🏈 NFL Lab Privacy Policy
In short: NFL Lab Connect reads three sign-in cookies from ESPN and Fantrax and sends them only to your own NFL Lab dashboard, so it can show your fantasy matchups. Nothing is sold, shared for advertising, or used for anything else.
Who runs NFL Lab
NFL Lab is a small, invite-only fantasy football dashboard run by one person for themselves and a few friends. It is not a commercial service and shows no ads. Only people with an invite can use it.
What the extension reads
NFL Lab Connect reads exactly these cookies, from the browser it is installed in:
| Site | Cookies | Why |
|---|---|---|
| espn.com | SWID, espn_s2 |
ESPN uses these to let you read your fantasy leagues |
| fantrax.com | FX_RM |
Fantrax's sign-in cookie, which lets you read your leagues |
It reads them only if you are signed in to those sites in that browser. It does not read any other cookies, your browsing history, or the content of any web page, and it never changes or deletes cookies.
Where it goes
- Only to your own account on the NFL Lab dashboard at
fantasy.nfllab.win, over HTTPS, and only while you have the dashboard open. The extension sends nothing to anyone else. - Only when the cookies have changed since last time.
- The dashboard uses them for one thing: reading your fantasy leagues, matchups and scores from ESPN and Fantrax to show them to you. It never sets lineups, makes trades, or changes anything on your fantasy accounts.
What the dashboard stores
- Your email address, as confirmed when you sign in, to know which account is yours.
- The leagues you follow and which team in each is yours.
- Your ESPN and Fantrax sign-in cookies, encrypted. They are never shown again - not to you, and not to other users.
- Recent scoring plays and your last board, so the dashboard picks up where it left off after a restart.
Who can see it
- You see your own leagues and matchups. Other users never see your cookies, your leagues or your account.
- If you are in a league with someone else who uses NFL Lab, your cookie may be the one used to load that league for both of you. They see the league data they can already see as a member of that league - never your cookie.
- The person who runs NFL Lab holds the encryption key and runs the server, so they could technically decrypt stored cookies. They will not use them for anything but loading your leagues as described here.
What stays in your browser
The extension keeps a few small things on your device only: a fingerprint (a SHA-256 hash) of what it last sent, so unchanged cookies are not sent again; whether you paused it for a site; and the time and result of the last connection, shown in its popup. It never stores the cookies themselves. Uninstalling the extension deletes all of this.
Who else is involved
- Cloudflare provides sign-in (Cloudflare Access) and the secure connection to the dashboard, and so processes your email address when you sign in. If you choose "Sign in with Google", Google confirms your email address to Cloudflare.
- ESPN and Fantrax receive requests for your league data, as they would when you visit their sites.
No data is sold, rented or shared for advertising, analytics or any other purpose. There are no ads and no tracking.
Your choices
- Disconnect ESPN or Fantrax on the dashboard's account page: the stored cookies are deleted immediately, and the extension stops reconnecting that site.
- Sign out of ESPN or Fantrax everywhere: the cookies stop working.
- Uninstall the extension at any time: nothing more is sent.
- Delete your account: ask the person who runs NFL Lab (contact below), and your email, leagues, cookies and history will be deleted.
Security
Cookies are encrypted before they are stored, with the key kept separately from the data. All traffic uses HTTPS, and only invited, signed-in users can reach the dashboard.
Children
NFL Lab is not directed at children under 13 and does not knowingly collect their information.
Changes
If this policy changes, the effective date above will change with it. Anything that widens what is collected or who can see it will be announced to users first.
Contact
Questions, or a request to delete your data: privacy@nfllab.win