Privacy Policy

AVRA AI LLC ("AVRA," "we," "us," "our") operates the AVRA fantasy football decision platform at tryavra.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the Service you agree to the practices described here.

1. Information we collect

Information you give us directly:

• Your email address if you previously joined the retired waitlist. Your email and name when you create an account or contact us.
• Account profile data, username, display name, time zone, communication preferences, optional avatar URL.
• Fantasy account identifiers you choose to link, such as your Sleeper username and numeric user ID or an ESPN league ID. Public leagues do not require platform credentials.
• If you connect a private ESPN league, the ESPN SWID and espn_s2 session-cookie values you choose to provide. AVRA keeps them in a deny-by-default credential table, never returns them to the browser after saving, releases them only to the worker holding the live league-read job, and deletes them when you disconnect ESPN.
• Payment information you provide to our payment processor (Stripe) for paid plans. AVRA does not receive or store card numbers.
• Messages you send us via the contact form, email, or support channels.

Information collected automatically:

• Standard log data, IP address, browser type, device characteristics, pages viewed, timestamps.
• Authentication metadata, session tokens, last sign-in time, user-agent strings.
• Usage signals, which leagues you sync, which recommendations you act on, refresh frequency. This drives our model improvements and feature decisions.
• Cookies and local storage for session persistence + remembering your active league.
• If you allow optional analytics: normalized page paths, bounded navigation and product events, campaign tags, device/browser information, and page-performance timings. AVRA never sends a concrete receipt token, email address, or account name in these events.
• Operational error data needed to secure and repair the Service: release/runtime identifiers, a normalized route family, error details, and bounded source-code context. AVRA disables Sentry collection of user information, cookies, headers, request or response bodies, query parameters, generative-AI inputs or outputs, and stack-local variables.

Information from third parties: when you connect a fantasy platform, we receive public league + roster + transaction data from that platform's public API (e.g., Sleeper). We do not request credentials. We do not seek or intentionally collect special-category or sensitive personal data (such as health, biometric, precise geolocation, or government-ID information).

2. How we use information

• To operate the Service, load your leagues, compute projections, deliver recommendations.
• To improve our models, aggregated usage signals refine our machine-learning predictions.
• To communicate with you, transactional emails (welcome, password reset, billing receipts) and, with your consent, product updates.
• To process payments and prevent fraud, via Stripe.
• To monitor security, detect abuse, and protect the platform.
• To comply with legal obligations and respond to lawful requests.

Legal basis (EEA/UK users): where the GDPR applies, we process your data to perform our contract with you (operating the Service and your account), on the basis of our legitimate interests (securing the platform, preventing abuse, and improving our models with aggregated signals), to comply with legal obligations, and, for product and marketing communications, on the basis of your consent, which you can withdraw at any time. AVRA does not make decisions producing legal or similarly significant effects about you based solely on automated processing; you make all final roster decisions yourself.

3. Who we share information with

We do not sell your personal data, and we do not share it for cross-context behavioral advertising (as those terms are defined under California law). We share limited information only with the following service providers, and only as needed to operate the Service:

• Supabase, our database and authentication provider. Stores all account, league, and usage data.
• Resend, sends our transactional and account emails.
• Stripe, processes payments. Stripe receives your billing information directly; AVRA does not store card data.
• Modal Labs, runs our machine-learning training jobs on aggregated, non-personally-identifying data.
• Google Analytics, after you allow optional analytics, receives normalized page paths, bounded site events, campaign tags, and device/browser data for site measurement. Advertising storage, advertising user data, and ad personalization remain disabled.
• Cloudflare Web Analytics, after you allow optional analytics, receives cookieless page-view and performance timings plus aggregate path, referrer, country, device, browser, and operating-system dimensions. Cloudflare Web Analytics does not log query strings or track people across customers' sites.
• Sentry, receives privacy-restricted error and performance events so we can detect, diagnose, and verify production repairs. Sentry is operational monitoring, not advertising analytics.
• Sleeper and ESPN, when you choose to connect a league, provide the league settings, rosters, transactions, and other fantasy data AVRA needs for league-aware decisions. Private ESPN access uses the session cookies you explicitly save for that purpose.
• Law enforcement or regulators, when required by valid legal process.

4. Data security

We protect data with TLS encryption in transit, encryption at rest, row-level security and deny-by-default credential custody, scoped API tokens, and least-privilege access. Private ESPN cookie values cannot be read through the normal account API and are released only to the live worker assigned to your league-read job. No system is perfectly secure; if we ever discover a breach affecting your data we will notify you promptly as required by law.

5. Data retention

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct or update inaccurate personal data.
• Delete your personal data (GDPR Article 17, CCPA right to delete).
• Export your data in a portable format (GDPR Article 20).
• Object to or restrict certain processing.
• Withdraw consent for marketing communications at any time.
• Lodge a complaint with your local data-protection authority (EEA/UK users).
• Not be discriminated against for exercising any of these rights.

Most of these rights can be exercised directly in your account settings (My account, Danger zone). For anything else, email [email protected]. You may use an authorized agent to submit a request on your behalf where the law allows, and we will verify your identity before acting on a request.

7. Cookies and tracking

8. Children

The Service is not intended for children under 13 (or under 16 in jurisdictions where that is the applicable threshold). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.

9. International users

AVRA AI LLC operates in the United States. If you access the Service from outside the U.S., you understand and consent to the transfer and processing of your information in the U.S., where data-protection laws may differ from those in your country. Where we transfer the personal data of EEA or UK users to the United States, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to protect that data.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Last updated" date and, where appropriate, notify you by email or in-product banner. Continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

11. Contact

Questions about this Privacy Policy or our data practices? Reach us at [email protected], via the contact form, or at: