Privacy Policy

Who's Starting is a free app. We don't sell your data — to anyone, ever. Below is exactly what we collect, why, and which outside services can see it.

Most of our analytics we run ourselves, in-house. Alongside that, two third-party analytics services run on the site:

• Cloudflare Web Analytics — aggregate traffic totals, cookieless and anonymous by design. Cloudflare never sees who you are.
• Google Analytics 4 (measurement ID G-XGX0C3ZEKG) — page views, general location (country/region/city, from your IP address), device and browser type, and how you move between pages, so we can see which pages and features actually get used. Google may set a cookie to do this. You can opt out of Google Analytics site-wide with Google's browser add-on, or block it with any standard tracker/cookie blocker.

What we record when you visit: the pages you view, the link that sent you here, roughly where you are (country, region, city, from your IP address), your browser and device type, and how you interact with a page, meaning clicks, how far you scroll, how long you actively spend, and searches you run on the site. We also record when you start or play a Dynasty career, when you make a Pick’em pick, add a player, or open a card pack (whether the pack opened and finished, and the rarity of the best card, never which player), so we can see which features people actually enjoy. (Long Draft is retired for this season; entries already made are kept from that game and deletable on request — see Contact.) Team and player searches you run, and those pages you open, are also counted as anonymous interest heat (sport, kind, and slug only — never the typed query text) so the home Pulse module and the search-heat page can show where fans are looking.

A few more things we record, all about how the page behaved rather than about you: which parts of a page actually scrolled into view, how quickly the site responded when you tapped something, when a page throws an error, and when you copy text.

On forms, we record the name of the box you tapped into and how long you stayed in it, and nothing else. If you start a form and leave without submitting it, we record which box you were on when you gave up, so we can find the ones that are confusing. We never record what you type. Not the characters, not the finished value, not any part of it. There is no keystroke logging anywhere on this site.

We do recognize returning visitors. Your browser stores a random ID so we can tell that the same person came back, which is how we learn whether people return to play Dynasty again. That ID is random, it is tied to this site only, and it can never be read by any other website, including our own other sites. Alongside it we keep two small numbers: how many separate visits you have made and the day you first arrived, which is how we tell a first-time visitor from someone coming back for a fourth time. Clearing your browser storage resets all of it. Separately, we also derive a scrambled code from your IP address and browser so a visit still groups correctly when that ID is missing. That code cannot be turned back into your IP address, and it changes on its own whenever your IP does.

Either way, none of this is linked to your name, and we never buy or combine data about you from anywhere else. We do not know who you are. We know that someone came back.

If your browser sends a Do Not Track or Global Privacy Control signal, we honor it: we still count the visit, but we do not store a returning visitor ID in your browser, we do not keep your visit count or your first-visit day, and we do not record the text of your searches.

An account is a real email and password through Supabase. It exists for optional Dynasty cloud-save backup across devices. Signing in never unlocks or blocks any feature on the site. Charts, My Players, pick'em, and every other game stay free with no account at all. You can create an account at whosstarting.com/account/.

• Your account email is used to sign you in and connect your Dynasty save across devices.
• Coming in a future update: when you're signed in, the pages you visit and what you tap here will be linked to your account so we can see how account holders use the site. This will be internal only, never shown publicly, never sold or shared. If your browser sends Do Not Track or Global Privacy Control, we won't link it. We'll update this page when it starts.
• Cloud saves are private — protected by owner-only access controls (row-level security) in our database.
• One save slot per account.

The contact form sends your message through Supabase (a durable record so nothing gets lost) and, on our end, email. We use it to reply to you and to fix real problems — never for marketing.

The intern application form sends your name, contact info, and answers through Supabase (a durable record) and, on our end, email. We use it only to review applications and reply — never for marketing. You must be 16 or older to apply, and we keep applications for 12 months before deleting them.

The idea box on the Roadmap takes what you type and, if you choose to add one, your email address (only so we can tell you when it is built, and we do not send anything automatically). We keep it in Supabase, protect the form with Cloudflare Turnstile and a hashed version of your IP address (to limit spam), and delete ideas after 12 months. What you type is never shown publicly: the Roadmap lists only items we write ourselves, and nobody's name or email appears there.

Two features that used to appear here are retired as of September 2026 — everything they offered is free now, so neither is needed:

• Stripe is no longer used for anything on this site. Historical billing records from when it was are retained, not deleted, for our own bookkeeping — they are not used for anything active.
• The old weekly depth-notes email signup is gone from every page. A small number of email addresses collected while it was live are retained, not deleted, but that list was never sent to and won't be contacted going forward. It is a separate list from the article newsletter below, and signing up for one has never added you to the other.

If you enter your email in the “Get our articles by email” box, we store that address to send you one email a week, on Sunday morning, containing whatever articles we published that week. That is the only thing it is ever used for.

• What we store:your email address, the date and time you signed up, the page you signed up from, your browser's user agent, and a one-way hash of your IP address. We keep those last few because they are the record of when and where you agreed to be emailed — there is no confirmation click, so that record is the evidence.
• We never sell or share it, and we never use it to contact you about anything other than new articles.
• Unsubscribing is one click, from a link in every email, with no sign-in. It takes effect immediately and permanently, and the signup form deliberately will not put an unsubscribed address back on the list — not even if someone else types it in. If you unsubscribe and later change your mind, tell us and we'll switch you back on.

Features like People's Ratings and pool leaderboards (Pick'em, The Long Draft) use a random, anonymous identifier generated by your device — not your account, your name, or any other identifying information. We have no way to connect a vote back to a person.

By default, your Dynasty Mode save lives only in your browser or device's local storage — it never leaves your device. Cloud backup (above) is opt-in, not automatic.

We use three service providers to run the app: Supabase (accounts, cloud save storage, and the contact form), Cloudflare (hosting and analytics), and Google Analytics (the website usage analytics described above).

We don't share data with anyone beyond the three providers named on this page. If we add a new partner that can see visitor data, this page is updated before it goes live.

• Cloud save: delete it any time from within the app.
• Full account deletion: use the contact form and we'll delete it. In-app account deletion is coming.
• Local save:clear this site's (or the app's) storage/data in your browser or device settings.
• To access or delete any other data we hold about you, just email us — we'll take care of it.

Who's Starting is a general-audience service and isn't directed at children under 13. We don't knowingly collect personal information from children under 13.

This policy covers the Who's Starting iOS app as well as the website — it's the same service, with the same data practices described here.

If this policy changes, we'll update the effective date at the top of this page.

Questions about privacy? Use the contact form. For who publishes this site and how the data is compiled, see About.