Bellcow · Privacy

Privacy policy

Effective September 11, 2026 · updated September 25, 2026

Bellcow is a fantasy football tool made and run by Adorea (“we”). It is invite-only. This page says what it keeps about you, why, who else sees it, and how to get it deleted. It is written to be read, not skimmed past, and everything in it describes what the app actually does.

What Bellcow keeps

Your account

The name you sign in with, the handle behind it, and a password. The password is never stored; only a salted hash of it is (PBKDF2, 600,000 rounds). No email address or phone number is needed to have an account. Kept with it: who invited you (and, if you came in on an invite link, your name on that link's list), your preferences — favourite team, default week, background, which widgets Home shows, whose projections your MFL lineup reads — and when you were last active, which updates on every request and is seen only by us.

The fantasy accounts you connect

Only what you add, and each one can be removed on its own from Settings → Accounts.

Sleeper. Your public Sleeper username and which league opens first. Sleeper's public data needs no password, and none is asked for.
MyFantasyLeague. The per-season MFL API key you paste in, and which franchise you claimed. The key is encrypted on the server with a key held only there, and used solely to read your league on your behalf. Forget it in Settings and it is deleted. The app owner's own key also answers reads every member of that league can already see on MFL, such as the draft order.
ESPN. For a public league, only the league's id and your team's id. For a private league, the two session values ESPN's own website issues to you when you sign in there (named espn_s2 and SWID), either pasted in or, in the iPhone app, captured after you sign in on ESPN's own page inside the app. They are encrypted on the server and used only to read the leagues you are in. Bellcow never sees or stores your ESPN or Disney password. Disconnect deletes the session values.
Teams you enter by hand. The team name, the players, the scoring rules and the record you type.

What you do in the app

Which pages you open, counted per day, so we can tell whether anyone uses this. No IP addresses, device identifiers or location are recorded with it.
Feedback you send through the app.
Your weekly lineup check-offs, and, per league, the last set of starters the app read and when it noticed they had changed.

What Bellcow does not do

No advertising, no ad networks, no analytics services, no tracking pixels. Nothing about you is sold, rented or shared with anyone for their own purposes. There is no marketing email, because the app does not have your email.

Cookies and storage on your device

One cookie keeps you signed in. It is set to last 400 days, but the sign-in behind it ends the moment you sign out, and a signed-out cookie is not honoured. A few small settings live on your device, such as which league you were last looking at and which version of the app you last saw, and never leave it.

Who else sees data

Sleeper, MyFantasyLeague and ESPN receive what is needed to read your leagues: your Sleeper username, your MFL key, your ESPN session. Those requests are made to their services under their own terms.
FantasyCalc (player values) and nflverse (statistics, used under the CC BY 4.0 licence) supply data to the app and receive nothing about you.
Team pictures and logos from your Sleeper, MFL and ESPN leagues are loaded from those services when a page shows them, so they see the image request and nothing else; the request carries no referrer.
Render hosts the app and its data on servers in the United States, and keeps ordinary server logs (which include IP addresses) under its own policy. Cloudflare provides the domain's name service and sits in front of the app: every request passes through it on the way to Render, it keeps copies of the app's public files (never your account or league data), and it keeps its own logs (which include IP addresses) under its own policy.

Bellcow is not affiliated with, endorsed by, or connected to ESPN, Disney, Sleeper, MyFantasyLeague, FantasyCalc or the NFL.

The iPhone app

The app shows bellcowff.com inside a web view, so everything above applies to it the same way. Its ESPN sign-in opens ESPN's own page in a sheet inside the app; you sign in on Disney's page, and when the sheet closes, whichever way, every cookie that sign-in set is deleted from the app. The only thing kept is the two session values, which go to the server to be encrypted. Haptic feedback uses nothing about you.

Keeping it safe

Everything travels over HTTPS. Passwords are hashed; your MFL key and ESPN session are encrypted at rest with a key held only on the server; sign-in tokens are kept on the server's disk. Sign-in locks a name after repeated wrong guesses. No system is perfectly secure, and we will tell you if something goes wrong with yours.

How long it is kept

Account data stays until you delete the account. A sign-in lasts until you sign out. An ESPN session stays until you Disconnect, an MFL key until you Forget it, a hand-entered team until you delete it. Usage is kept as daily totals for as long as the account exists.

Your choices

Settings → Accounts shows every connection and lets you remove any of them, and Delete my account there removes the account itself at once: the record, its connections and keys, your hand-entered teams, your lineup log, your feedback and your usage totals; your name on an invite's list is blanked. To see everything held on your account, email [email protected]. There is no self-service password reset; email the same address and we will reset it.

Children

Bellcow is not directed at children under 13 and does not knowingly keep information about them.

Changes

If this policy changes, the new version is posted here with a new effective date.

Contact

Adorea, at [email protected]. Questions, a password reset, and requests to see or delete your data all go to that address, and a person answers every one. For anything else, business included, write to [email protected].