Privacy Policy

> DRAFT — not yet reviewed by a lawyer or accountant. Do not publish until reviewed.

Last updated: [EFFECTIVE DATE]

The privacy of your data — and it is your data, not ours! — is a big deal to us. This policy explains what we collect and why, how it's handled, who helps us run Ask Ash, and your rights. We never sell your personal data.

Who we are. The data controller for Ask Ash (askash.gg) is [OPERATOR LEGAL NAME], [REGISTRATION NO.], [ADDRESS], Latvia ("we", "us"). Contact for privacy questions: [PRIVACY CONTACT EMAIL e.g. privacy@askash.gg]. [ASH TO CONFIRM: whether a Data Protection Officer is required — likely not at this scale; lawyer to confirm.]

This policy covers visitors to askash.gg, people who try the demo league, and Ask Ash account holders. It also explains how we handle limited information about other managers in leagues our users connect.

What we collect and why

Our guiding principle is to collect only what we need to run Ask Ash.

Account and sign-in

When you sign up, our login provider (Clerk) collects your email address and, if you use Google or Apple sign-in, the basic profile those services share (such as name, account ID and possibly a profile picture). We also record that you confirmed you are 18 or older. We use this to create and secure your account and send you service emails (receipts, security and account notices). Your session lasts up to 30 days, and an account can be signed in on up to 2 devices.

Legal basis: performance of our contract with you.

Billing information

Card details are entered directly with our payment provider, Stripe, and never touch our servers. We receive and keep a record of each transaction (plan, amount, date, country, and the last 4 digits and brand of the card) for account history, receipts and support. To enforce "one account per card", we also receive a card fingerprint from Stripe (a code that identifies the card without revealing its number). [ASH TO CONFIRM: if Stripe Managed Payments is approved, Stripe acts as merchant of record and is an independent controller for the payment and tax data it collects; its own privacy notice applies to that part.]

Legal basis: contract; legal obligation (tax and accounting records); legitimate interest (fraud prevention).

Your fantasy leagues

When you connect a league, we read and store what we need to give you advice:

League data: league name and settings, scoring categories, roster slots, teams, rosters, matchups, standings and transactions.
Your choice of team in that league.
League access credentials where a platform requires them — for example a Sleeper username, an ESPN league link, or for private ESPN leagues the `espn_s2` and `SWID` cookies. These credentials are stored encrypted and used only to read your leagues. We never use them to make changes in your league. You can disconnect a league at any time, which deletes its credentials.

Legal basis: contract.

Other managers in your league. League data includes other managers' team names, display names and rosters. We process this only to provide Ask Ash to you (for example, matchup projections, trade checks or scouting reports), we don't contact those people, and we don't build profiles of them outside your league. Legal basis: our legitimate interest, and yours, in analyzing your own fantasy league. If you're a manager in a league connected by someone else and have questions, contact us.

Questions to Ash and AI answers

When you ask Ash a question, we send your question, together with the relevant league and stats data, to our AI provider (Anthropic) to generate an answer. We store your conversations so you can see your history and so Ash can remember your choices per league (for example, punt strategy or risk style). Please don't put sensitive personal information into chat — Ash doesn't need it.

We also keep a recommendation log: each recommendation Ash or our engine makes, what we expected, and the probability we gave. At the end of each week we compare it with what actually happened to measure and improve accuracy and to show you "Last week in review". If you rate an answer (👍/👎 with an optional reason), we keep that feedback to improve Ash.

Under our agreement with Anthropic, API inputs and outputs are not used to train Anthropic's models. [ASH TO CONFIRM against current Anthropic commercial terms and data-retention settings for the account.] We don't sell your chats or use them for advertising.

Legal basis: contract (answering your questions); legitimate interest (measuring and improving accuracy, quality and safety).

Settings and notifications

We store your preferences — morning tip time, draft/risk style (Safe/Balanced/Upside), Ash's voice (Straight/Hoops/Trash talk), and which notifications you want. To send push notifications we store a push token for your device (via Expo for the mobile app and web push in the browser). You can turn each notification type off at any time.

Legal basis: contract.

Credits, referrals and Ash Dimes

We keep a record of your plan, credits used and remaining, credit packs, and — if you use the referral program — who referred whom and the Ash Dimes earned and spent.

Legal basis: contract.

Marketing emails

We may send you product news and offers by email (at most one marketing email per week). At sign-up, the marketing checkbox is unticked for users in the EU/EEA — we'll only email you if you opt in. For users in the US, the box is pre-ticked and you can untick it. [ASH TO CONFIRM with lawyer: treatment of UK, Canada and other countries with opt-in rules — recommended: unticked everywhere outside the US.] Every marketing email has an unsubscribe link.

Legal basis: consent (EU/EEA/UK); legitimate interest / applicable law elsewhere.

Usage, devices and security

We log technical information such as IP address, device and browser type, sign-ins, and errors. We use it to keep accounts secure, enforce limits (for example, 2 devices per account, 20 Ash questions per hour, one team per account), detect fraud and abuse, fix bugs, and understand which features people use. We use product analytics (PostHog) and error monitoring (Sentry) for this. We may see your approximate country (from IP) for statistics and tax purposes.

Legal basis: legitimate interest (security, fraud prevention, improving the Services); consent where required for analytics cookies.

Cookies

We use:

Essential cookies — to keep you signed in (Clerk), protect against fraud (Stripe) and secure the site. These are needed for Ask Ash to work.
Analytics cookies — to understand how the site is used (PostHog). In the EU/EEA/UK we only set these after you agree via our cookie banner, and you can change your choice at any time.

We do not use advertising cookies or tracking pixels. [ASH TO CONFIRM: no ad pixels (Meta/TikTok/Reddit/Google Ads) planned — if they are added, this section, consent banner and US "sharing" opt-out must be updated. Also confirm cookie-banner tool and whether PostHog runs cookieless before consent.]

Support and correspondence

When you email us, we keep the conversation and your email address so we have a history to refer to if you contact us again. If you cancel, we'll store the optional cancellation reason you pick.

Legal basis: legitimate interest; contract.

What we don't collect

We don't collect player photos, your contacts, your precise location, or any special-category data (like health data) about you. Ask Ash is not for anyone under 18, and we don't knowingly collect data from children. If you believe a minor has created an account, contact us and we'll delete it.

Where our data comes from (besides you)

Your league platform — ESPN, Sleeper, Fantrax, Fleaflicker and, once available, Yahoo — when you connect a league.
NBA data providers — statistics, game logs, schedules and injury status from licensed data providers (currently balldontlie) and Sleeper's public player database; injury statuses are based on official NBA injury reports. These sources contain data about NBA players and games, not about you.

Who we share data with (sub-processors)

We use these service providers to run Ask Ash. They process data only on our instructions and under data processing agreements.

|---|---|---|---|

| Stripe (incl. Stripe Managed Payments, if approved) | Payments, invoices, tax; merchant of record if Managed Payments is used | Billing and payment data | US / EU [ASH TO CONFIRM] |

We may also share data:

At your direction — when you connect a league platform, or share a card as an image.
To comply with the law — if we're required by a valid legal order. Where allowed, we'll tell you first.
To protect Ask Ash — to investigate fraud, abuse or security incidents.
With tax authorities and accountants — the minimum billing information needed.
If the business is sold or merged — we'd notify you before your data becomes subject to a different privacy policy.

We may use aggregated or de-identified data (which doesn't identify you) for statistics, accuracy reports and improving our engine.

International transfers

We are based in the EU (Latvia), but some of our providers are in the United States or other countries outside the EU/EEA. When we transfer personal data outside the EU/EEA, we use appropriate safeguards — the EU Standard Contractual Clauses (SCCs) and/or the provider's certification under the EU–US Data Privacy Framework — plus additional measures such as encryption. You can ask us for a copy of the relevant safeguards.

How we secure your data

All data is encrypted in transit (HTTPS/TLS). League access credentials (cookies and tokens) are encrypted at rest. Access to production data is limited to the people who run Ask Ash and only when needed — for example, to answer a support request you made or fix an error. Our providers maintain their own security programs. No system is perfectly secure, but we'll notify you and the authorities as required by law if a breach affects your data.

Data retention

We keep your data only as long as needed:

Account, league and chat data — while your account is active.
Disconnected leagues — league credentials are deleted immediately when you disconnect; league data is deleted within [ASH TO CONFIRM: e.g. 30 days].
Deleted accounts — when you delete your account, it is first deactivated ("soft deleted") and can be restored for 30 days. After 30 days, we permanently delete your personal data from our active systems, and from backups within [ASH TO CONFIRM: backup retention, e.g. 60 days]. [ASH TO CONFIRM: soft delete + 30-day restore.]
Billing and tax records — kept for the period required by Latvian accounting and tax law [ASH TO CONFIRM with accountant: exact statutory period], even after account deletion.
Recommendation log — kept in de-identified form after account deletion for accuracy measurement [ASH TO CONFIRM].
Security and server logs — up to [ASH TO CONFIRM: e.g. 90 days].
Marketing consent records — as long as needed to prove consent.

Your rights

We apply the same core rights to everyone, wherever you live. You have the right to:

Know and access — get a copy of the personal data we hold about you.
Correct — fix inaccurate data.
Delete ("be forgotten") — delete your account in settings or ask us to erase your data (some data, like billing records, we must keep by law).
Portability — receive your data in a machine-readable format. [ASH TO CONFIRM: in-app export or by email request.]
Restrict or object — ask us to limit processing, or object to processing based on legitimate interest, including any direct marketing (always honored).
Withdraw consent — at any time, for marketing emails or analytics cookies, without affecting earlier processing.
Not be subject to automated decisions with legal or similarly significant effects. (Ask Ash's recommendations are suggestions for your fantasy team; they don't have legal effects on you.)
Non-discrimination — we won't charge you more or give you worse service for using your privacy rights.
Complain — to a data protection authority. Our lead authority is the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv); you can also complain to the authority where you live.

California and other US states. We don't sell personal information, and we don't "share" it for cross-context behavioral advertising. California residents have the rights to know, delete, correct and limit use of sensitive information; we don't collect sensitive personal information for inferring characteristics. [ASH TO CONFIRM with lawyer: whether a separate CCPA "Notice at Collection" is needed at this size — CCPA thresholds may not apply.]

To use any of these rights, email [PRIVACY CONTACT EMAIL]. We'll need to verify it's you (usually by confirming from the email on your account). We respond within one month (GDPR) or the period your local law requires.

Changes and questions

We may update this policy as Ask Ash changes or the law requires. When we make a significant change, we'll update the date at the top and let you know by email or in the app.

Questions, comments or concerns about this policy or your data? Email [PRIVACY CONTACT EMAIL] or write to [OPERATOR LEGAL NAME], [ADDRESS].

Adapted from the Basecamp open-source policies / CC BY 4.0. Changes were made: the text was rewritten and extended for Ask Ash.