The fine print, minus the fog

Privacy & Terms

MustDraft was previously called The Pre-Snap and lived at thepresnap.com. Links to the old address redirect here, and every account, saved item and connected league carried over unchanged. Nothing about what we collect or how we use it changed with the name.

Privacy

• No account required for core tools. The trade analyzer, mock draft, rankings, stats and news never ask who you are. An optional free account exists only to save your work — see Accounts.
• Without an account, your preferences stay in your browser. Theme choice, tool settings, and recently-viewed lists are stored only in your own browser's local storage and are never transmitted to us. Nothing in your browser is uploaded unless you create an account and explicitly ask us to import it.
• Standard server logs. The site is served through a CDN/proxy; like essentially every website, requests generate standard access logs (IP address, page requested, time). We look at these only in aggregate to count visits and find broken pages.
• First-party product measurement, no third parties. To learn whether the tools are useful, the site records a short list of predefined events (for example "a mock draft was started" or "a draft was completed") on our own server. These events never contain your email, name, draft contents, tokens or IP address. The only identifier is a random number your browser invents, kept for at most 30 days and linked to nothing else. Raw events are deleted after 90 days; we only ever look at totals. There is no fingerprinting, no session recording and no advertising identifier, and nothing is shared with anyone. If your browser sends the "Do Not Track" signal, this measurement is switched off entirely. Error reports work the same way: if a page breaks, a short, scrubbed description of the failure (never your data) is recorded so it can be fixed.
• Optional feedback. After a mock draft you may be asked whether it was useful. Answering is optional; a comment, if you leave one, is limited in length, stored for at most a year, and read only by the site's owner. Don't put personal information in it.
• Advertising code is installed and approval is pending. Google AdSense is connected to this site and its script loads on public pages, so ad requests are made. The site has not yet been approved by Google, so those requests currently come back empty and you will not see ads yet. Once Google approves the site, ads may begin serving without further notice. The section below applies now, not only later. Signed-in account pages carry no advertising code at all.
• Outbound links (news headlines, credited outlets) take you to sites with their own privacy practices.
• We do not sell your personal information and we do not share account data with advertisers.

Accounts

An account is entirely optional. It exists for one reason: to remember the drafts, rosters, trades and tracked players you choose to save, so they are still there on your other devices. If you never make one, nothing in this section applies to you, and every tool still works.

What we hold

• Your email address, so you can sign in and recover access.
• A hashed password, if you signed up with one. Passwords are stored using scrypt, a deliberately slow password-hashing function. We never store, log or transmit your password itself, and we cannot read it or tell you what it is.
• What you choose to save: mock drafts and their picks, saved rosters, saved trades, your watchlist, and your default league settings. These contain player names and identifiers — not personal information about you beyond the fact that you saved them.
• Sessions. Signing in creates a session record in our database together with a cookie in your browser. The cookie is HttpOnly (JavaScript on the page cannot read it), Secure (sent over HTTPS only), SameSite=Lax, and host-only. Because sessions live in the database rather than only in the cookie, signing out of a device really does end that session immediately. You can see and revoke your active sessions on your account page.
• A small security log. Sensitive actions (saving, deleting, exporting, deleting an account) are recorded with the action name, the time, a truncated IP address — the last part is discarded, so it identifies a rough network rather than you — and a coarse browser family. We do not log the contents of what you saved, and we never log sign-in links, password reset links, session cookies or tokens.

Signing in with Google

You may sign in with Google instead of a password. If you do, we ask Google only for your email address, your basic profile and a sign-in identifier. We do not request — and cannot obtain — access to Gmail, Drive, Calendar, your contacts, or any other Google service, and we do not ask for offline access. We never see or receive your Google password. Google will have its own record of the sign-in; see Google's privacy policy.

Importing what's already in your browser

If you have used the tools without an account, your work is sitting in your browser's local storage. When you sign in we may offer to add it to your account. That transfer happens only when you click to accept it, and only for the specific things this site itself saved — a roster, a draft in progress, a trade, a watchlist, your tool settings. We never upload the rest of your browser storage, and the server independently rejects anything outside that list.

Connected fantasy leagues

If you connect a Sleeper league in League HQ, we read what any member of that league can already see through Sleeper's public, documented API: league settings, rosters, and transaction history. We use it two ways.

• For you, live: your league pages, lineup checks, waiver and trade suggestions. This copy includes team and manager display names so the pages make sense, and it is deleted when you disconnect the league.
• In aggregate, to improve our market values: we keep a separate, minimised record of completed trades from connected leagues (and the same league's earlier seasons, which Sleeper links) — which players, picks and waiver budget moved, the league's format and scoring, and when. This dataset is used only to measure and eventually model how the fantasy community actually values players. It contains no usernames, avatars, team names or messages — the tables it lives in have no columns for them — and trade sides are recorded as anonymous seat numbers. Because it is aggregated and de-identified, it is not deleted when you disconnect.

We never guess or enumerate league ids: only leagues you connected, leagues volunteered to us, and their own linked history are ever read.

Who else processes this data

We run the account system ourselves rather than handing it to an identity vendor, so the list of companies touching your account data is short:

• DigitalOcean — hosts the server and the managed PostgreSQL database where accounts and saved work are stored. The database is in their Toronto, Canada region; the web server is in New York, United States. Connections to the database are encrypted and certificate-verified.
• Postmark — sends account email (confirmation and password reset) and therefore processes your email address. Open tracking and link tracking are switched off, so we do not know whether or when you opened one of these messages.
• Cloudflare — serves the site, terminates HTTPS and forwards mail sent to our contact address.
• Google — only if you choose to sign in with Google, and separately for advertising on public pages as described below.

How long we keep it

• Your account and saved work: until you delete them. There is no expiry and no automatic clear-out.
• Sessions expire after 30 days, sooner if you sign out or revoke them. Changing your password ends every other session.
• Email confirmation and password-reset links are single use and expire after one hour.
• Security log entries are kept while the account exists. The record that an account was deleted outlives the account itself, without identifying who it belonged to.

Getting it back, or getting rid of it

• Export. Your account page has a one-click download of everything the account holds, as a plain JSON file. No request, no waiting.
• Deletion. The same page deletes your account. This removes your email, your password hash, your sessions and everything you saved. It is immediate and irreversible — we keep no backup copy we can restore from, so please export first if you want to keep anything.
• If you would rather ask a person, use the address on the About page.

Security, honestly

We do the things that matter: passwords hashed with scrypt, sessions in the database so they can actually be revoked, email confirmation before an account can be used, rate limits on sign-in and password reset, HTTPS everywhere, encrypted and verified database connections, and secrets kept off the website and out of version control.

What we will not tell you is that this is perfectly secure, because no system is. This is a free football site run by one person, not a bank. Please use a password you do not use anywhere else, and do not store anything in your saved rosters that you would not want to lose. If you find a security problem, tell us at the address on the About page and we will fix it.

Advertising

This site is connected to Google AdSense. The AdSense script is installed and running on public pages. Google's review of the site is still pending, so ad slots come back unfilled and nothing is displayed yet. When Google approves the site, ads may start appearing automatically.

• This site uses Google AdSense to display ads.
• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.
• Google and its partners may set or read cookies and similar local storage on your device to deliver, measure, and limit the repetition of ads, and to detect fraud.
• Ad delivery may involve device and browser information — for example approximate location derived from IP address, device type, browser, and the pages you view on this site.
• Ads may be personalized (based on inferred interests) or non-personalized (based only on general context such as the page and rough location). Where valid consent is required and has not been given, personalized advertising will not be served.
• Your choices. Visitors in regions where a consent prompt applies (the EEA, the UK, and Switzerland) can change their answer at any time using the Privacy choices link in the footer of every page. Visitors in US states with applicable privacy laws can use the "Do Not Sell or Share My Personal Information" link shown on the site.
• You can also opt out of personalized advertising through Google's own controls at My Ad Center, read how Google uses cookies in advertising, and see Google's privacy policy. To opt out of some third-party vendors' use of cookies for personalized advertising, visit aboutads.info/choices. Browser settings and tracker-blocking extensions also work — the site and all its tools function normally with ads blocked.
• We do not run our own ad tracking, do not attach click handlers to ads, and do not build visitor profiles ourselves.
• Questions or a request about your data: use the contact address on the About page.

Terms of use

• MustDraft is for entertainment and informational purposes. It is not gambling, betting, or financial advice, and it takes no bets.
• Values, rankings, stats, and news can be wrong, delayed, or stale — see Methodology for what refreshes when. No warranty of any kind is made; use your own judgment.
• Headlines and reporting belong to the credited outlets; each item links to its source. Team and player names are used factually.
• The squares and payout tools are organizational aids — how your group runs its pool, and whether that's appropriate where you live, is your responsibility.
• Don't scrape the site into oblivion or misrepresent its data as your own; be a good league-mate.
• If you create an account, keep your sign-in details to yourself, and don't use the account to store anything that isn't yours to store. We may close an account that is used to attack the site or other people. You can close it yourself at any time from your account page.
• Accounts and saved work are provided as-is and without warranty. Export anything you would be upset to lose.

Something look wrong or unfair? Report a correction — honest fixes beat fine print.