Privacy policy
Last updated 5 October 2026
The short version
- 9cat collects only what it needs to run: your email address, what you choose to save to your account, and whether you have paid.
- No ads. Google Analytics counts visits and which pages are read, with its advertising features turned off. Your data is never sold or shared for advertising.
- Card details go to Stripe and never reach 9cat. ESPN passwords are never asked for.
- You can use 9cat without an account; your draft then stays in your own browser.
- Ask for your data to be deleted at any time with Send feedback in the account menu, or by emailing support@9cat.app.
Who we are
9cat (9cat.app) is an independent nine-category and points fantasy basketball draft and matchup companion, based in Australia. In this policy “9cat”, “we” and “us” mean the people who run it. Questions or requests: use Send feedback in the account menu.
What we collect, and why
| What | Why |
|---|---|
| Your account: email address and how you signed in (an emailed link or code, or Google). With Google, also the name and profile picture on your Google account. | To create your account, sign you in and show who is signed in. |
| Your access: Founder number, Pre-Season Access, Regular Season Access or free-trial dates. | To unlock the features you have. |
| What you save to your account: drafts, picks, notes, targets and avoids, keeper plans, the ESPN league and team you connect, saved matchup weeks and waiver suggestions. | So your work is kept and syncs across your devices. Only your account can read these rows. |
| Purchases: your Stripe customer ID, checkout and payment status, the amount and currency, and whether the 9CAT50 code was used. | To give you what you paid for and to handle refunds and disputes. Stripe processes the payment itself. |
| Injury alerts, if you turn them on: which channels you chose, quiet hours and your time zone, the ESPN league and team you connected, the ESPN IDs of the players on your shortlist, the push address your phone or browser gives us, and a record of alerts sent (kept 30 days). | To know whose players to watch and when and where to alert you. Turning alerts off, or removing a device, stops them. Every alert email has a one-click link to stop alert emails. |
| Feedback you send: your message, the page you were on, your access level, your screen width and browser type. | To read and answer it, and to reproduce problems. Your draft is not included. |
| Site visits: through Google Analytics, the pages and app tabs you view, the site that sent you (for example x.com or a search engine), your approximate location (city or country), device and browser type. Google Analytics sets its own cookies to tell repeat visits apart. | To see how people find 9cat and which parts they use. Google signals and ad personalisation are off, and we don’t send Google your email or account. Block it with any ad or tracker blocker and 9cat works the same. |
| In your browser (not sent to us): your practice draft, settings and the last known access for your account, in this browser’s local storage. | So 9cat works without an account and offline. Clearing this site’s data removes them. |
When you connect an ESPN league, view player history or open your matchups, 9cat requests public league and player data from ESPN on your behalf. Only public leagues can be read, and no ESPN login is used.
Sign in with Google
If you choose Continue with Google, Google shares your name, email address and profile picture with 9cat. We use them only to create and sign in to your 9cat account. We don’t request access to anything else in your Google account, and we don’t use Google user data for advertising or share it with anyone else. 9cat’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who processes data for us
- Supabase: accounts, sign-in and the database (hosted in Sydney, Australia).
- Netlify: hosts the website and runs its server functions.
- Stripe: payments, receipts, refunds and disputes.
- Resend: sends sign-in emails and injury alert emails.
- Apple, Google and Mozilla push services: deliver phone and browser injury alerts, if you turn them on. Alerts are encrypted so only your device can read them.
- Google: sign-in with Google, if you use it, the web fonts on the main site, and Google Analytics (visit counts; data kept 14 months).
- jsDelivr: serves the sign-in library the site loads.
- ESPN: the public league and player data you ask for.
Some of these services store or process data outside Australia. Each receives only what it needs for its job.
How long we keep it
Your account data is kept while your account exists. When an account is deleted, its saved drafts, notes, plans, matchup data and access are deleted with it. Payment records can be kept as long as the law requires for tax and accounting.
Your choices
- Use 9cat without an account: browsing and practice drafts work in your browser.
- Ask to see, correct or delete your data, or to close your account, with Send feedback or by emailing support@9cat.app.
- 9cat sends no marketing emails: only the sign-in emails you ask for, and Stripe’s receipts when you pay.
Security
Everything travels over HTTPS. In the database, row-level security lets each account read only its own rows, and paid features are checked on the server. Card details never reach 9cat.
Children
9cat is not directed at children under 13, and we don’t knowingly collect their information.
Changes
If this policy changes, this page and the date at the top are updated.