Privacy
Effective October 31, 2026. This policy explains what CoManager collects, why we use it, and the choices available to you.
Information you provide
We store your email address, optional phone, account identifiers, fantasy-platform username, messages, onboarding answers, goals, preferences, corrections, and feedback. We also store summaries and memories derived from that content so the product can give you consistent advice.
If you provide a phone, we may contact you for feedback or support. Providing it does not subscribe you to automated text notifications.
Fantasy league information
When you connect a league, we read league information from Sleeper, ESPN, or Yahoo. Private leagues require your permission. This can include league settings, rosters, players, standings, transactions, drafts, scoring history, and public profile information about league members. CoManager does not use your Sleeper password or place roster moves on Sleeper.
How we use it
We use this information to create and operate your account, give advice based on your leagues and goals, answer your questions, send notifications you request, provide support, prevent abuse, secure the service, process access and purchases, and improve reliability. We do not sell your personal information. Our analytics and advertising measurement practices are described below.
We record whether a notification link reaches the app and whether its report, story, or conversation opens. We use these account-linked events to understand which notifications are useful. We do not put message text in these records.
We record onboarding steps, screens viewed, clicks, offer views, and purchase attempts to understand how people use the app and where setup fails. These events include an app installation identifier before sign-in and an account identifier after sign-in. Click events can include displayed text, such as conversation titles and league names. We use PostHog to analyze these events and replay onboarding and activity in the main app. Replays can include your chat messages, draft messages, league information, and visible interactions. We mask password, verification-code, email, and phone fields; redact recognizable contact details and credentials in displayed text; and block images and media. We exclude network headers and bodies and remove paths and query strings from replay URLs.
For Apple checkout, we retain a purchase-attempt identifier, result time, a standard error code, and whether the app went into the background and returned. These account-linked records help us diagnose unfinished purchases. They do not include Apple account credentials, payment details, receipt contents, or raw error messages.
Advertising measurement
Starting with iOS version 3.3, after you sign in, we use Apple's AdServices attribution to understand which Apple ads led to app downloads and subscriptions. RevenueCat receives an Apple attribution token and associates available campaign, ad group, and keyword information with the subscription record of the account signed in on that device. We use this information to compare trials, payments, and renewals by acquisition source. We do not enable device advertising-identifier collection for this integration.
We share app-install, trial-start and first-payment events with Meta to measure our advertising. These events include app and device information and an anonymous identifier created by Meta's software on your device. If you allow tracking in iOS, they also include your device's advertising identifier. We never share your account identifier, email, phone, messages or league content for this purpose. You can turn off tracking in iOS Settings at any time. Account deletion removes the identifiers we stored. It does not recall events already shared with Apple or Meta.
Account deletion does not clear Meta's separate on-device identifier or its event queue. Deleting the app stops future on-device measurement.
Artificial intelligence processing
CoManager sends your messages and relevant league data to artificial intelligence providers such as Anthropic, OpenAI, and Google to generate advice and related content. We ask for your permission first. You can stop future artificial intelligence processing in Settings. Deleting your account removes content stored by CoManager.
Connections to external clients
When you connect Claude, ChatGPT, or another client, the tools enabled for your account can read your linked leagues, rosters, available players, recorded trades, saved goals, trade restrictions, and your notes about league managers. They can also read saved app reports, weekly lineup evidence and results, football reporting, analyst perspectives, and trade-partner and lineup comparisons when those tools are available. Provider and tool access vary by account. News and weekly-result tools may refresh stored data. Sending a selected answer to CoManager is optional, as described below. The client handles shared information under its own privacy policy. We do not automatically receive your conversations from that client or save copies of complete tool responses. We retain the limited activity records and any selected answers described below.
Service providers
We share information only as needed to operate CoManager. Our providers include Supabase for authentication and data storage, Vercel for hosting, Resend for email, Stripe for payment and subscription processing, Apple for app distribution, push notifications, and native subscription processing, RevenueCat for iOS subscription records, and Anthropic, OpenAI, or Google for artificial intelligence processing. Twilio may process a phone number and message delivery data when text notifications are enabled. When diagnostics are enabled, we send Sentry JavaScript error and crash reports, app hangs, watchdog events, limited app and device context, and a pseudonymous account identifier. We do not send your email, fantasy username, or fantasy data to Sentry. PostHog processes the navigation and interaction analytics and masked app replays described above. Stripe handles card details directly; CoManager stores purchase and entitlement records but does not receive your full card number.
WorkOS manages authentication and connection grants for external clients using your account identifier and email. New connection activity stays in CoManager. Older activity notices sent to the founder’s Slack include your email and client identifier and have separate retention.
Retention and deletion
We keep account and product information while your account is active. You can delete your account inside the app from Settings. Account deletion removes your account and linked product content. After deletion, we may retain limited records when needed for payment and subscription administration, security, fraud prevention, support, disputes, legal duties, or email suppression. We do not use retained records to recreate a deleted account or restore deleted fantasy content. We may also retain aggregate or de-identified analytics that are no longer linked to your account.
Records of external client activity include your account identifier, tool names, client and league identifiers, outcomes, response sizes, timing, and bounded diagnostic facts such as the scoring week, report identifier, result counts and evidence availability. We retain activity records for up to 90 days. New first-use markers are kept until you disconnect the connection or delete your account. Disconnecting deletes new connection records, including attributable first-use markers and selected answers, in CoManager. Disconnects made in an external client are checked periodically. Earlier records without connection attribution follow the previous retention periods: activity and selected answers for 90 days, and first-use dates until account deletion. You can review or delete selected answers from Manage connections at any time. Our current Slack workspace settings do not automatically delete activity notices, so they may remain indefinitely. Account deletion does not automatically remove notices already sent to Slack. Email privacy@comanager.app to request their removal. Account deletion blocks connector access and starts removal of the WorkOS record. We retain the account identifier and cleanup dates indefinitely to retry removal.
If you ask your external client to send an answer to CoManager, we store the selected question, answer and any feedback you choose to include for service improvement. This is client-authored feedback, not verified CoManager advice or an automatic change to your goals or memory. We keep it for up to 90 days, or until you delete it. The connection cleanup described above also removes selected answers. You can review or delete it from Manage connections; account deletion removes it. We do not capture whole external-client conversations or final answers automatically.
Your choices
You can change notification preferences, stop artificial intelligence processing, or delete your account in Settings. You can also email privacy@comanager.app to ask about, access, or correct your information.
You can disconnect a client at Manage connections to stop future access and remove its saved answers and activity records in CoManager. Disconnecting does not remove information already shared with that client.
Changes
We may update this policy as CoManager changes. We will update the effective date above when we make a material change.