Privacy
Last updated 12 September 2026. This covers surplus.football and the Surplus Draft Chrome extension.
Surplus has no analytics, no advertising, no third-party trackers and no cookies for tracking. It does not know who you are unless you make an account, and the only thing it asks for then is an email address.
Two things you can switch on do create a record, and both are off until you press something. Publishing a draft report puts that report at a public link. Turning on in-season reminders stores a notification address for that one browser. Neither happens on its own, both are listed below, and both can be undone.
What is stored, and why
| Data | Why | Where |
|---|---|---|
| Email address | To have an account: to sign you in, to confirm the address, and to reset a password. | Supabase (auth.users, profiles) |
| Your leagues and drafts | So a draft you start on one device continues on another, and so last season's board is still there next year. This is league settings and a list of picks. | Supabase (leagues, drafts) |
| Whether you have paid | To unlock the paid columns. A season, a tier, how it was bought, and when it expires. | Supabase (entitlements) |
| Waitlist email | Only if you type one into the waitlist form. | Supabase (waitlist) |
| A report you publish | Only if you press Share on a finished report. It goes to a public link anyone holding it can open — that is the point of sharing it. What is stored is what the share card already showed: a grade, a finish, a few player names, and the league and team names you typed. No picks, no roster, no email. The link expires after 180 days, and this browser keeps a key that revokes it sooner. | Supabase (shared_reports) |
| In-season reminders | Only if you switch them on and allow the browser prompt. Your browser issues a notification address; we store that, two keys your device generated, which of the three reminders you chose, and your time zone name. The notification text is encrypted to a key that never leaves your device, so the service carrying it cannot read it. No draft, no roster and nothing about your behaviour is attached. Turning all three off deletes the record, and so does uninstalling or revoking permission. | Supabase (push_subscriptions) |
| Daily counts | To know whether a feature is used at all. One row per day per event name and a number — no user id, no IP address, no user agent, no cookie. There is no per-person record in it and it cannot be turned into one. | Supabase (events) |
What stays on your own device
The draft board runs in your browser. Your picks, your queue, your board settings and
the downloaded player data live in that browser's own storage (localStorage
and IndexedDB), and the app works from them offline. The account copy above is a backup
and a way to move between devices — not the primary.
Payments
Card payments are handled entirely by Stripe. Surplus never sees or stores a card number. What comes back is a Stripe customer id stored against your entitlement, so a refund or a renewal can be matched to the right account.
The Chrome extension
Surplus Draft reads no website. It has no content script and no permission for Yahoo, ESPN, Sleeper or any other fantasy site, and it never reads, changes or submits anything on a page you are looking at. It is a draft board of its own that you type into.
It stores, in the browser's extension storage: your sign-in token, the draft you are recording, and small display preferences such as the sort order and where you last dragged its window. It talks to exactly two places — surplus.football and the Supabase project above — and nowhere else.
It does not collect browsing history, page content, keystrokes, location or personal communications, and it is not used for advertising, sold, or transferred to anyone.
Other services this uses
- Your browser's push service — only if you turn on in-season reminders. Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari. They carry the notification to your device. Because the message is encrypted to a key your device generated, they can see that something was sent and how big it was, never what it said.
- Supabase — the database and sign-in, and where everything in the table above is stored.
- Netlify — hosting. Netlify keeps ordinary server request logs.
- Stripe — payments, as above.
- Cloudflare Turnstile — a bot check on the waitlist form only. It is used instead of a CAPTCHA that profiles people.
- Sleeper — only if you choose to import or follow a Sleeper league. Your browser asks Sleeper for that league's public data directly; Surplus does not hold a Sleeper login for you.
Player projections and average draft position are downloaded to your browser as a data file. Nothing about you goes out with that request.
Who can read your data
Row Level Security is on for every table, and the rule is the same one everywhere:
auth.uid() = user_id. Your rows are readable only by your own signed-in
session. The events and waitlist tables have security on and
no policies at all, so nothing but the server can read them.
How long it is kept, and deleting it
Account data is kept while the account exists. Delete your account and the leagues,
drafts and entitlements attached to it are deleted with it — they are foreign-keyed
on delete cascade, so this is not a promise to remember to do it later.
To delete your account, use Delete account on the Account tab while signed in, or email privacy@surplus.football. Removing the extension clears everything it kept on your device.
Children
Surplus is not directed at children under 13 and accounts are not knowingly created for them.
Changes
If this changes in a way that affects what is collected, the date at the top changes and the change is described here rather than quietly applied.