Privacy Policy

Version 2026-10-11 · Treeport Holdings LLC

Who we are and what this covers

Treeport Holdings LLC operates MFL Live and decides how the personal information described here is used. This policy covers mfl-live.com, the web app at app.mfl-live.com, and our iOS and Android apps. It explains information used to provide the app and optional information used to understand how it is used. MyFantasyLeague and the app stores have their own privacy practices. This policy is also available in French and Spanish: Politique de confidentialité and Política de privacidad.

Our Privacy Officer is responsible for this policy and for privacy requests. Contact the Privacy Officer at support@mfl-fantasy.com, or write to Privacy Officer, Treeport Holdings LLC, 2108 N ST #16273, Sacramento, CA 95816, USA.

Information used to provide the app

Account and league access. We process the MyFantasyLeague username and password you enter to sign in, and the session information returned for authorized requests. Depending on the platform, requests go to MyFantasyLeague directly or through our service. The app saves your username, session, and league preferences locally so you can stay signed in. It also saves the Terms and Privacy Policy versions you acknowledged, the time, and whether you used Sign In or Agree. After our backend verifies the MyFantasyLeague session and league membership, we keep the same acknowledgment under your MyFantasyLeague username, with the season, league ID, franchise ID, platform, and app version used, so each account sees an update notice once on any device and we can show which versions it acknowledged. If you signed in before the app saved your username, we keep the acknowledgment under a one-way hash of your MyFantasyLeague session, with the league and franchise IDs that session owns, and move it under your username the next time you sign in. The account record does not contain your password or session cookie. It is not an analytics consent record and is not part of the usage reports. The device keeps a copy so the app works offline. We obtain league, franchise, roster, scoring, and related information from MyFantasyLeague to provide the features you request. Account and league identifiers may also be processed by our backend to verify access. You need a MyFantasyLeague account to use the app; the optional usage data described below is never required.

Franchise presence and activity. While you are signed in and the app is in the foreground, the app periodically sends the season, league ID, franchise ID, public franchise name, app version, app build number, available operating-system name and version, and the Privacy Policy version you acknowledged, after our backend verifies the MyFantasyLeague session and league membership. We use a device-level last-seen record under the anonymous Firebase authentication identity to calculate the short online-status window. We also keep one canonical latest-active timestamp, app release, and operating-system metadata for each season, league, and franchise as restricted backend service data for community and service operations across multiple devices; individual franchise activity is not displayed in the Usage report. The canonical record does not contain the Firebase identity, MyFantasyLeague credentials, session cookie, device identifier, or device model. From that activity we also keep hourly aggregate counts for each season and league under a pseudonymous league reference: how many times a franchise returned to the league after at least 30 minutes away, how many franchises were active in each hour and how many hours had passed since each of them was last active, and the highest number present at the same time in each five-minute period. Those counts contain no franchise, device, account, or league identifier. The Usage report shows them only as season-and-league totals and as totals across all leagues by day, week, month, or hour. This is standard app functionality and is not controlled by the optional Share usage data setting.

Daily app activity record. From the same signed-in activity, we keep one record per installation per day under a keyed one-way code derived from the anonymous Firebase authentication identity, with the UTC hours of that day in which the app was open. We use it to count active installations and to find people who use the app on many days, whom we may invite to give feedback. The record contains no names, account, league, franchise, or device identifiers and no details of what you did. App versions that acknowledged an earlier policy keep it only while Share usage data is on.

Operation reports. The app reports the outcome and coarse duration of key operations, such as loading players, saving a lineup, refreshing a matchup, sending chat, and submitting feedback, so we can find and fix failures and slow responses. Each report contains a fixed screen and operation name, the outcome (success, timeout, unavailable, rejected, or error), a coarse duration, the platform, the app version, a random event code that prevents duplicate counting, and a coarse receipt time. Reports omit names, account, device, session, league, and franchise identifiers, IP addresses, URLs, credentials, message content, and raw error text. The app sends them after you acknowledge this policy, whether Share usage data is on or off. Google Analytics receives them only while Share usage data is on.

Invite counts. When you invite league mates from the app, by posting to League Chat or by sharing or copying the invite link, we count the invite. For each UTC day, season, and league, under a pseudonymous league reference, we keep how many invites went out by League Chat and by link in each UTC hour, and from which screen. The counts contain no names, no franchise, account, or device identifier, and no message text. The Usage report shows daily totals, how many leagues received an invite, and how many teams first used MFL Live in a league within 14 days after an invite there. The app counts invites after you acknowledge this policy, whether Share usage data is on or off.

Messages and support. When you post chat, report content, or send feedback, we process that submission and the account, league, franchise, version, and platform context needed to deliver it, check permissions, respond, and moderate abuse. League chat may be visible to other league members and is handled with MyFantasyLeague. Do not include passwords or unnecessary sensitive information in chat, feedback, or support requests.

Franchise Image Studio. If you create team images, our backend first verifies the MyFantasyLeague session and that you own the franchise. It then sends OpenAI the style and personalization text you enter, your color and size choices, your team name, league name, and season, and any reference image you choose, so OpenAI can create a team icon and header. For each season, league, and franchise we keep your 12 most recent generations: each icon or header, smaller preview copies of them, both text entries, the style, color, and size choices, whether a reference image was used, and when it was made. We also keep a daily attempt count and, after you save images, the addresses of the saved images. Anyone signed in as that franchise's owner can reopen them in the studio. We do not keep the reference image or your session cookie. Save to MyFantasyLeague uploads the icon, the header, or both, whichever you save, to your franchise on MyFantasyLeague, where other league members can see them.

Image generation service records. At a successful MyFantasyLeague sign-in, our server associates a one-way code of the session with the MFL username whose credentials MyFantasyLeague accepted. This lets us count image generation for the same account across devices without retaining the password or session cookie. For each admitted generation request we keep the verified account username and account code, team and league identifiers and names, season, request time, requested icon and header counts, usable returned image counts, and result (complete, partial, failed, or pending). Replayed requests do not count again. Historical requests that lack an account are attributed to the target franchise and labeled as inferred; their image counts are unknown. Authorized managers and administrators can see these service records in Usage reports to operate the feature and plan future billing. This is separate from optional usage sharing, remains on when Share usage data is off, and does not itself charge you. These records and the account association are retained until no longer needed to operate the feature or you ask us to delete them, subject to legal retention requirements.

Rundown weekly editions. When AI writing is enabled, our server sends Meta checked league facts for the week summary, each team as a team token: this season’s scores, records, rankings, projections, lineup and bench points and playoff chances; past seasons’ final standings and titles from League History; the season’s draft picks, trades, waiver claims and other roster moves; NFL player names with their injury status and recent public news headlines; the franchise names of the teams in those facts; last week’s published summary; and fixed editorial settings. A team excluded from jokes is left out of the request, including its franchise name. Owner names, emails, league identifiers, chat text, trade and draft comments, session credentials and device data are excluded from the prompts. The Muse Spark Contributor tier permits Meta to use prompts and completions to train future models; see Meta’s tier and data-use description. To compare writers, an administrator’s Prompt lab tests also send the same request to OpenAI and Google; these tests are never published, and we keep their results, validation and costs. OpenAI processes these requests under OpenAI’s API data controls. We use Google’s unpaid Gemini API tier, which permits Google to use prompts and responses, including through human review, to improve its products; see Google’s Gemini API terms. Code validates the text and uses templates when validation, the provider or the budget fails. English members may read cached AI prose; French and Spanish members read localized templates. We retain cached editions, commissioner settings and review actions, team joke opt-outs, immutable prompt versions and run/usage records containing a pseudonymous league reference, tokens, cost and validation results to operate and review the feature. Members may exclude their team from jokes and turn weekly edition alerts off in Rundown or Notifications.

Notifications. If you enable supported notifications, we process the push token or installation identifier, notification preferences, and the league and franchise information required to send the notifications. Apple and Google deliver notifications through their services. Device permissions and Notification settings control these features separately from usage analytics.

Trade and waiver notifications. When you use a signed-in league, we retain your MyFantasyLeague session encrypted on our backend so we can check incoming trade proposals, published trade bait, and processed waiver results while the app is closed. We do not retain your password for these checks. Backend workers verify the owner before using private information; private responses are never placed in a public league cache. We keep the verified Firebase identity, season, league and franchise, connection status and activity time, a one-way session fingerprint, current activity identifiers, up to 100 recent notification events, and separate read positions so unread indicators agree across your devices. The trade-proposal, trade-bait and waiver-result switches in Notifications control push delivery; unread indicators continue to work when an alert is off. Logging out removes saved sessions for this installation’s Firebase identity; other signed-in installations are separate. Expiry or 30 days without opening that league removes the saved session and pauses background checks. Opening the league with a valid sign-in resumes checks automatically. These service features and notification choices are separate from optional usage sharing.

Purchases, if used. App stores handle payments. The app may receive product, transaction, or entitlement information needed to provide and restore a purchase. We do not ask you to enter a payment-card number into MFL Live.

Service and security records. Our hosting and backend providers process network information such as IP addresses, request times, device or browser details, and error or security information to serve requests and protect the service. Some existing operational logs include account or league context. These records are separate from the limited custom usage reports described below. Turning off usage reporting does not prevent ordinary requests or security processing needed for the app to work.

Website analytics on mfl-live.com

The public pages at mfl-live.com (the home page, support, Terms, and this policy) use Google Analytics 4 to measure site traffic: pages viewed, the referring site, approximate location derived from network information, and browser or device details. Google sets analytics cookies (_ga and _ga_...) in your browser for this measurement. Personalized advertising, Google signals, and advertising cookies are turned off for this site.

Google Ads website measurement (updated October 11, 2026). When website measurement is on, the same Google tag also connects to our Google Ads account for limited measurement without advertising cookies. Google receives network information needed to handle the request, page and browser information, and consent status. Advertising storage, advertising user-data use, and ad personalization remain denied; ad-click identifiers are redacted from Ads requests. We do not use this tag for personalized remarketing or send account or contact details for enhanced conversions. This tag alone does not report app installations or purchases. The website choice below controls loading of both Google Analytics and Google Ads. Visitors who previously allowed analytics see the updated notice; saved opt-outs are preserved. In opt-in regions, a fresh Allow is required. If the tag is already loaded when you choose No thanks and browser storage is available, the page reloads to stop both tags. A request already sent may complete.

A notice on those pages lets you choose. In a browser whose time zone is in the European Union, the European Economic Area, or the United Kingdom, or cannot be determined, website analytics stays off and sets no cookies unless you choose Allow. Elsewhere, choosing OK or continuing to use the site keeps measurement on, and choosing No thanks stops it in that browser and removes the analytics cookies we set. Your choice is remembered in browser storage; clearing it shows the notice again. This website choice is separate from the app's Share usage data switch described below: it does not change app reporting, and the app switch does not change website measurement. Website analytics uses a separate Google Analytics data stream from the app.

Optional usage data

Optional usage reporting helps us understand which screens and features people use. It has two outputs controlled by one setting:

Google Analytics. Google Analytics for Firebase measures app and feature activity, including the operation reports described above, using app-instance identifiers on mobile and cookies or comparable browser identifiers on web. It also processes device/app metadata and derives approximate location from network information. We do not send MFL or Firebase account identifiers, chat text, feedback text, or credentials as Analytics event parameters. The app disables advertising-related collection and advertising consent. Analytics data is pseudonymous; it is not described as fully anonymous. See Google's explanation of partner data use.

Screen views and feature taps. Our Firebase reports record which fixed screen was viewed or feature was used, with platform, app version, action, and coarse receipt time. A random event code prevents identical retries from being counted twice. These report documents omit names, account, device, session, league, and franchise identifiers, IP addresses, URLs, credentials, message content, and raw error text. Daily totals summarize events by fixed dimensions and receipt hour. Removing identifiers reduces the risk of identification but does not guarantee anonymity, especially in small groups.

A separate, restricted admission counter uses a hash derived from Firebase authentication to limit requests. It is not included in the usage reports and is not used to reconstruct a person's activity. Infrastructure logs remain a separate data set.

Your single sharing control

Open Privacy settings → Share usage data from the app menu. When the Settings hub is available, use Settings → Privacy settings. Privacy settings is available after sign-in and any required Terms acknowledgment. In versions released before the Settings update, use Usage analytics → Share usage analytics instead.

Turning the switch off stops new Google Analytics collection and new screen-view and feature-tap reports, and discards unsent ones. A request already transmitted may finish. It does not stop the information used to provide the app, including franchise presence, the daily app activity record, operation reports, and invite counts. Your saved choice applies to that installation or browser; it does not automatically change another device. Clearing browser storage or reinstalling may remove a locally saved choice. Changing this setting does not restrict app access or alter notification preferences.

Share usage data starts on for an installation or browser with no saved choice, except in Canada, the European Union, the European Economic Area, and the United Kingdom, where it starts off. The iOS and Android apps decide by the country of your App Store or Google Play account, or by the device's region setting when the store gives no country, and start off when neither is known. The web app decides by the browser's time zone, and starts off when it cannot be determined. Reporting begins after you acknowledge the current legal documents, and where sharing starts off, only if you turn it on. A saved choice, on or off, is kept when the app updates. Turning reporting off does not automatically delete information already received; retention and privacy requests are addressed below.

Why information is used and who receives it

We use service information to authenticate requests, provide league features, show recent franchise presence, count active installations, count invites and the teams that join after them, find and fix failures, invite frequent users to give feedback, support community and service operations, deliver requested messages and notifications, respond to support, prevent abuse, and meet legal obligations. We use optional usage information to evaluate and improve MFL Live.

Google Firebase and Google Cloud process hosting, authentication, database, function, and notification data for these features. Google Analytics is a separate analytics service with its own terms. MyFantasyLeague receives requests necessary for your account and league actions. OpenAI receives the Franchise Image Studio text, choices, team details, and reference images described above to create images; see OpenAI's API data controls. Other league members receive content you choose to share with them. App stores process purchases and distribution. Authorized personnel and service providers may access data needed for support, operation, and security.

We may disclose information when required by law, to protect rights and security, or in a business transfer subject to appropriate protections. We do not sell personal information, use the custom usage reports for advertising, or use them to identify users. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal bases in the EU, EEA, and UK

If the EU or UK General Data Protection Regulation applies to you, we rely on these legal bases:

Contract: Account and league access, franchise presence and online status, messages, Franchise Image Studio, and notifications you turn on, because they are the Services you ask us to provide.

Legitimate interests: Service and security records, operation reports, the daily app activity record, aggregate league activity counts, invite counts, and feedback invitations. Our interests are keeping MFL Live secure and reliable, fixing failures, and understanding how many people use it and how league mates find it. These records carry no direct identifiers and expire on the schedules below. You can object to this processing.

Consent: Google Analytics, screen views, and feature taps through Share usage data, and website analytics where the notice asks you to allow it. You can withdraw consent at any time; withdrawal does not affect processing before it.

Legal obligation: Keeping records of the legal documents you acknowledged and responding to lawful requests.

International transfers

We are based in the United States, and our service providers, including Google (Firebase, Google Cloud, and Google Analytics) and OpenAI, process information in the United States and other countries. If you use MFL Live from outside the United States, including from Canada, Australia, New Zealand, the United Kingdom, or the EU/EEA, your information is transferred to, stored in, and processed in the United States, where it may be accessible to courts, law enforcement, and national security authorities under US law. For transfers from the EU/EEA and the UK we rely on our providers' data processing terms, which include the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum; Google is also certified under the EU-U.S. Data Privacy Framework and its UK Extension. Requests to MyFantasyLeague are necessary to provide the app you ask for. Contact the Privacy Officer for more information about these safeguards.

Retention and deletion

Screen-view, feature-tap, and operation reports: Scheduled to expire 30 days after the received UTC hour.

Daily event totals, daily app activity records, and invite counts: Scheduled to expire after 13 calendar months.

Separate admission counters: Scheduled to expire after two days.

Google Analytics information: Governed by separate configured retention periods and Google's processing rules; the custom-report periods do not apply.

Franchise presence and activity: The canonical activity record keeps only the latest active time for each season, league, and franchise rather than a detailed activity history. Aggregate league session, active-franchise, return-interval, and concurrency counts are scheduled to expire after 13 calendar months. Device-level presence and membership-verification records are retained as needed to provide and protect the feature.

Franchise Image Studio: Each franchise's 12 most recent generations, with their text and choices, and its attempt count are kept until newer generations replace them or you ask us to delete them. OpenAI's handling of image requests is described in its API data controls linked above. Images saved to MyFantasyLeague follow MyFantasyLeague's practices.

Terms and Privacy acknowledgments: Each acknowledgment is kept for as long as we need to show which versions an account acknowledged and for legal purposes. A new acknowledgment is added to the history rather than replacing earlier ones.

Account/session, chat, push, feedback, operational logs, and backups: Retained as necessary for their service, security, support, and legal purposes. They do not inherit the custom-report expiry periods.

Automatic Firestore deletion is asynchronous, so a record can remain after its scheduled expiry. Aggregated information without a usable user link cannot necessarily be attributed to you for an individual deletion request. We do not collect new identifiers merely to identify a person in such totals.

Who can use MFL Live

MFL Live is intended for people aged 18 or older who live in the United States, Canada, the United Kingdom, Australia, or New Zealand. We do not offer use by minors based on guardian permission. Contact us if you believe a person under 18 has provided information so we can investigate and take appropriate action. This audience statement is not a claim that every website visitor's location or age has been verified.

Your privacy rights

To request access, correction, deletion, or a copy of information we can associate with you, or to withdraw consent or object, contact the Privacy Officer. We may need to verify your request and may retain information where legally permitted or required. We will respond within the time applicable law requires and explain any limitations. We will not discriminate against you for exercising your rights. Uninstalling or signing out does not itself delete server records, your MyFantasyLeague account, or a store subscription.

United States: Depending on the applicable law and its coverage, you may have rights to access, correct, delete, or obtain a copy of personal information; learn about recipients; opt out of sale, targeted advertising, or certain profiling; and appeal a decision on a request. You may contact us through an authorized agent where the law permits. You can also contact your state privacy regulator or attorney general.

Canada: You can access and correct your personal information and withdraw consent to optional uses. In Quebec you can also ask for a copy of computerized information in a structured, commonly used format, and ask us to stop disseminating information or to de-index a link to it. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec.

Australia and New Zealand: You can access and correct your personal information. If you are not satisfied with our response to a complaint, you can contact the Office of the Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner.

EU, EEA, and UK: You have rights of access, correction, erasure, restriction, portability, and objection, and you can withdraw consent at any time. You can complain to the data protection authority where you live or work or, in the UK, to the Information Commissioner's Office. Send these requests to the Privacy Officer above.

Do Not Track and Global Privacy Control are different signals. We do not currently use the legacy Do Not Track signal to operate the usage toggle. Global Privacy Control expresses an opt-out from uses such as sale or targeted advertising where applicable law recognizes it; it is not the same as this app's usage-sharing switch. Contact us about applicable privacy choices.

Security and policy updates

We use access restrictions and technical safeguards appropriate to the Services. Network connections for our Firebase and MyFantasyLeague HTTPS requests are encrypted in transit. Encryption does not make data anonymous or remove the need for disclosures. No system can guarantee absolute security. If a security incident creates a risk of serious harm, we will notify affected people and regulators as the law requires.

We will identify material policy changes and the effective date. We may show an update notice in the app. Acknowledging a new notice does not erase an opt-out or retroactively authorize a new data use. We will obtain any new consent required for a changed practice before that collection starts.