How Box Out uses your data

Plain answers, written from what the software does. Each question can be linked to on its own.

What does Box Out read from ESPN?

Your league as ESPN holds it: its settings, its teams and who manages them, rosters, lineups, matchups, the draft, and every add, drop and trade, for each season ESPN will give. A public league is read the way anyone can read it; a private one with the ESPN cookies of the member who connected it.

Can Box Out change anything on ESPN?

No. Box Out only reads your league: it can't set your lineup, make a move or bid for you. Nothing is ever written back to ESPN with anything you give it, and your cookies, if you give them, are opened only to read.

What happens after I connect?

Your league's history is read from ESPN, every season it holds, as soon as the site is free and at its next pass at the latest (four a day). It takes one to two minutes a season, the league's pages open when it is done, and the league's own numbers are measured over the following hours.

What do you keep, and where?

Everything is kept in Box Out's own database, on its server, with a nightly backup kept fourteen days and an encrypted copy of it off the server. What is kept is your account, what you make here, the days you were signed in, when you last read each league's Board, and your ESPN cookies only if you give them for a private league. In full:

• Your email address, to sign you in and send the mail you ask for. It is never shown to another member: your leagues see the name you choose. Signing in proves it is yours, so a sealed copy of it is listed on Alerts as a confirmed address, and you can remove it there; once removed, signing in never adds it back. Which mail reaches it is each switch on Alerts, per league: the morning digest and the alerts between digests are off until you turn them on; trade proposals, claims waiting on you and the answer to your own claim are on; mentions, direct messages and joins are off until you turn them on.
• A sign-in link, or its code. There is no password. Only a fingerprint of the link is stored, and it works once, for fifteen minutes.
• Your session, for thirty days after you were last here. Only a fingerprint of it is stored; the cookie is sent over HTTPS alone and can't be read by a script on the page.
• espn_s2 and SWID, if you give them, sealed (encrypted and signed) with a key kept on the server and never in the database, so a copy of the database, a backup for one, opens neither.
• What you make here: your draft plans, projection files you upload, board posts, messages, and the tokens of tools you connect (only a fingerprint of each token).
• The days you were signed in, one row a day: your account and the date, and nothing else. Never which pages you opened, never a time of day, never how often. They are kept for the day streaks on your Achievements page ("Three days running") and used for nothing else. A day is a UTC day.
• Your achievements: which ones you have unlocked in each league and the day of each, the one you choose to show beside your name there, and when you last looked at the new ones. Most are read from what is already kept (your posts, your plans, your team's results in the league); three, the guided first tasks, are recorded when you finish them.
• When you last read each league's Board: one time per league, kept so the Board can say what is new since ("Three new since you were last here") and draw a rule where you had read to. Reading the Board moves it to now; it is overwritten each time, never a history, never which posts you opened, never how often. Viewing the site as a test account, or a tool you connect reading the board, does not move it.

Why would Box Out need my ESPN cookies?

Only for a private league: ESPN shows a private league only to someone signed in. Box Out asks for them only after ESPN has said your league is private, and asking your league manager to make it public always comes first.

What are my ESPN cookies, and what could someone do with them?

espn_s2 and SWID together are your ESPN sign-in: anyone holding them can use ESPN as you until they expire, your lineup, moves and settings included. Box Out keeps them sealed, opens them only to read your league, and never shows them again, to you or to anyone. Joining a league that is already on Box Out, your espn_s2 is checked once, to show you are in it, and not kept; your SWID, the half that names your ESPN account, is kept encrypted to match you to your team.

How do I take my cookies back?

Press Disconnect on League settings: the sealed cookies are wiped at once, and the league's pages stop updating. Once your league is viewable to the public, Forget my cookies wipes them instead and keeps the league, read as ESPN shows it to anyone. Your SWID is also kept on its own, encrypted, to match you to your team; Forget, beside Your ESPN account on your Account page, removes it, and so does deleting your account.

Signing out of ESPN in the browser you copied them from may end them at ESPN's end, but we haven't checked whether ESPN then refuses a copy taken earlier, so wiping them here is the step that is sure.

How do I make my league public, and what does that show?

Ask your league manager: it is a league manager's setting on ESPN, which ESPN's help calls "Making a Private League Viewable to the Public". Anyone with the league's link can then see its league office, standings, box scores and team pages; nobody can join the league by it, and the manager can switch it back. Then connect again with its link, and nothing of yours is kept.

Why are some of my past seasons missing moves?

As far as we can tell, a private league shows each past season's detail, its daily lineups and its moves, only to ESPN logins that were in the league that season; anyone else gets a summary: settings, teams and matchup results. ESPN does not document this. We inferred it from three leagues: a member who joined a private league this season was refused its earlier seasons, the same member's other private league, where they have had a team every season, read whole, and a public league read every season with no login at all.

Box Out leaves a season it got as a summary out of every number it measures, and names those seasons in the email when a league is read, on League settings, and on the pages where a past season is chosen. Two ways that may read them whole:

• A member who was in those seasons reads the league with their own login: "Read this league with my login" on League settings. Their cookies are checked with ESPN and kept, in place of the league's current login, only if they read more of its past seasons; then its history is read again. Otherwise nothing changes and their espn_s2 is not kept. The league's owner stays its owner.
• The league is made public by its manager on ESPN; then whoever connected it presses "Forget my cookies and read every season", and nothing of theirs is kept.

For a private league not yet on Box Out: the member who has been in it longest should be the one to connect it.

Who can see my league on Box Out?

Only its members. A public league lets in anyone who connects it by its link, as ESPN shows it to anyone, unless its owner has removed them; a private one takes an invite, the member's own ESPN cookies, or its owner's yes, and its ID alone gets nobody in. Numbers measured on your league can join the averages for leagues with the same settings, as numbers only, never names, rosters or moves (the next question); and the person who runs the site can read the database, as on any site.

Does my league's data help other leagues?

Only as averages: the figures measured on your league's history (what a pickup is worth, what an opened place is worth, the three bars for a move, the trade number's record, and how a week's categories move together) are averaged with leagues of the same settings, never your teams, moves or names. An average is only used when at least three other leagues are in it, and you are told only how many leagues are in it. Any owner of your league can turn this off on League settings, "Let this league's averages help similar leagues", and the league still reads the averages of other leagues.

Who sees what I make here?

Your draft plan is your team's alone, and a projection file you upload is yours alone, with any plan built on it. Board posts are read by your league's members, and messages by the people you send them to. A tool you connect (the co-manager in Claude, for one) reads what you can read, writes nothing, and stops when you end its token on Tools.

Your achievements are yours to read. The other members of a league see the one you choose to show beside your name there, and how many you have unlocked; never the list, and never the days you were signed in. A league honour (a title, a run of wins) is your team's result, which the league sees on its own pages already; one earned in the season in play is also a line on the league's Board ("Dee earned an honour: Team of the week"). Nobody sees when you last read the Board.

Someone else connected my league. What now?

Ask its owner for the league link, or ask to join it: connecting it again says the league is already on Box Out, with an Ask to join button right there, and its owner lets you in. Nothing is connected twice, public league or private. If whoever connected it can't prove a team in it, a member who can (their team verified by ESPN, or taken by a link made for it) can take the owner role on Members. An owner can also offer the ownership to another member there; accepted, they own the league beside the owner, and for a private league their own ESPN login then reads it.

Someone else claimed my team

Claim it anyway: your claim waits for the league's owner, who sees on Members who claims each team and decides. The owner can also reject a claim already made, or remove a member, whose claims go with them. Members shows how each manager holds their team, and "claimed" means nothing proved it.

How do I delete my account, and what goes with it?

Press Delete beside Delete my account, under Your data on your Account page, read what goes and what stays, and type your email address to confirm. It happens at once and can't be undone: you are signed out, and signing in again with the same address starts a new, empty account. If you cannot sign in, write to patrick@boxoutfantasy.com from the address you signed in with, and the account is removed the same way.

What deleting your account takes, and what it leaves

Goes: your sign-in, sessions, sign-in links and tool tokens (a tool's access ends at once); your name, your SWID, your alert addresses and mail settings, and mail still waiting for you; your team claims and league memberships; the draft plans, marks and builds of the teams only you manage (a co-manager keeps a plan you share); your uploaded projection files and mixes; your board posts and replies, and the men you put on a trade block; your direct messages, both sides of each thread; your Yahoo connection; the achievements you unlocked, the one you showed beside your name, the days you were signed in, and when you last read each league's Board; a pass that was not bought (a code's pass, for one); and any request for a code.

A league connection you made is revoked and its sealed ESPN values are wiped. That league's pages stop updating; its other members lose nothing they could see, and any of them can connect it again. Invite links you made stop working.

Stays, and why:

• Each league's ESPN history: its seasons, teams, rosters, matchups and moves. It is the league's, read from ESPN, and its other members read it.
• A post someone replied to stays as a deleted post, with no words and no name ("A former member"), so their reply keeps its place.
• A trade proposal your team sent or answered stays in the other team's record, without your name and without your note.
• A record that a season pass was bought, without your address or your account, because the books require it. Nothing is sold yet.
• A code you redeemed stays counted as used; the site's owner made it.

Is there anything you never ask for?

Your ESPN password is never asked for. Nothing here signs in to ESPN for you, and while the site is in preview nothing is charged and no card or payment detail is asked for or kept.

What leaves the site?

• Mail goes out through a mail provider, to your sign-in address and any other address confirmed on Alerts: the kinds your switches there allow, and, with no switch, the sign-in email, the one mail saying a league you connected is ready, and a note if its connection stops refreshing.
• The backup's encrypted copy, stored off the server. The sealed ESPN values stay sealed in it, and the key is not in it.
• The week's facts, to DeepSeek, a language model, when your league's weekly recap is written for the Newsroom: the league's name, its team names, player names, and the week's figures (scores, category totals, standings, moves and bids). Never an email address and never a person's name. The recap it writes is checked by code against those facts, and nobody in the league reads it until the league's owner has approved it.
• Fonts are loaded from Google Fonts, so Google sees that your browser asked for them.

That is the whole list. There is no advertising, no analytics and no tracking script on any page, and the pages set no cookie but the ones that sign you in. The records of your visits are the day you were signed in, kept on the server as said above (the day, and never the page), and, per league, the one time you last read its Board, which is what lets it say what is new. Your browser remembers a few choices of yours on the device itself, such as light or dark and the league and season you last looked at.

Written from what the software does, on September 28, 2026, and brought up to date on September 29 and 30 and October 1 and 14, 2026. Where a sentence says what the software does not do, that is a fact about the code as it stands, not a promise about the future; a change to any of it changes this page.