The short version: we read public league data, we store your league's history to make the jokes better, and we don't sell anything about you to anyone.
Public fantasy-league data (team names, rosters, picks, scores) for leagues you submit; the purchaser's email (via Stripe) to deliver setup and receipts; usage analytics, described below. Viewers need no account and give us nothing.
Ours. Two first-party cookies, neither identifying you, plus Google's, described below. One remembers which version of the landing page you were shown so it stays consistent. The other records where you arrived from — an ad campaign name, or "direct" — so we can tell which advertising is worth paying for. Both last 30 days, hold no personal data and no per-visitor identifier, and are never shared. If somebody sends you a link to a finished report, that arrival is counted separately and is never attributed to whoever paid to bring the first reader in.
Where readers are. When a report is opened we record the reader's state and country against that league, and the city of visitors to the site as a daily aggregate that is never tied to a league or a person. We never store a precise location or an IP address ourselves, and none of it identifies you. To stop one person burning the free tool for everybody we count recent generations against a salted one-way fingerprint of your address, which we cannot turn back into the address, and which is discarded after two hours.
Google Analytics. We use Google Analytics 4 to understand how people move through the site — pages viewed, whether a report got generated, whether it got read to the end. Google is a third party and receives your IP address, which it uses to approximate your location and then discards. We do not send it your name, your email, or your league's contents.
What it stores, and where. Advertising and personalisation consent are denied
everywhere, for everybody, with no exceptions — we do not run remarketing and never will from this
data. Analytics consent depends on where you are. In the EEA, the UK and Switzerland it is denied
by default: Google Analytics stores nothing on your device and what comes back to us is modelled
and aggregated. Everywhere else it is granted, which means Google sets a first-party
_ga cookie that lasts two years and holds a random identifier — not a name, not an
email, and nothing we can turn back into you.
Opting out is easy and we would rather say so than hide it. Google's
browser add-on switches it off, and
blocking googletagmanager.com does the same. The site works exactly the same either
way, and a fair number of our visitors already do.
We use Cloudflare Turnstile in invisible mode to keep automated abuse off the free tool. It runs silently and is covered by the Cloudflare Turnstile Privacy Addendum.
No data sales, no advertising pixels, no per-visitor identifier of our own, no card data (Stripe handles payment entirely). We do buy ads pointing here, and we count how many people each campaign brings — as totals, never as individuals. We used to say "no third-party analytics" and that stopped being true the day we added Google Analytics; the section above says exactly what it does, because a privacy page that has gone stale is worse than not having one.
League history persists so multi-season commentary works. Want your league's data gone? Email support@roastmydraft.com and it's deleted within 7 days.
Contact: support@roastmydraft.com · Seam Water Consulting LLC · Updated 1 Sep 2026