Privacy Policy
Last updated September 16, 2026
Reading the site
Who the Experts Like, Highest Bids of the Week, this page and the rest of the free site ask nothing of you. No account and no email address.The only cookies on the free pages are the two Google Analytics ones described below. Our own cookie is set only once you do something that needs to be remembered, such as signing in or unlocking a pass. Our web host keeps ordinary server logs of requests, which include IP addresses, in the same way every website does.
Analytics
Every page loads Google Analytics, Google's visitor-counting script, so that we can see which pages are read and how many people read them. It is the stock script with nothing added: no custom events, no advertising features, and nothing that ties a visit to an account, an email address or a purchase.
Loading it sends Google the address of the page, the page you came from, your IP address, your browser and device type, and a random client id kept in a cookie so that two visits from the same browser can be told apart. Google processes that under its own privacy policy, and explains how it uses data from sites like this one at policies.google.com/technologies/partner-sites. What we see is aggregate counts, never a named visitor.
To opt out, install Google's Analytics opt-out browser add-on, or block googletagmanager.com with any content blocker; the site works exactly the same without it. Clearing your cookies resets the client id, after which you count as a new visitor.
An account
Registering stores your email address and your password. The password is stored only as a scrypt hash, so nobody here can read it, including us. Alongside it we keep whether your address has been confirmed, when you last signed in, and a count of failed sign-ins so that ten wrong guesses can lock the account for fifteen minutes.
Password reset and verification links are stored only as a SHA-256 of the link, never the link itself, so a stolen copy of our database cannot be used to take an account over. Resets last an hour and verification a week; both work once.
A season pass
Buying a pass stores your email address, the season it covers, the amount paid, and the reference numbers Stripe gives us for the checkout and the payment. If the pass is later cancelled — almost always because it was refunded — we also store when that happened and a short note of why. We never see or store your card details. Those go from your browser to Stripe and never touch our servers.
Votes
If you vote on what a player is worth bidding, we store your account, the week, the player and the dollar amount, so that a second vote replaces your first rather than counting twice. Votes are published only as an average across everyone who voted, alongside how many people that is. No vote is ever shown next to the name or address of the person who cast it.
Leagues
If you connect your fantasy leagues, we store which leagues they are, their names, the names of their teams, and which players are on each roster, read from Sleeper, ESPN or Yahoo, along with your Sleeper user id if you gave a Sleeper username. That is what lets the tables mark a player available or taken for you. Who is on your league's rosters is shown only to you.
A private ESPN league is read with the espn_s2 and SWID cookies you give us, and a Yahoo league with the permission you grant at Yahoo. Both are stored encrypted, used only to read that league's rosters, and deleted when you disconnect the league or delete your account. We never see your ESPN or Yahoo password.
Cookies
One cookie of ours, faabtastic.sid, and only after you buy a pass, sign in, or sign in as staff. It holds a random session id and nothing else; what it refers to — who you are signed in as, which seasons you hold — is kept on our own server. It is marked HttpOnly and SameSite=Lax, sent only over HTTPS in production, and expires twelve hours after your last request.
Google Analytics sets two, _ga and _ga_8TSRCL762W, on every page. They hold the random client id described above and the time of your visit, are set on our own domain, and last up to two years unless you clear them. They are the only analytics cookies, and there are no advertising cookies and no other third-party cookies.
Neither cookie is needed to read the site. Blocking them, or the script that sets them, changes nothing you can see.
What we do not do
- We do not sell, rent or trade your data. There is nobody to sell it to.
- Beyond the Google Analytics page counts above, we run no tracking pixels, no session recording and no advertising network.
- We do not build a profile of you or track you across other websites.
- We do not email you anything you did not ask for. The only mail we send is transactional: confirm your address, reset your password.
Who else sees your data
A short list, each doing one job, and none of them given anything beyond what that job needs:
- Stripe takes the payment. Your email address and card details go to them directly. Card details never reach us.
- Heroku hosts the site and the database it stores this in.
- Sleeper, ESPN or Yahoo is asked for the rosters of a league you connect, using the league id, cookies or permission you gave us. The request comes from our server, not your browser, and carries nothing about you beyond those.
- Google counts visits through Google Analytics, and receives what the Analytics section above lists: the pages read, your IP address and browser, and the client id from its two cookies. It is not given your email address, your account or your purchases.
- A transactional email provider delivers confirmation and password-reset messages, and receives your address and the text of the message.
- Two public CDNs, cdnjs.cloudflare.com and cdn.jsdelivr.net, serve the icon and layout scripts the pages use. Loading a file from them shows them your IP address and browser, as loading any file from any server does. They are not given anything else and we set no cookies through them.
- Soro (trysoro.com) hosts the blog. The Blog page loads its script and the posts from there, which shows them your IP address and browser in the same way. It is given nothing else by us.
Beyond those, we share data only if the law actually requires it.
How long we keep things
- Your account and votes: until you ask us to delete them.
- Connected leagues, their rosters and the cookies or permission that read them: until you disconnect the league or delete your account.
- Purchase records: kept after an account is deleted, because we have to be able to account for money we have taken.
- Sign-in sessions: twelve hours, then cleared automatically.
- Reset and verification links: an hour and a week respectively, and they stop working once used.
What you can ask for
Write to info@faabtastic.com and we will tell you what we hold about you, correct it, or delete it. We do this for anyone who asks, wherever you live, rather than only where some law obliges us to.
Deleting your account deletes your votes and any unused reset links with it. Purchase records stay, for the accounting reason above, and your season pass stops being attached to an account. You can change your password yourself at any time on your account page.
Children
Faabtastic is not aimed at children under 13 and we do not knowingly collect anything from them. Tell us if you think we have and we will delete it.
Security
The site is served over HTTPS. Passwords are hashed with scrypt and reset links are stored as hashes. Signing in issues a fresh session id, so a cookie planted before you signed in cannot ride in on your account. None of this makes a breach impossible, and we would tell you promptly if one affected you.
Changes
If we start collecting something new, this page changes before we do, and the date at the top moves. It is the honest record of what the site actually does.
Contact
UY HOANG, 12345 Parklawn Dr, Ste 200 #1077, Rockville, MD 20852 · info@faabtastic.com · Terms of Service · Refund Policy