Privacy Policy

Who We Are

Fantasy NBA War Room is an Australian-based fantasy basketball tools platform. We operate the website at fanwarroom.com and related subdomains.

If you have any questions about this policy or how your data is handled, contact us at admin@fanwarroom.com.

What Information We Collect

We collect information in the following ways:

Account registration

• Email address and password — hashed — we never store your plain-text password
• Account creation date and access tier

Email sign-up without registering

• Email address and the page or context where you signed up

Purchases

• Payment is processed entirely by Stripe — we do not receive or store your card number, CVV, or banking details
• We store a Stripe customer ID and purchase record linked to your account

Anonymous usage data

War Room collects anonymous usage data to understand how the platform is being used and to improve it over time. This is standard practice for web products and is a legitimate interest under Australian privacy law, GDPR (EU/UK), and CCPA (California).

• Pages visited, time spent on each page, and the page you arrived from
• Which tools you open — for example Draft Advisor, Trade Analyser
• Player names and team names you click on or search for
• Whether you click an upgrade or sign-up button and where on the page it appears
• Your device type — desktop or mobile — and approximate session count

Device fingerprinting

A non-identifiable hash derived from your browser, device type, screen resolution, and timezone is collected for account security purposes including enforcing concurrent session limits and detecting unauthorised account sharing. This fingerprint cannot identify you personally and is not used for advertising.

What we never track: email addresses, IP addresses, passwords, payment details, and any other personally identifiable information never appear in usage event data. They are stored separately in your account record and are never included in analytics.

Do Not Track: our analytics library checks the browser-level Do Not Track signal before firing any event. If your browser or operating system has Do Not Track enabled, no usage data is collected from your session.

How We Use Your Information

We use the information we collect to:

• Create and manage your account and access to paid features
• Process and verify your purchase through Stripe
• Send product updates, new feature announcements, and relevant content to email subscribers
• Improve the site based on usage patterns
• Enforce account security and detect fraudulent or abusive access

We do not sell, rent, or trade your personal information to any third party for any purpose.

Third-Party Services

We use the following third-party services that may process your data:

Stripe — payment processing. Stripe's privacy policy applies to all payment data: stripe.com/au/privacy

Go High Level — email marketing and communications platform used to send product updates and announcements to subscribers. Go High Level's privacy policy applies to email data processed through their platform.

Replit — hosting infrastructure. Our servers run on Replit's platform.

We do not use advertising networks, tracking pixels, or third-party analytics services.

Cookies and Local Storage

We do not use advertising cookies or tracking cookies. We use browser local storage for the following functional purposes:

• Keeping you signed in between sessions — authentication token
• Remembering whether you have dismissed the email sign-up prompt
• Storing league setup preferences for the War Room tools
• Temporarily queuing anonymous usage events when a network request fails so they can be retried on your next visit — this queue contains no personal information and is cleared once sent

This data stays in your browser and is not transmitted to us except where needed for authentication or for the purposes described above. If your browser has Do Not Track enabled the analytics queue is never written.

Data Retention

We retain your account information and email address for as long as your account is active or as needed to provide services.

Anonymous usage analytics data is retained for a maximum of 24 months and is then automatically deleted. This data contains no personal information and cannot be linked back to any individual.

If you wish to have your account and personal data deleted, contact us at admin@fanwarroom.com and we will action your request within 30 days.

Your Rights — Australia

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt out of marketing communications at any time

You also have the right to lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au if you believe we have mishandled your personal information.

To exercise any of these rights, contact us at admin@fanwarroom.com.

International Users and GDPR — EU and UK

This site is accessible globally. If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation or UK GDPR applies to how we handle your personal data.

Lawful basis for processing

We rely on the following lawful bases when processing your personal data:

• Contract — processing your account details and purchase records is necessary to provide the Service you signed up for
• Consent / legitimate interests — sending product updates and content to users or subscribers who have opted in or purchased from us
• Consent — where you have explicitly provided your email address via the sign-up form

Additional rights for EU and UK users

In addition to the rights listed in Section 7, you have the right to:

• Receive your personal data in a portable, machine-readable format — data portability
• Restrict how we process your data in certain circumstances
• Object to processing based on legitimate interests
• Lodge a complaint with your local data protection authority — for example the ICO in the UK or your national supervisory authority in the EU

Browser storage notice

We use browser local storage — not tracking cookies — for strictly functional purposes: keeping you signed in, remembering prompt dismissals, and storing league preferences. No personal data stored locally is shared with third parties or used for advertising. No consent banner is required for strictly necessary storage under the EU ePrivacy Directive but you can clear your browser's local storage at any time via your browser settings.

For any GDPR-related requests, contact us at admin@fanwarroom.com. We will respond within 30 days.

Biometric Authentication

Fantasy NBA War Room may allow users to enable biometric authentication — such as Face ID, Touch ID, Windows Hello, or supported Android biometric methods — for faster sign-in on their personal device.

Fantasy NBA War Room does not collect, store, receive, or process any biometric information. All biometric verification — including facial recognition and fingerprint matching — is performed entirely on the user's device by the operating system's secure authentication framework (such as Apple Face ID, Apple Touch ID, or Windows Hello). Biometric data never leaves the device and is never transmitted to our servers.

We store only the information required to recognise a trusted device, specifically:

• A WebAuthn / Passkey credential identifier (a public cryptographic key reference)
• Device name and browser information provided by the user's device at the time of registration
• Registration date and last-used timestamp

No face scan, fingerprint template, or other biometric template is stored at any point. Biometric authentication is an optional convenience feature. Users may disable it at any time from Account Settings → Biometric Login and may remove any trusted device from the Trusted Devices list.

This approach uses the WebAuthn / Passkeys standard, a widely adopted open web authentication specification developed by the FIDO Alliance and the World Wide Web Consortium (W3C).

Changes to This Policy

We may update this policy from time to time. Any material changes will be posted on this page with an updated date. Continued use of the site after changes are posted constitutes acceptance of the updated policy.

This Privacy Policy is governed by the laws of New South Wales, Australia.