Last updated September 30, 2026. Leer en español (Aviso de privacidad). For users in Mexico, the Spanish Aviso de privacidad is the governing version.
Who we are
Dynasty Room (dynasty-room.com) is run by Antonio José Zárate Lozano, an individual based in Monterrey, Nuevo León, Mexico, who is the controller of your personal data (“we”, “us”). Contact for anything about your data: support@dynasty-room.com, phone +1 (510) 961-1170.
What we collect and why
| Data | Why we use it | Legal basis (EU/UK) |
|---|---|---|
| Email address and account ID; for Google sign-in, the email Google shares with us (never your Google password, Gmail, Drive or contacts). Passwords are stored only as a one-way hash by our database provider. | Create and secure your account, sign you in, send account and billing emails. | Contract |
| Sleeper username and Sleeper user ID you give us, and the league you choose. | Show your leagues. Everything else about your leagues is public Sleeper data your browser reads directly from Sleeper. | Contract |
| Play-money bets, gazette editions, clubhouse messages, reactions, votes, punishments, challenges and photos. | Run those features. Clubhouse content is visible only to verified members of that clubhouse; photos sit in private storage behind links that expire after an hour. | Contract |
| Purchase data: Stripe customer ID, plan, status, renewal date, League Pass league IDs, name and number of teams (read from Sleeper to set its price), and a record that you agreed to automatic renewal. Card details go to Stripe; we never see or store them. | Provide what you paid for, send the purchase confirmation and renewal reminders, handle refunds, keep tax and accounting records, and keep proof of your consent. | Contract; legal obligation |
| Technical data: IP address, browser and device details, and error logs kept by our hosting and database providers. | Keep the service running and secure, prevent abuse. | Legitimate interests |
| Advertising cookies and identifiers (free users, only after you choose; see below). | Show ads that pay for the free plan; personalized only if you accept. | Consent (personalized ads); legitimate interests (non-personalized ads, fraud prevention) |
| Settings in your browser: selected league, language, theme, team colors, cookie choice and a cached copy of Sleeper’s player list. | Remember your preferences on this device. | Legitimate interests; strictly necessary |
We don’t collect sensitive data, and we don’t use your data for automated decisions that affect you legally. We don’t send marketing emails; only account, purchase and renewal emails. If that ever changes, it will be opt-in.
Ads and cookies
Free users see ads from Google AdSense on some pages (never in the sportsbook or the clubhouse). Premium, invite-code and League Pass users see no ads, and the ad code isn’t loaded for them.
Nothing from Google loads until you answer the cookie notice. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the internet. If you choose Accept, ads may be personalized. If you choose Essential only, ads are not personalized, though Google may still use cookies to limit how often you see an ad and to fight fraud. Visitors in the European Economic Area, the UK and Switzerland are asked through Google’s certified consent message.
Ad measurement (Meta Pixel). We advertise Dynasty Room on Instagram and Facebook. To learn which of those ads bring people here, the site can load the Meta Pixel, but only after you choose Accept, never if your browser sends Global Privacy Control, and never for Essential only. When it runs, Meta receives that you visited, the pages you opened, your browser and IP address, and two events: that you created an account and that you subscribed (no email, name, Sleeper data or payment details). Meta uses this to measure and improve ads, as described in its privacy policy; under some US state laws that counts as “sharing” for targeted advertising.
Change your choice any time with Your privacy choices at the bottom of every page of the app. You can also opt out of personalized advertising at Google Ads Settings or aboutads.info. We honor the Global Privacy Control signal: if your browser sends it, ads are never personalized and the Meta Pixel never loads. How Google uses data: policies.google.com/technologies/partner-sites. We never give Google your email, your Sleeper username or your league data.
Who receives your data
We don’t sell your data for money. Service providers process it only on our instructions:
- Supabase (database, sign-in, file storage), Netlify (website hosting), Resend (account and billing emails): service providers.
- Stripe: payments, billing and fraud prevention. Stripe also acts as an independent controller for payment data under its own privacy policy.
- Anthropic: writes AI gazette editions and answers Assistant GM. It receives your questions and a snapshot of the league on screen (team names, manager usernames, rosters, projections, odds and scores) and the names of your other linked leagues, never your email or payment details, and doesn’t use them to train its models. Assistant GM conversations aren’t stored by us.
- Google: ads for free users, as described above. For personalized ads Google acts as an independent controller; under some US state laws that counts as “sharing” for targeted advertising, which you can refuse.
- Meta (Instagram, Facebook): measuring our own ads, only if you accept, as described above. Meta acts as an independent controller; you can refuse this sharing.
- Authorities, when a law or a valid court order requires it.
Your browser also loads public data directly from Sleeper and ESPN’s public scoreboard; they receive your IP address like any website you visit.
International transfers. Our providers store data in the United States and other countries. Where EU/UK law applies, transfers rely on the providers’ Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
- Account, bets, gazettes and clubhouse content: while your account exists. When you delete your account it’s removed right away, and from backups within 30 days.
- Purchase, invoice and consent records: 5 years after the purchase, because Mexican tax law requires it (and to prove consent to automatic renewal).
- Technical logs: kept by our providers for a short period, normally no more than 90 days.
- Browser settings: until you clear them.
Your rights
Wherever you live, you can:
- Access your data and get a copy in a portable format.
- Correct it. You can change your Sleeper link and password on your account page.
- Delete it. Use Account › Your data › Delete my account, or email us.
- Object to or limit a use, and withdraw consent for personalized ads at any time with “Your privacy choices”. This doesn’t affect what was done before.
- Opt out of the sale or sharing of your data for targeted advertising (California and other US states), by choosing “Essential only” or turning on Global Privacy Control.
Email support@dynasty-room.com from the address on your account, saying what you want. We may ask you to confirm your identity; an authorized agent may ask on your behalf with your signed permission. We reply within 20 business days and carry out your request within 15 business days after that (faster where your local law requires, such as one month in the EU/UK). We won’t treat you differently for using these rights. If we say no, you can appeal by replying to our answer; we’ll respond within 45 days.
Mexico: these are your ARCO rights under the Federal Law on the Protection of Personal Data Held by Private Parties (2025). If you believe your rights were not respected, you may complain to the Secretaría Anticorrupción y Buen Gobierno. EU/UK: you may complain to your local data protection authority. US: you may contact your state attorney general.
Security
Data travels over encrypted connections, and every database table is locked so that each person can reach only their own data or their own clubhouse. No system is perfect; if a breach affects you, we’ll tell you and the authorities as the law requires.
Age
Dynasty Room is for people 18 and older. We don’t knowingly collect data from anyone younger; if we learn we have, we delete the account. Parents or guardians can write to us.
Changes
If we change this policy in a way that matters, we’ll post the new version here with a new date and tell signed-in users in the app and, for material changes, by email before they apply.