Privacy Policy

Effective date: 10 November 2026

1. Who we are

Off Night (“we”, “us”) is an iOS app for season-long fantasy basketball, developed by Kerem Uslular. Kerem Uslular is responsible for the personal data described in this policy.

Questions or requests: [email protected].

2. The short version

3. What we collect

Account

• Sign in with Apple identifier. When you sign in, Apple gives us a stable identifier that is unique to you and Off Night. We store it with a random Off Night account ID and the time your account was created.
• No name or email. Off Night doesn't store your name or email.
• Session token. After you sign in, the app receives a session token that lasts up to 30 days. It is kept in the iOS Keychain on your device and is not stored on our servers.

League connections

• Yahoo. You sign in on Yahoo's own page. Off Night never sees your Yahoo password. Yahoo gives us read-only access to your Yahoo Fantasy Sports data, as access and refresh tokens, along with your Yahoo account identifier. We store the tokens and that identifier together, encrypted. We refresh the tokens as needed so that we can read your league for you, and we use the identifier to find your team in the league. While you connect, we also keep a random, short-lived value that expires automatically. It protects the connection against forged requests.
• ESPN. You log in on ESPN's (Disney's) own login page, shown inside the app. That page is run by ESPN/Disney under their privacy policy, and it includes their own bot protection. After you log in, the app reads only two ESPN session cookies, espn_s2 and SWID, and sends them to our server. When you connect a league, they are stored encrypted.
  • Finding your leagues. To show which fantasy basketball leagues your ESPN account is in, our server sends your ESPN account identifier (the SWID cookie) to ESPN and shows you the list so you can pick one. This happens on our server. We don't store the list; we keep only the league you pick. The identifier is already part of the encrypted ESPN credentials described above, so nothing new is stored.
  • On your device. The app does not capture or store your ESPN password. While you log in, ESPN's login page keeps its own web data on your iPhone, including these cookies. As soon as the login finishes, the app erases all of it. After that, the app holds the two cookies only in memory, never in its own storage. It clears them once it has sent them to connect your league, when you cancel, or after 10 minutes of inactivity.
• Fantrax. You connect a Fantrax league by pasting its league link and choosing your team. There is no Fantrax login: Off Night never asks for, receives or stores a Fantrax password, cookie or token. The app reads the league ID from the link and sends our server only that ID and, once you pick it, your team. Our server then reads the league from Fantrax's official read-only API, which needs no login, sending Fantrax only that league ID. We store the league ID and the team you chose.

League data

• When a league is connected, we sync and store what Yahoo, ESPN or Fantrax returns for it: the league's name, season, scoring format and categories, roster, injured-list and waiver/acquisition settings, and other league settings; every team in the league (team name, win-loss-tie record, rank, points for and usage counts); each team's rostered players; the league's free agents; and which team is yours. For Fantrax, that's the team you chose when you connected. Not every source provides every item; Fantrax, for example, doesn't share acquisition limits or injured-list slots.
• That includes other managers' team names and records, because they are part of the league data the provider returns.
• The league data includes identifiers for the other managers (Yahoo manager IDs, ESPN team owners). We read these only to work out which team is yours, and we don't store them.
• We store the recommendations Off Night computes for your league, so the app can show them quickly.
• We also store the changes you make to a league's rules in the app (such as the games limit, adds cap or FAAB) and your recent-form projection choice for that league. They are deleted when you remove the league or delete your account.

Notifications

• If you allow notifications, we store your device's Apple push notification token so that we can send injury alerts and the daily lineup reminder.
• We keep records of scheduled notifications: the type, the send time, the delivery status and, where relevant, the league.
• Your push token is removed when you sign out, when you turn notifications off in the app, or when Apple reports that the token is no longer valid.

Purchases

• Apple processes all payments. We never see your card or payment details.
• RevenueCat. The app uses RevenueCat to check your purchases and unlock Off Night Pro. Once you're signed in, the app identifies you to RevenueCat by your random Off Night account ID, so your purchases are linked to your Off Night account. That ID is not your name or email, and we don't send RevenueCat your name or email. Before you sign in, RevenueCat uses its own random ID, which is joined to your account ID when you sign in. RevenueCat receives your App Store purchase and subscription information from Apple and the app, and basic device details (device model, iOS and app version).
• Your Pro status on our servers. So that Pro works for your account, our servers ask RevenueCat for your current purchase status and store the result: whether Pro is active, how you got it (subscription, Season Pass or a promotional grant), the product, when it expires or its billing grace period ends, whether it was an Apple test (sandbox) purchase, when we last checked, and the ID and type of the last RevenueCat notification we received. RevenueCat notifies our servers when your purchase status changes, and we then fetch the current status from RevenueCat. We also re-check with RevenueCat when your Pro is about to end, and when you buy or restore in the app. We don't store payment details, prices or receipts.

Technical logs

• Our servers log request metadata such as the time, method, status and your IP address, and for some events internal account identifiers. Request paths, credentials and tokens are removed from logs. We use logs to run the service, investigate problems, prevent abuse, and apply per-IP rate limits.

On your device

• The app keeps a few preferences on your iPhone: whether it's your first launch, and whether you've opted in to notifications. Your session token is kept in the Keychain, as described above.

What we don't collect

• The app contains no third-party analytics, advertising, or crash-reporting SDKs.
• We don't track you across other companies' apps or websites, and we don't use your data for advertising.
• Public NBA schedules, stats, and injury reports come from a data provider (balldontlie). We don't send them any personal data.

4. How we use it

• To provide Off Night: sign you in, fetch and show your leagues, and compute recommendations.
• To check whether you have Off Night Pro and unlock its features.
• To send notifications you've opted into.
• To keep the service secure and reliable, and to prevent abuse.

We don't use your data for advertising, we don't sell it, and we don't build profiles of you for third parties.

5. How we share it

We share data only with the service providers below, and only so they can do their part in running Off Night. Your Yahoo tokens are sent only to Yahoo, and your ESPN cookies only to ESPN, to fetch your league. For Fantrax, we send only your league's ID.

If you email us, we use your email address and message only to reply to you.

We may also disclose data if the law requires it, for example to comply with a valid legal order.

We don't sell personal information, and we don't share it for cross-context behavioural advertising.

6. Security

• All connections between the app and our servers use HTTPS.
• Your Yahoo tokens and ESPN cookies are encrypted at rest with AES-256. The encryption key is held as a managed secret, not in the database.
• Fantrax connections have no credential to store.
• Credentials are never written to our logs and are never sent back to the app by our API.
• Your Off Night session token is kept in the iOS Keychain.

No system is perfectly secure, but we work to protect your data and to keep what we store to a minimum.

7. How long we keep it

• Account and league data are kept while your account exists. Each sync updates your league data in place; we don't build a history of your league.
• Your Pro status is kept while your account exists. Each check with RevenueCat replaces it; we don't keep a history of your purchases.
• When you remove a league or delete your account in the app, the data our database holds for it is deleted straight away (see below).
• Server logs are kept only as long as needed to operate and secure the service, under our hosting provider's log retention. Copies of deleted data may remain in our hosting provider's logs or backups, where those exist, for a limited time until they are overwritten.
• Signing out removes the session token from your device and stops push notifications to it. It does not delete your data on our servers.

8. Deleting your data

1. Delete your account in the app: if you have a connected league, open Your leagues and tap Delete account. If you haven't connected a league yet, tap Account at the top right of the Connect screen, then Delete account. You'll be asked to confirm with Apple first; if you cancel, nothing is deleted. This permanently deletes your Off Night account and everything our database holds for it in one all-or-nothing step: your league connections and their encrypted credentials, synced league data, recommendations, scheduled notifications, push tokens, your stored Pro status, and your account record. Right after that, we also ask RevenueCat to delete its customer record for your account (see below). Where possible, we also ask Apple to revoke Off Night's Sign in with Apple access at the same time. That step can't always be completed, so you can also remove it yourself (see below).
2. Remove a single league: on the Your leagues screen, long-press the league and choose Remove league. This deletes that league's data and its stored credentials. A Fantrax league has no stored credential, so removing it deletes the league ID, the team you chose and the league's synced data.
3. By email: write to [email protected] and we'll delete your account within 30 days. We may ask for information to find your account.
4. Revoke access at the source. Deleting removes our copy of your tokens and cookies. It does not change anything at Yahoo or ESPN. To revoke access there too:
   • Yahoo: remove Off Night from the connected apps in your Yahoo account settings.
   • ESPN: log out of ESPN or change your ESPN password. This invalidates the session cookies.
   • Fantrax: there's nothing to revoke. Off Night never signs in to your Fantrax account, so removing the league in Off Night deletes everything we hold for it.
   • Apple: when you delete your account, we also ask Apple to revoke Off Night's Sign in with Apple access where we can. To be sure, or to do it without deleting your account, on your iPhone go to Settings → [your name] → Sign-In & Security → Sign in with Apple, choose Off Night, and stop using it.
5. Subscriptions: deleting your account does not cancel an App Store subscription. Manage or cancel it in Settings → [your name] → Subscriptions.
6. RevenueCat records: when you delete your account in the app, we ask RevenueCat to delete the customer record linked to your Off Night account ID. If that request fails, your Off Night account is still deleted; email [email protected] and we'll ask RevenueCat to remove it. Apple keeps its own record of your App Store purchases. If you later sign in again and restore a purchase, RevenueCat creates a new record for your new account.

9. Your rights

You can ask to access, correct, delete or export your personal data, or object to how we use it. Email [email protected]. Most league data comes from Yahoo, ESPN or Fantrax, so changes you make there appear in Off Night after the next sync.

EEA and UK users: we process your data to provide the service you asked for (performance of a contract), for security and server logs (our legitimate interests), and for notifications (your consent, which you can withdraw at any time by turning notifications off). You can also complain to your local data protection authority.

California users: we don't sell or “share” personal information, as those terms are defined in California law. You have the rights described above, and we won't treat you differently for using them.

10. Where your data is processed

Our servers are in the United States. If you use Off Night from elsewhere, your data is transferred to and processed in the United States.

11. Children

Off Night is not directed to children under 13, and we don't knowingly collect their data. If we learn that we have data from a child under 13, we delete it. If you think this has happened, please contact us.

12. This website

offnight.app uses no cookies, no analytics and no third-party scripts. Cloudflare hosts the site and processes request data, including your IP address, to deliver and protect it.

13. Changes to this policy

If we change this policy, we'll post the new version on this page and update the effective date at the top.

Questions? Email [email protected] or visit Support.