Slate Stats › Privacy
Privacy
Short, because the site collects very little. The parts that matter are what we never hold at all.
What we never collect
No passwords. Sign-in goes through an identity provider, so a credential never reaches this site.
No payment details. There is nothing to pay for.
No advertising or cross-site trackers. There is no ad network and no advertising pixel on any page. One measurement script does run: Cloudflare Web Analytics, which counts page views. It sets no cookie, stores nothing in your browser, and cannot connect a visit here to a visit anywhere else. We use it to see which pages people read. If you would rather it did not load, a content blocker will stop it and the site works normally without it.
No behavioral tracking. We do not record scrolling, mouse movement, which links you follow, how long you stayed, or your path through the site. The only actions counted are the few named under What we do collect — connecting a league, a lineup being worked out, sorting a table — as anonymous tallies. Where we want to know whether something worked, we ask.
What we do collect
An email address, if you sign in, supplied by your identity provider along with your first name. It identifies your account and nothing else.
Which of our posts brought you here, if a link says so. Links we post on X end in ?ref=x. When you arrive through one, your browser tells us once that a visit came from X and which page it opened — no identifier, nothing stored in your browser, nothing that connects it to you or to any other visit — and the tag is removed from the address. With Global Privacy Control or Do Not Track on, nothing is sent. We use the count to learn whether posting is worth doing.
A tally of a few tool actions. When you look up a Sleeper username on My Team, when a lineup is worked out for your team, and when you sort a table, your browser sends one count to /api/event: which action, how it ended (for example “username not found”), the page, and whether you were signed in (yes or no, not who). It never includes your username, your league or your team, carries no identifier, stores nothing in your browser, and is sent at most once per action per page view. With Global Privacy Control or Do Not Track on, nothing is sent. We use the counts to learn which tools are used and where they fail. Calls to our public data endpoint (/mcp), which AI assistants can use, are counted the same way: by tool name only, plus the name of the app that connected (for example “claude-ai”) and the name of any tool it asked for that we do not offer — nothing about who called it or what they asked.
The questions you ask the assistant, and its answers. For a signed-in account these are kept as your history. Anonymous questions are kept without any identifier attached, to see what people want and where the model falls short.
Your IP address, briefly and in memory only, to count free questions. It is not written to a database and does not survive a restart. Server logs record only whether a request arrived through our network edge, not the address itself.
Which page on this site you asked from — the path only, such as /nfl/studies/do-touchdowns-repeat/. It tells us whether people who read a study then ask us something, which is how we decide what to write next. We keep no query string and no fragment, so anything after a ? or a # is discarded before it is written. If you arrived from another site, that is dropped entirely: where you were before you got here is not ours to record.
The country a question came from, as the two-letter code our network edge reports. It tells us which countries the site is used in. It is not an address, it cannot identify you, and it is never combined with anything that could.
Whether you marked an answer useful, if you click Yes or No under one. We store the rating and which answer it refers to, and nothing else — no identifier, no address, not even the question, which is already kept under that answer. It is the only way to tell a correct answer nobody wanted from one that actually helped, and it is used to fix the tool rather than to profile anybody. Not clicking is the normal thing to do and costs you nothing.
Which questions in a visit followed which, so a run of questions reads as a conversation rather than as unrelated ones. The page makes up a random label when it loads, keeps it in memory and forgets it when you leave or refresh. It is not a cookie, it is never stored in your browser, and it cannot connect one visit to another or to you. What it tells us is whether an answer led somewhere or ended the conversation.
Whether you typed a question or clicked one we suggested. A suggestion nobody takes is one worth replacing, and the words alone cannot tell the two apart.
Whether your browser has been here on an earlier day, as a plain yes or no, sent only with a question you choose to ask. Your browser works it out from the date of your first visit, which it keeps itself (see below); the date never leaves your device, and no identifier goes with the yes or no, so it cannot connect two questions to each other or to you. It tells us whether people come back. If your browser sends Global Privacy Control or Do Not Track, nothing is kept and nothing is sent.
What your browser keeps
Your own browser keeps a few small values for this site. None is a cookie and none can identify you. Clearing your site data removes all of them and the site works normally without them.
slate-theme — whether you chose light, dark, or to follow your device. Never sent to us.
slate-rail — whether you collapsed the navigation column. It is shared between tabs on this site, which is why collapsing it in one updates the others. Never sent to us.
slate.league — the fantasy league you connected on My Team, so your lineup is on screen when you come back. It stays in your browser; your league platform answers your browser directly and nothing about it reaches our server.
slate-charts-layout — how you arranged the charts on Your charts. If you are signed in, the same arrangement is also saved to your account so it follows you to another device.
ss_first_visit — the date of your first visit to this site. We never see the date. When you ask a question, your browser sends only whether that date is earlier than today (see “What we do collect”). It is not kept at all if your browser sends Global Privacy Control or Do Not Track.
That is the whole list, and the compliance check that runs before every release fails if the site's code stores anything not named here. There is no cookie we set ourselves.
Who else sees it
Google, if you sign in with it, under their own privacy policy.
Anthropic, which turns the measurements into a sentence. Your question and the retrieved figures are sent; your email and account are not.
Cloudflare, which serves the pages and sees request metadata.
We do not sell personal information, and we do not share it for advertising.
How long it is kept
Account records last until you ask us to delete them. A sign-in session expires after 60 days. Session tokens are stored only as a one-way hash, so a copy of our database does not let anyone sign in as you.
Your choices
Write to hello@slatestats.com to see what we hold, correct it, or have it deleted. Deleting an account removes the address and the saved history.
Depending on where you live you may have further rights, including under the California Consumer Privacy Act or the GDPR. We will honor an access or deletion request regardless of where you are.
Children
The site is not directed at children and we do not knowingly collect information from anyone under 13. Betting content is intended for adults of legal age.