OUR LEAGUE, OUR SPACE
Privacy note
Updated September 16, 2026. Don’t Be Last is an independent fantasy football companion developed by Tanner for a private league.
One Yahoo connection
Tanner authorizes the app on Yahoo and selects one football league to share. Only the administrator can connect, select, or disconnect that league. Members use a shared league password and do not need to connect their Yahoo accounts. Yahoo passwords are entered on Yahoo and are never received by this app.
Information used and shared
The app reads the connected account’s current-season football league list to let Tanner choose a league. Members see only the selected league’s name, season, and team count. Other Yahoo league metadata and account identifiers may pass through server memory, but are not displayed to members or intentionally saved. All Yahoo requests are read-only. Lineups, trades, and waivers stay on Yahoo.
Saved connection and retention
Yahoo access and refresh tokens are encrypted by the app before being saved in an Upstash Redis database. The server uses these tokens to renew access automatically when data is requested. The selected league’s basic information is saved with the connection and reused for up to five minutes between checks. This record remains until Tanner disconnects it or replaces the connection. Yahoo may revoke access and require Tanner to reconnect. The app does not keep historical league snapshots in this release.
Passwords and cookies
Separate admin and league passwords are held in server-side hosting settings. They are not included in browser cookies. Encrypted, HTTP-only cookies remember member access for up to 30 days, admin access for up to eight hours, and connection verification for up to ten minutes. On the live site these cookies are sent only over HTTPS. Changing the relevant site password invalidates existing access cookies after the new settings are deployed. Anyone who receives the league password can view the selected league, so share it only with league members.
Signing out and disconnecting
Sign out clears this browser’s access cookies without disconnecting the league. Tanner’s Disconnect league from Yahoo control deletes the saved connection and league selection for everyone. To revoke the underlying Yahoo permission as well, remove Don’t Be Last in Yahoo’s connected-app settings. A previously copied site-access cookie remains usable until it expires or its site password changes, but it contains no Yahoo tokens.
Service providers and security records
Yahoo provides authorization and league data. Vercel hosts the app and its server-side settings. Upstash stores the encrypted connection and temporary security counters. Password-attempt counters use a keyed hash of the connecting IP address and expire after 15 minutes; connection-attempt counters and one-time verification records expire after ten minutes. Hosting providers process technical request information such as IP addresses, URLs, times, and browser details; callback URLs contain short-lived authorization codes. Application logs use generic failure categories and do not intentionally include passwords, Yahoo tokens, authorization codes, or league records. Provider backups and technical logs follow each provider’s retention practices.
This app does not add advertising trackers or sell league data. Contact Tanner through the existing league communication channel with questions about access or deletion.
Don’t Be Last is not affiliated with, endorsed by, or sponsored by Yahoo. Yahoo Fantasy remains the authoritative source for league data and roster transactions.
