Privacy Policy

1. Scope of this policy

This Privacy Policy applies to blitzenbets.com and the Blitzen web application (the "Service"), and to ESPN Link for Blitzen, our Chrome extension, all operated by BlitzenBets LLC ("Blitzen," "we," "us," or "our"). It describes the information we collect from and about you, how we use and share it, and the rights and choices available to you. Blitzen is an information and analytics service only. We do not accept, hold, process, or facilitate wagers, so this policy does not cover any activity that happens on a third-party sportsbook.

What the extension reads, what it sends and what it never collects are set out in ESPN Link for Blitzen, our Chrome extension, below. It collects only the fantasy league data described there. The usage and device data in section 2 and the cookies in section 5 are the website’s, not the extension’s.

By using the Service, you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.

2. Information we collect

We collect the following categories of information, mostly so we can give you an account and a working product.

Account information

When you register, we collect your email address and authentication credentials. Account sign-up and login are handled by Amazon Web Services (AWS) Cognito, our identity provider. Your password is managed by Cognito and is not stored in our application database in readable form.

Subscription and billing information

If you subscribe to a paid plan, billing is processed by Stripe. We receive limited records such as your plan, subscription status, and the last few digits and brand of your payment card. We never store your full card number — that information is collected and held by Stripe under its own security and privacy practices. Blitzen is currently free during our beta, so most users will have no billing data on file.

Bets and predictions you log

Blitzen lets you record the bets you place elsewhere so the Service can track closing-line value (CLV) and other performance metrics. The bets, stakes, odds, and notes you choose to log are stored with your account. This data is yours; you log it, and you can delete it. Logging a bet on Blitzen does not place a wager — we are not connected to any sportsbook's betting system.

Usage, device, and analytics data

We collect information about how you interact with the Service, such as pages and features you view, actions you take, approximate location derived from IP address, browser type, device and operating system, and timestamps. We use this to understand product usage, diagnose problems, and improve Blitzen.

Cookies and local storage

We use cookies and browser local storage to keep you signed in, maintain your session, and remember your preferences (such as display and sport settings). See Cookies and tracking below for more detail.

3. How we use your information

We use the information we collect to:

• Operate, maintain, and improve the Service and its analytics tools.
• Authenticate you and keep your account secure.
• Process and manage subscriptions and billing through Stripe.
• Store and compute the bets and metrics you choose to log.
• Send you service communications, such as account, security, billing, and support messages.
• Understand how the product is used so we can fix bugs and prioritize improvements.
• Detect, prevent, and address fraud, abuse, and violations of our Terms.
• Comply with legal obligations and enforce our agreements.

League data received from our ESPN Link extension is used only as described under Limited Use in ESPN Link for Blitzen, below.

We may send occasional product or marketing emails. You can opt out of marketing messages at any time (see Your rights and choices); we will still send essential service messages you cannot opt out of while you hold an account.

4. Third parties and sub-processors

We rely on a small set of trusted service providers to run the Service. We share only the information they need to perform their function, and they are bound to handle it on our behalf. We do not sell your personal data.

• Amazon Web Services (AWS) — cloud infrastructure, including Cognito (authentication), Lambda (compute), S3 (storage), DynamoDB (database), and SageMaker (model hosting and compute).
• Stripe — payment processing and subscription billing.
• The Odds API — sportsbook odds and line data that powers the Service. This is market data, not your personal information.
• ESPN and nflverse — sports statistics and game data. For the public feeds that power scores, projections and player pages, this is market and league data rather than your personal information. A fantasy league you connect is different — see below.

We may also disclose information if required by law, to respond to lawful requests, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you of any change in how your information is handled). League data received from our ESPN Link extension is held to narrower terms: see Limited Use under ESPN Link for Blitzen, below.

Fantasy leagues you connect

If you connect a fantasy league — Sleeper, or ESPN via our Chrome extension, ESPN Link for Blitzen — we store that league’s data (ESPN) or its id (Sleeper — see below) against your account. That is your data, not public sports data, and it is held to the rest of this policy.

ESPN Link for Blitzen, our Chrome extension

An ESPN league reaches Blitzen through ESPN Link for Blitzen, our extension for Google Chrome. It runs in your own browser. This is everything it does with your data.

What it reads. One address only: ESPN’s read-only fantasy API, lm-api-reads.fantasy.espn.com. The first time you press Sync in the extension, Chrome asks your permission for it to reach that address. After that, it reads your league when you press Sync, and when your league page on Blitzen asks it to: when you open that page, when you come back to it if five minutes or more have passed since it last asked, and about every ten minutes while it is on screen. The page can name only the league, which team you picked as yours and how many seasons back to read; it cannot choose what is fetched from ESPN. Its support diagnostic, a page you reach only by typing its address, also reads it when you run it, and keeps its report — counts and statuses, never names — on that page unless you copy it. Every request is read-only — the extension never writes to ESPN. Chrome attaches the ESPN session cookie already in your browser to each request, as it does when you open ESPN in a tab; the extension cannot read that cookie.

What it sends. League settings and scoring rules, team names, logos and records, rosters and weekly lineups, matchups, playoff results, draft results (including auction prices and keepers), trades and waiver moves (including waiver bids), and each team’s current roster, for the leagues you choose to connect — with which team you tapped as yours, when it read them, which parts ESPN did not answer for, how many requests it made, and the extension’s version number. It hands this only to Blitzen pages open in the same browser, along with a summary of what the sync read (counts, never names), and Blitzen stores the league in your own account. It goes nowhere else: apart from its reads from ESPN, the extension makes no network requests at all. You can disconnect a league at any time, which removes its stored data (see Deleting it — ESPN, below).

What it never collects. Your ESPN password — it never asks for it. Your cookies — it requests no cookie permission and runs no code on espn.com, so it cannot read them; you can check both in its manifest. Your leaguemates’ names, and your or their ESPN account identifiers — ESPN’s response includes them, but the extension never selects them, and they are dropped before anything leaves the extension. Your browsing — the only website it runs on is blitzenbets.com, and it reports nothing about the pages you visit.

Which team is yours. You tap it in the extension, from the league’s team names; the member list is never read to work it out. Team names are chosen by their owners and visible to everyone in the league. A team whose owner never renamed it can carry ESPN’s default name, “Team” followed by the owner’s surname, so a surname can travel inside a team name, and we store team names as they appear in your league.

What it keeps on your computer. Nothing on disk. It has no storage permission and uses no other browser storage, so it stores nothing on your machine: what it holds while it works — the league it is reading, and a note of what its last sync did — is in memory only, and is gone when Chrome puts the extension to sleep. Chrome itself remembers the permission you gave it to read ESPN; removing the extension takes that away and ends all of its access at once.

Limited Use. The use of information received from the ESPN Link extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. In plain terms: we use the league data it sends only to show you your own league, and its rosters, across your Blitzen account, and to keep those features working and improve them. Our usage analytics count things such as how many seasons a sync stored, never anything inside them. We do not sell it. We do not use it for advertising, and we do not give it to advertising platforms, data brokers or other resellers. We do not use it to judge anyone’s creditworthiness or for lending. It is kept on Amazon Web Services, the cloud provider that runs Blitzen (section 4), and we pass it to no one else unless the law requires it, to protect against fraud or abuse, or as part of a merger, acquisition or sale of BlitzenBets LLC’s assets — and in that last case only after you have explicitly agreed. Nobody at Blitzen reads your league’s data unless you explicitly ask us to (in a support request, for example), it is needed to investigate abuse or keep the Service secure, the law requires it, or it has been aggregated and anonymized to run the Service.

What we store, and how to delete it

What we store — ESPN: the league data the extension sends (listed under What it sends, above), for the seasons you choose to connect. Waiver bids and auction prices are your league’s own play-money budget — they are league records, not payment information, and we receive no payment information of any kind from a connected league.

What we store — Sleeper: the numeric ids of the Sleeper leagues you link — Sleeper’s public league ids — and which of them you have open. Nothing else. We keep them against your account so your league list is the same on every device you sign in on. Your Sleeper leagues’ settings, rosters, matchups, drafts and transactions are read from Sleeper’s public API by your own browser each time you open the page, and are never sent to us or stored on our servers. The league names shown in your league switcher, and your Sleeper username, are kept in your browser only.

What we never store: your ESPN or Sleeper password. Your ESPN session cookie. Your ESPN account identifier.

About other people in your league. ESPN’s response includes your leaguemates’ names and account identifiers. The extension never selects them and drops them before anything leaves the extension, so they never reach us — and it does not use them to work out which team is yours either. We store team names — the names shown publicly within your league — and not the people behind them. One honest exception: if a manager never renamed their team, ESPN’s default name may contain their surname, and we store that team name as it appears in your league.

On Sleeper we store none of this, because we store nothing about a league beyond its id. Sleeper shows each manager’s public display name, and Blitzen shows it back to you inside your own league view. If a manager never named their team, that display name is what Sleeper uses as the team name. Anything you download or share from Blitzen replaces it with a team slot instead, so a shareable image never carries someone’s Sleeper handle out of your league.

Deleting it — ESPN. Disconnecting a league removes its stored data immediately. If any part of that deletion does not complete, the disconnect reports a failure rather than appearing to succeed. Our backups keep a recoverable copy for up to 35 days, after which it is gone from those too.

Deleting it — Sleeper. Removing a league deletes its id from your account before the league disappears from the page, so a removal you can see is a removal that has happened. Because the list belongs to your account rather than to one browser, the league is then gone from every device you sign in on, not just the one you used. If we cannot reach our servers, we say so and leave the league linked rather than showing you a removal that did not take. Our backups keep a recoverable copy of your account settings, these ids included, for up to 35 days, after which it is gone from those too. The league’s name, which your browser caches for the switcher, never reaches us.

5. Cookies and tracking

We use a limited set of cookies and similar technologies:

• Essential cookies and tokens — used to authenticate you, keep you signed in, and maintain your session. The Service will not work properly without these.
• Preference storage — browser local storage that remembers your settings and choices.
• Analytics — used to understand aggregate usage and improve the product.

You can control cookies through your browser settings, including blocking or deleting them, but disabling essential cookies may prevent you from signing in or using core features.

6. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. After you close your account, we delete or anonymize personal data within a reasonable period, except where we need to retain certain records to comply with legal, tax, accounting, or fraud-prevention obligations, or to resolve disputes and enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be retained indefinitely.

Billing records are one of those exceptions, and we would rather name it than leave it to the sentence above. If you delete your account while a subscription is active, we cancel that subscription immediately so you are not charged again. The record of what you paid stays with our payment processor, Stripe, because tax and accounting rules require us to be able to account for payments we have received. We never hold your card details ourselves — see section 7.

7. Data security

We take reasonable measures to protect your information. Data is encrypted in transit, sensitive operations run on AWS infrastructure, and access to systems is restricted. Payment card data is handled by Stripe and never stored on our servers. That said, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

8. Your rights and choices

You have meaningful control over your information. Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal data — yourself, from Settings → Danger zone, without contacting us.
• Export the bets and data you have logged.
• Opt out of marketing communications.

Deleting your account. You can do it yourself, from inside the app, without asking us: go to Settings → Danger zone → Delete account. It removes your account and sign-in, your settings, every bet you have logged, your favorites and watchlist, your saved workspaces and models, your alerts, any fantasy league you have synced, and every device registered for push notifications — and it cancels an active subscription. If any part of that deletion does not complete, it tells you which part and does not claim to have succeeded. Your data is gone from the app immediately; our backups keep a recoverable copy for up to 35 days, after which it is gone from those too. Billing records are retained as described in section 6.

If you cannot sign in — you have lost access to your email, or the account will not let you in — email us at support@blitzenbets.com and we will delete the account for you. We may need to verify your identity first.

Residents of California, the European Union, and other regions with comprehensive privacy laws may have additional rights, such as the right to know what data we process, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. To make any other request, email us at support@blitzenbets.com. We may need to verify your identity before acting on a request.

To unsubscribe from marketing email, use the unsubscribe link in the message or email us. You can update many preferences directly in your account settings.

9. Children

The Service is not directed to children and is intended only for adults who are of legal age to bet in their jurisdiction (18+, and 21+ in many U.S. states). We do not knowingly collect personal information from anyone under the legal age. If you believe a minor has provided us with personal information, please contact us at support@blitzenbets.com and we will delete it.

10. International and U.S. data handling

Blitzen is operated from and intended for users in the United States, and our service providers (including AWS and Stripe) primarily process data in the U.S. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after a change takes effect means you accept the updated policy.

12. Contact us

Questions about this policy or your data? Email us at support@blitzenbets.com.