Privacy policy

MustDraft was previously called The Pre-Snap and lived at thepresnap.com. Links to the old address redirect here, and every account, saved item and connected league carried over unchanged. Nothing about what we collect or how we use it changed with the name.

Privacy

• No account required for core tools. The trade analyzer, mock draft, rankings, stats and news never ask who you are. An optional free account exists only to save your work — see Accounts.
• Without an account, your preferences stay in your browser. Theme choice, tool settings, and recently-viewed lists are stored only in your own browser's local storage and are never transmitted to us. Nothing in your browser is uploaded unless you create an account and explicitly ask us to import it.
• Standard server logs. The site is served through a CDN/proxy; like essentially every website, requests generate standard access logs (IP address, page requested, time). We look at these only in aggregate to count visits and find broken pages.
• First-party product measurement, no third parties. To learn whether the tools are useful, the site records a short list of predefined events (for example "a mock draft was started" or "a draft was completed") on our own server. These events never contain your email, name, draft contents, tokens or IP address. The only identifier is a random number your browser invents, kept for at most 30 days and linked to nothing else. Raw events are deleted after 90 days; we only ever look at totals. There is no fingerprinting, no session recording and no advertising identifier, and nothing is shared with anyone. If your browser sends the "Do Not Track" signal, this measurement is switched off entirely. Error reports work the same way: if a page breaks, a short, scrubbed description of the failure (never your data) is recorded so it can be fixed.
• Trade votes. If you vote on a trade in the trade ticker, your browser invents a second random number and that number is stored with your vote, so you can change your mind later and only be counted once. It is linked to nothing else, it works even with "Do Not Track" on, and votes are deleted within a year.
• Optional feedback. After a mock draft you may be asked whether it was useful. Answering is optional; a comment, if you leave one, is limited in length, stored for at most a year, and read only by the site's owner. Don't put personal information in it.
• Advertising on public pages. Public pages may show ads served by Google AdSense — see Advertising for what that involves and the choices you have. Signed-in account pages carry no advertising code at all.
• Outbound links (news headlines, credited outlets) take you to sites with their own privacy practices.
• We do not sell your personal information and we do not share account data with advertisers.

Accounts

An account is entirely optional. It exists for one reason: to remember the drafts, rosters, trades and tracked players you choose to save, so they are still there on your other devices. If you never make one, nothing in this section applies to you, and every tool still works.

What we hold

• Your email address, so you can sign in and recover access.
• A hashed password, if you signed up with one. Passwords are stored using scrypt, a deliberately slow password-hashing function. We never store, log or transmit your password itself, and we cannot read it or tell you what it is.
• What you choose to save: mock drafts and their picks, saved rosters, saved trades, your watchlist, and your default league settings. These contain player names and identifiers — not personal information about you beyond the fact that you saved them.
• Sessions. Signing in creates a session record in our database together with a cookie in your browser. The cookie is HttpOnly (JavaScript on the page cannot read it), Secure (sent over HTTPS only), SameSite=Lax, and host-only. Because sessions live in the database rather than only in the cookie, signing out of a device really does end that session immediately. You can see and revoke your active sessions on your account page.
• A small security log. Sensitive actions (saving, deleting, exporting, deleting an account) are recorded with the action name, the time, a truncated IP address — the last part is discarded, so it identifies a rough network rather than you — and a coarse browser family. We do not log the contents of what you saved, and we never log sign-in links, password reset links, session cookies or tokens.

Signing in with Google

You may sign in with Google instead of a password. If you do, we ask Google only for your email address, your basic profile and a sign-in identifier. We do not request — and cannot obtain — access to Gmail, Drive, Calendar, your contacts, or any other Google service, and we do not ask for offline access. We never see or receive your Google password. Google will have its own record of the sign-in; see Google's privacy policy.

Importing what's already in your browser

If you have used the tools without an account, your work is sitting in your browser's local storage. When you sign in we may offer to add it to your account. That transfer happens only when you click to accept it, and only for the specific things this site itself saved — a roster, a draft in progress, a trade, a watchlist, your tool settings. We never upload the rest of your browser storage, and the server independently rejects anything outside that list.

Connected fantasy leagues

Front Office can connect leagues from Sleeper and ESPN. In every case we read only what you, as a member of that league, can already see: league settings, rosters, and transaction history. We use it two ways.

• For you, live: your league pages, lineup checks, waiver and trade suggestions. This copy includes team and manager display names so the pages make sense, and it is deleted when you disconnect the league.
• For market data, minimised: we keep a separate, minimised record of completed trades from connected leagues (and the same league's earlier seasons, which Sleeper links) — which players, picks and waiver budget moved, the league's format and scoring, and when. This dataset powers our market values and our public Trade Ticker, which shows individual, de-identified trade records: the packages, the league's format, and the date at day precision. It contains no usernames, avatars, team names or messages — the tables it lives in have no columns for them — and trade sides are recorded as anonymous seat numbers; league identifiers are never published. Because it is de-identified, it is not deleted when you disconnect.

We never guess or enumerate league ids. Leagues enter this record only through a real, public relationship: leagues you connected, leagues volunteered to us, their own linked history, or leagues reached by walking outward from a Sleeper username someone looked up on our public analyzer — their account, then the public leagues it plays in, and so on. Every league is one a real person could already see; none is discovered by trying ids at random.

Sleeper leagues

Sleeper leagues are read through Sleeper's public, documented API. It is public data: no password, no sign-in, and nothing stored beyond the league data itself.

ESPN leagues

Public ESPN leagues need only a league ID. Reading a private ESPN league requires proof that you are in it: two ESPN session cookies (espn_s2 and SWID) that your browser already holds while you are signed into ESPN. Whether you enter them yourself or use the optional MustDraft ESPN League Import browser extension, the same rules apply:

• They are stored encrypted, used only to read your leagues from ESPN, and never used to change anything on your ESPN account.
• We never see, ask for, or store your ESPN password.
• The extension acts only when you click "Import from ESPN" on mustdraft.com: it reads those two cookies and delivers them directly to our server. It runs on no other site, reads no other cookies or page content, and does nothing in the background.
• Removing the connection on your account page deletes the stored cookies. Changing your ESPN password or signing out of ESPN everywhere also invalidates them at ESPN's end.

Who else processes this data

We run the account system ourselves rather than handing it to an identity vendor, so the list of companies touching your account data is short:

• DigitalOcean — hosts the server and the managed PostgreSQL database where accounts and saved work are stored. The database is in their Toronto, Canada region; the web server is in New York, United States. Connections to the database are encrypted and certificate-verified.
• Postmark — sends account email (confirmation and password reset) and therefore processes your email address. Open tracking and link tracking are switched off, so we do not know whether or when you opened one of these messages.
• Cloudflare — serves the site, terminates HTTPS and forwards mail sent to our contact address.
• Google — only if you choose to sign in with Google, and separately for advertising on public pages as described below.

How long we keep it

• Your account and saved work: until you delete them. There is no expiry and no automatic clear-out.
• Sessions expire after 30 days, sooner if you sign out or revoke them. Changing your password ends every other session.
• Email confirmation and password-reset links are single use and expire after one hour.
• Security log entries are kept while the account exists. The record that an account was deleted outlives the account itself, without identifying who it belonged to.

Getting it back, or getting rid of it

• Export. Your account page has a one-click download of everything the account holds, as a plain JSON file. No request, no waiting.
• Deletion. The same page deletes your account. This removes your email, your password hash, your sessions and everything you saved. It is immediate and irreversible — we keep no backup copy we can restore from, so please export first if you want to keep anything.
• If you would rather ask a person, use the address on the About page.

Security, honestly

We do the things that matter: passwords hashed with scrypt, sessions in the database so they can actually be revoked, email confirmation before an account can be used, rate limits on sign-in and password reset, HTTPS everywhere, encrypted and verified database connections, and secrets kept off the website and out of version control.

What we will not tell you is that this is perfectly secure, because no system is. Please use a password you do not use anywhere else, and do not store anything in your saved rosters that you would not want to lose. If you find a security problem, tell us at the address on the About page and we will fix it.

Advertising

Public pages on this site may show ads served by Google AdSense. Signed-in account pages carry no advertising code.

• This site uses Google AdSense to display ads.
• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.
• Google and its partners may set or read cookies and similar local storage on your device to deliver, measure, and limit the repetition of ads, and to detect fraud.
• Ad delivery may involve device and browser information — for example approximate location derived from IP address, device type, browser, and the pages you view on this site.
• Ads may be personalized (based on inferred interests) or non-personalized (based only on general context such as the page and rough location). Where valid consent is required and has not been given, personalized advertising will not be served.
• Your choices. Visitors in regions where a consent prompt applies (the EEA, the UK, and Switzerland) can change their answer at any time using the Privacy choices link in the footer of every page. Visitors in US states with applicable privacy laws can use the "Do Not Sell or Share My Personal Information" link shown on the site.
• You can also opt out of personalized advertising through Google's own controls at My Ad Center, read how Google uses cookies in advertising, and see Google's privacy policy. To opt out of some third-party vendors' use of cookies for personalized advertising, visit aboutads.info/choices. Browser settings and tracker-blocking extensions also work — the site and all its tools function normally with ads blocked.
• We do not run our own ad tracking, do not attach click handlers to ads, and do not build visitor profiles ourselves.
• Questions or a request about your data: use the contact address on the About page.

Children

MustDraft is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, contact us via the About page and we will delete it.

Changes to this page

If what we collect or how we use it changes, this page changes with it and the "Last updated" date at the top moves. We do not weaken protections for data already collected without saying so here first.

The rules for using the site are on a page of their own: see the Terms of use and the Disclaimer.