Privacy policy

Last updated November 1, 2026

CommishDesk (commishdesk.app) gives a private ESPN fantasy football league its own site: a weekly recap email, the league's history, and the commissioner's tools. It's a free beta, and leagues are added by hand. This page says what CommishDesk collects, why, who else handles it, how long it's kept, and how to have it removed. It covers the website, the emails and the CommishDesk ESPN Connect extension for Chrome.

Questions or requests: commissioner@commishdesk.app.

What CommishDesk collects

The league roster

A league's commissioner adds its members by name and email address. Some members are email-only: they get the weekly email and never sign in.

Signing in

Your email address, used to send you a sign-in link. If you sign in with Google, Google shares your name, email address and profile picture link with our sign-in provider. Our sign-in provider also records when you signed in and the IP address and browser of each session.

The ESPN connection

A league that's private on ESPN can only be read with a signed-in member's ESPN cookies, espn_s2 and SWID. The commissioner chooses to connect them, by pasting them in, with a bookmark, or with the Chrome extension. They are stored encrypted, are never shown to anyone, and are used only to read that league from ESPN. They are a sign-in to the commissioner's whole ESPN account, which is why they're handled this way.

One caution for the bookmark: it carries the cookies in the address it opens, and your browser keeps that address in its history even after the page clears it. Delete it from your browser's history afterwards, or use the extension, which never puts them in an address.

League data from ESPN

Team names, managers' names as ESPN shows them and ESPN's member IDs, rosters, lineups, scores, transactions, draft picks, and the league's history back to its first season. That includes managers who were in the league before it joined CommishDesk and never used it. CommishDesk builds the weekly recap (The Rundown) and the history (The Ledger) from it.

What members do on the site

Draft-date poll votes, rule-change proposals and votes, the draft order, and what commissioners write: the rules, a welcome note, prize payouts and past champions.

Visits to the site

Our host receives the usual request details: IP address, browser, and the page address, including invitation and guest-link codes in it. CommishDesk uses no analytics, no advertising, no tracking pixels and no tracking cookies. Your browser keeps your sign-in and your light or dark setting, on your device. Team logos load from wherever ESPN says they're hosted, which sees your IP address.

The Chrome extension

CommishDesk ESPN Connect does one thing: it connects a commissioner's league to ESPN.

• It reads the espn_s2 and SWID cookies that ESPN sets when you sign in to ESPN: when you open it, only to show whether you're signed in, and when you click Connect, to hand them over.
• To suggest your league, it looks at the addresses of any commishdesk.app pages open in your browser. It never looks at any other site.
• It gives them only to your league's own page on commishdesk.app, in the tab it opens, by passing a message inside your browser. It never puts them in a web address, never keeps them, and never sends them anywhere itself.
• If you're signed in there as a commissioner of that league, the page stores them as described under "The ESPN connection". If not, the page discards them.
• The only thing the extension stores is your league's address, on your computer, so it can offer it next time. Removing the extension deletes it.
• It has no analytics and runs no code from anywhere but itself.

CommishDesk's use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

How it's used

To run your league's site, The Rundown and The Ledger; to send the emails you'd expect (sign-in links, invitations, the draft order and the weekly Rundown); and to keep the service working and secure. Nothing is sold, used for advertising, or shared beyond the people and services below.

Who sees what

• Your league's members see the roster, including each other's names and email addresses, and everything on the league's site.
• Guests. A commissioner can turn on a read-only guest link, which goes out in the weekly email. Anyone with it can read what members can, except email addresses. The commissioner can turn it off or replace it at any time.
• Anyone who visits a league's address sees the league's name and its ESPN league ID.
• CommishDesk's operator can see every league's roster (names, email addresses and when people last signed in), its ESPN connection status, and the invitations and emails it has sent, and can make changes to support a league.
• Email recipients. League emails come from commissioner@commishdesk.app with the league commissioner's own address to reply to, so replies go to that commissioner and recipients see the address. A commissioner can also send The Rundown to people outside the league; their addresses are kept with the record of that send.
• The services that run CommishDesk, each only for its part:
  • Supabase: the database, sign-in and encrypted storage, in the United States.
  • Vercel: hosts the website.
  • Resend: sends CommishDesk's email.
  • ImprovMX: forwards mail sent to commishdesk.app addresses to CommishDesk's Gmail inbox.
  • Google: the optional Google sign-in; the site's fonts, so Google sees your IP address and the site's address when a page loads; and Gmail, where that mail arrives.
  • ESPN: CommishDesk reads your league from ESPN with the connected cookies.
  • Anthropic: the AI tools used to build, run and monitor CommishDesk, which can read the database and CommishDesk's own mail (messages sent to commishdesk.app addresses) to do so.
• Anyone the law requires us to tell.

How long it's kept

• Roster entries: until the person is removed from the league, or the league is deleted. Removing someone deletes their votes. Rule proposals they wrote stay, no longer linked to them, and saved draft orders keep the names they were drawn with, as the league's record of each draw.
• ESPN cookies: until a commissioner disconnects ESPN, the person who connected them leaves the league or stops being a commissioner, or the league is deleted. Each of these deletes them at once. ESPN itself expires them after about a year.
• League data, The Rundown and The Ledger: as long as the league exists. Keeping every season is the point.
• Recent ESPN reads are cached for up to two days.
• Sign-in accounts: until you ask for yours to be deleted, which also takes you off your leagues' rosters.
• Records of invitations sent and of administrative changes keep the email addresses involved, even after someone leaves, so that sending limits hold and changes can be traced.
• The services above keep their own logs for their own limited periods.

Your choices

• To be removed from a league, ask its commissioner. To have your sign-in account and personal details deleted, write to commissioner@commishdesk.app. The league's history keeps the names ESPN shows for its teams, and the records described above keep email addresses; ask if you want something specific taken out.
• To stop getting CommishDesk email, ask your league's commissioner, or write to commissioner@commishdesk.app.
• Commissioners can disconnect ESPN at any time in Admin. Signing out of ESPN everywhere also ends the cookies.
• Remove the Chrome extension to delete what it stores.

Security

Everything travels over HTTPS. ESPN cookies are stored encrypted and never sent back to any browser. Each league's data is visible only to that league's members, its guest link and CommishDesk's operator. No system is perfectly secure; if something goes wrong that affects your information, you'll hear about it.

Children

CommishDesk isn't meant for anyone under 13 and doesn't knowingly collect their information.

Changes

This page is updated when what CommishDesk collects or shares changes, with the date at the top. Commissioners hear about significant changes by email.