Privacy Policy
Waiver is a fantasy football app operated by RIGHT AT HOME ENT INC. Its home on the web is waiver.games. The same service was released earlier on the web under the name Hard Knocks Fantasy. That name is retired, but it still appears on the address league invitation emails are sent from. Waiver and Hard Knocks Fantasy are one service run by one operator, and this policy covers both.
This policy is written from the code, not from a template. Everything below describes what Waiver actually does today. If we change what we collect, we will update this page and move the date at the top.
We collect the email address and name you sign up with, and the fantasy league content you create. We do not sell your data. We do not use it for advertising. There are no analytics or advertising trackers in Waiver or on this website. You can delete your account, and everything attached to it, from inside Waiver yourself.
1. What we collect
Account information
When you create an account, our sign-in provider Clerk collects your email address and, if you provide one, your name. Clerk sends us your email address, a display name and a user id that identifies your account in our database. We also store a flag for whether your account is active and whether you have paid access to the AI GM.
If you sign in with a password, Clerk holds that password. We never see it and never store it. If you sign in with Apple or another provider, we receive only the email address and name that provider releases to us.
League content you create
Everything you build in the app is stored so your leaguemates can see it:
AI GM messages
If you use the AI GM, the question you type is sent to OpenAI together with context about your league — the current week, your league format, your team name, your starters and bench, and who you play this week. See section 4.
Purchases
The AI GM is the only paid part of Waiver. When billing is live, the store you buy through (Apple for in-app purchases, Stripe for purchases made on the website) processes the payment and holds the payment details. We never see or store your card number. We receive a record that a purchase happened and whether your access is currently active, which is what turns the AI GM on for your account.
Ordinary server logs
Our hosting and database providers keep short-lived operational logs, which can include an IP address, a timestamp and which request was made. These exist so we can keep the service running and stop abuse. We do not use them to build a profile of you.
2. Why we collect it
- To sign you in and keep your account attached to your leagues.
- To run your league — a draft cannot work unless your picks, your roster and your leaguemates' picks are all stored and shared with the league.
- To send the one invitation you asked us to send.
- To answer AI GM questions about your actual team.
- To unlock the AI GM for accounts that have paid for it.
- To keep the service up and prevent abuse of a paid API.
- To meet tax and accounting law where a purchase record is involved.
We do not collect anything for any other purpose. There is no secondary use of your data.
3. What we do not do
- We do not sell your personal information to anyone, for money or for anything else of value.
- We do not use your data for advertising, ad targeting, or building advertising audiences.
- We do not track you across other apps or websites. Waiver contains no advertising SDK, no analytics SDK, no attribution SDK and no tracking pixel. This website contains none either. Because there is no tracking, iOS never shows you an App Tracking Transparency prompt.
- We do not collect your location, contacts, photos, camera, microphone or health data. The app never asks for those permissions.
- We do not store your password or your card number.
4. The AI GM
The AI GM is an optional assistant that answers questions about your fantasy team. It runs on OpenAI's API. Here is exactly what happens when you send it a message:
- Your message is sent to our own server, which checks you are signed in.
- Our server adds context about your league — the week, the league format, your team name, the players in your starting lineup and on your bench, and your opponent that week — and forwards the whole thing to OpenAI.
- OpenAI's answer comes straight back to you.
Your AI GM conversation is not saved on our servers. Our server is a relay: it passes the message on and returns the answer, and keeps nothing afterwards. The conversation lives in the app on your device for that session and disappears when you close it.
OpenAI does not use data submitted through its API to train its models. OpenAI retains API requests for a limited period for abuse monitoring under its own API policy. Do not type anything into the AI GM that you would not want to leave your device.
Our OpenAI key lives only on our server, never in the app or in your browser.
5. Companies we share data with
We use a small number of service providers to run Waiver. Each one gets only what it needs to do its job. None of them is allowed to use your data for their own advertising.
We also load player names, teams and statistics from third-party sports data sources (including FantasyPros and CollegeFootballData). That is information about players flowing into the app. No information about you is sent to them.
Beyond these providers, we share personal information only if the law requires it — for example a valid legal order — or if it is necessary to investigate fraud or protect someone's safety. If Waiver were ever sold or transferred, your data would move with it and this policy would continue to apply until you were told otherwise.
6. How long we keep it
One thing worth being clear about: a fantasy league is shared. If you delete your account, the picks you made stay part of your league's draft history for the other managers, because a draft board with a hole in it is not a draft board. Those picks are player names and pick numbers — they are no longer linked to your account.
That only holds while somebody is left to run the league. If you are the last manager who can still sign in, the whole league is deleted with your account — the league itself, its draft, every pick, every seat and every invite. Nothing of it is kept. The Delete account screen tells you this before you confirm.
7. Your rights, and how to delete your account
You can ask us to do any of the following, and we will not charge you for it:
- Access — get a copy of the personal information we hold about you.
- Correct — fix anything that is wrong. Your name and email can be changed in the app; anything else, email us.
- Export — receive your data in a portable, machine-readable file.
- Delete — remove your account and the personal data attached to it.
- Object or restrict — tell us to stop a particular use of your data.
- Withdraw consent — where we relied on your consent.
On the web: open the ⚙ gear on the league screen, choose Delete account, type DELETE to confirm, then press Permanently delete my account. In the Waiver iOS app: open the Profile tab, then tap Delete Account. Either way this deletes your account and the personal data attached to it. You do not need to email anyone, and you do not need to ask permission.
It is permanent — there is no undo, and we cannot restore it for you afterwards. The confirmation screen spells out what goes with it, including the warning that a league can be deleted along with your account. Read it before you confirm.
For any other request, email info@waiver.games from the email address on your account. We aim to respond within 30 days. We may need to confirm it is really you before we act, which protects you as much as us.
8. Children
Waiver is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, email info@waiver.games and we will delete it. Where local law sets a higher age for consent to data processing — 16 in parts of the EU — that higher age applies.
9. Security
- All traffic between the app, this website and our servers is encrypted in transit using HTTPS/TLS.
- Passwords are held by Clerk and never by us. There is no password in our database to steal.
- API keys live only on the server, supplied as environment variables and never committed to code or shipped inside the app.
- Every AI GM request must carry a verified sign-in token. An anonymous request is rejected.
- Our database and hosting providers encrypt data at rest under their own security programmes.
No service can promise perfect security, and we are not going to pretend otherwise. We have not undergone a formal third-party security audit or certification, and we do not claim one. If we ever discover a breach affecting your personal data, we will tell affected users and the relevant regulators as the law requires.
10. GDPR and UK users
If you are in the European Economic Area, the United Kingdom or Switzerland, RIGHT AT HOME ENT INC is the data controller for the information described here. Our legal bases are:
- Performance of a contract — your account, your leagues, your drafts and your purchases. We cannot run a fantasy league without them.
- Legitimate interests — keeping the service running, preventing abuse and fraud, and securing our systems.
- Legal obligation — keeping purchase and tax records.
- Consent — where we ask for it, such as sending an invitation email to an address you supply.
You have the rights listed in section 7, and you also have the right to complain to your local data protection authority.
11. California users
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect and why, the right to delete it, the right to correct it, the right to a portable copy, and the right not to be discriminated against for exercising any of those rights.
We have not sold or shared personal information for cross-context behavioural advertising in the past twelve months, and we do not do so now. Because we do not sell or share it, there is no "Do Not Sell or Share My Personal Information" process to opt into. We do not use or disclose sensitive personal information for any purpose beyond providing the service. Use the same routes in section 7 to exercise any of these rights.
12. Where your data is processed
RIGHT AT HOME ENT INC operates from the United States, and the providers listed above process data in the United States and in other countries where they run infrastructure. If you use Waiver from outside the United States, your information will be transferred to and processed in the United States. Where such a transfer requires a legal safeguard, our providers rely on mechanisms such as the European Commission's Standard Contractual Clauses.
13. Changes to this policy
If we change what we collect or who we share it with, we will update this page and change the effective date at the top. If a change is significant, we will also tell you in the app or by email before it takes effect. Continuing to use Waiver after a change means you accept the updated policy.
14. Contact
Questions about privacy, or a request about your data:
info@waiver.gamesWaiver and Hard Knocks Fantasy are operated by RIGHT AT HOME ENT INC. Email is the fastest way to reach a person, and a real one reads it.