to your account in the Room. Deleting your account removes your link, not the Room's shared history. Disconnecting a provider deletes its stored tokens, if any. Leaving a Room removes your access; the group's shared history stays with the group.

Getting your data out, or gone

  • Disconnect a provider any time in Settings: its tokens, if any, are deleted immediately. Sleeper uses no token; disconnecting removes your stored link, not the Room's imported league data.
  • Leave a Room any time in Settings.
  • Export your data yourself: Settings has a Download my data button that hands you a JSON file of everything we store about you (never your provider tokens).
  • Delete your account: contact us via the support page and we'll complete it within 30 days.

Security

Everything is served over HTTPS. Provider tokens are encrypted at rest. Database access is enforced row-by-row so Rooms are isolated from each other. If you believe you've found a security issue, please tell us through the support page. We take reports seriously and respond quickly.

Changes

If this policy changes in a way that matters, we'll say so in the app before the change takes effect. The date at the top always reflects the current version.