Privacy

Penthouse stores the least it can get away with: an email address or a mobile number so your purchase follows you, which leagues you connected, and what it recommended so it can check later whether it was right. It never stores your ESPN password or cookies, and never sees your card details. Nothing is sold to anyone. We do measure which posts and ads bring people in, and when ad tracking is switched on, the ad networks named below learn that a visit, a sign-up or a purchase happened, so our ads reach people like the ones who use us.

• Your email address, your name if you gave one, and a hash of your password, if you create an account. The password itself is never stored, only a salted scrypt hash of it, which cannot be turned back into the password. The email is the key that purchases and connected leagues hang off.
• Your mobile number, if you sign up or sign in with your phone. It is how you sign in: we text it a one-time code. We send marketing texts only if you tick the box that asks for them, and you can untick it on your account page or reply STOP at any time. An account made with a phone has no password; an email is optional.
• The leagues you connect: the platform, the league and team identifiers, and the league name. Enough to rebuild your week when you come back.
• Your purchases: which pass, which season, and the Stripe checkout reference. Never a card number, which we could not store even if we wanted to.
• Whether you asked for the weekly email, if you tick that box when signed in. One row saying yes or no, and nothing else. Untick it, or delete your account, and it is gone.
• How you found us, and the steps you took: the campaign tags on the first link you arrived by, the website that sent you (its name only, never the page), a random id your browser makes, and a short log of milestones such as signing up, connecting a league, reaching a paid feature, starting a checkout, paying, cancelling and sharing a card. It never holds your league identifier, your roster or your ESPN cookies. This is how we know which ads are worth paying for.
• What we recommended, with the version of the engine that produced it, plus any Helpful/Wrong vote you leave. This is how we grade ourselves against what actually happened. It is the only reason the accuracy numbers on the site mean anything.

Reading a private ESPN league requires two cookies from your browser, espn_s2 and SWID. Those are a read session for your whole ESPN account. They cannot be narrowed to one league, and we cannot revoke them.

So we do not keep them. They stay in your browser, ride along with the request that needs them, and are gone when it finishes. They are never written to our database or to disk, and logs record only a fingerprint, never the values. Cached league data is keyed to that fingerprint, so a private league is never served to someone who has not proved they can read it.

The deliberate cost: anything that runs without you, such as a scheduled weekly email, cannot read a private ESPN league, because by then we have nothing to read it with. We think that is the right trade.

Yahoo opens every league only to its members, so connecting one means signing in with Yahoo and letting Penthouse read your fantasy leagues. Yahoo asks you to approve that on its own page; we never see your Yahoo password.

Yahoo then issues a pair of keys that can read your fantasy data and nothing else. Like the ESPN cookies, they stay in your browser and ride along with the request that needs them. Our server passes them to Yahoo and does not write them to our database or to disk. You can withdraw our access at any time in your Yahoo account settings, or clear it on this device from the connect page.

Turning a trade verdict into a link at /s/… publishes a display-only snapshot: the verdict, the player names already on the card, and the numbers. It carries no email address, no league identifier and no roster. Anyone with the link can open it, so treat it as public, because it is.

• Stripe takes the payment. Card details go to Stripe, never to us. We receive that a purchase succeeded and a reference for it.
• Twilio texts the sign-in code when you use your phone. It receives the number and nothing else about you, and it checks the code; we never see it.
• Sleeper, ESPN and Yahoo are read to fetch your league, rosters and projections. We read from them; we do not send them anything about you beyond what the request requires.
• Anthropic, only when written trade explanations are switched on, and then only the numbers and player names already in the verdict. Never your email or your league. With the setting off, explanations come from templates and nothing leaves our server.
• PostHog, Meta, Reddit and Google, only where each is switched on: PostHog counts page views (with any league number in the address blanked out), and the three ad networks receive that you visited, signed up, connected a league, started a checkout or bought, so they can measure and aim our ads. None of them receives your email, your phone number, your league or your roster from us. Blocking them in your browser changes nothing about the app.
• Our hosting providers, who necessarily process requests on our behalf.

Your sign-in session, the league you last connected, your light or dark preference, and, in a demo build, which features are unlocked, plus the random id and first-visit campaign tags described above. These sit in your browser’s own storage. The ad networks and PostHog, where switched on, set their own cookies; an ad or tracker blocker stops them without breaking anything.

Recommendation records are kept while they are useful for measuring accuracy. Purchase records are kept as long as the law requires for a sale.

Ask us and we will delete your account and everything attached to it. Deleting the account ends access to any pass bought with it.

Penthouse is not intended for anyone under 13, and we do not knowingly collect their information.

If this page changes in a way that matters, the date at the top changes and we say so in the app. Continuing to use Penthouse after that means the new version applies.