Plain answers before private setup.
DimeDropper is a beta fantasy assistant. It should earn trust by saying exactly what it needs, what it stores, and what still depends on correct production configuration.
This is not official ESPN OAuth.
DimeDropper is not official ESPN OAuth, is not an ESPN login screen, and does not claim an ESPN partnership. ESPN does not provide OAuth for this app today, so DimeDropper uses ESPN fantasy cookies only after you choose to connect a league.
- Why SWID is needed SWID is ESPN's account/browser identifier. DimeDropper uses it to match the ESPN account to the team owner inside your fantasy league.
- Why espn_s2 is needed espn_s2 is ESPN's private login-session cookie. DimeDropper uses it to ask ESPN for your private fantasy league data after you explicitly connect.
- Why reconnect may be required Cookies may expire after logout, password changes, browser changes, ESPN security checks, or normal ESPN session rotation. If that happens, reconnect may be required.
- What DimeDropper never asks for DimeDropper never stores ESPN passwords and should never ask you for your ESPN password.
Credential storage depends on production env.
ESPN credentials are encrypted when ESPN_CREDENTIALS_KEY is configured.
If that key is missing, new ESPN credential rows are not encrypted and the deployment should not be treated as paid-production ready.
Existing plaintext ESPN credential rows must be replaced by reconnecting leagues after the key is configured. Strict production health should stay red until this is fixed.
The connector is a setup helper, not OAuth.
The Chrome and Firefox connectors read ESPN fantasy cookies only to connect your league to your configured DimeDropper backend over HTTPS.
Local testing may use localhost or 127.0.0.1.
- Stored by the extensionBrowser extensions store only backend URL and last league ID.
- Never stored by the extensionSWID and espn_s2 are never stored in extension storage.
- Not loggedThe connector should not print SWID or espn_s2 to the console.
DimeDropper does not store card numbers.
DimeDropper never stores card numbers or raw payment data. Stripe handles payment details when billing is configured. DimeDropper stores only billing provider references such as customer id, subscription id, access status, and a note on the entitlement record.
Starting checkout never unlocks recommendations by itself. Premium access changes only after a verified Stripe webhook or an authenticated manual admin entitlement update.
Normal users should use login.
API keys are for advanced/API use, scripts, debugging, and integrations. They are secret because anyone with a valid key can act as that account. Normal customer setup should use website login and the browser connector.
DimeDropper stores API keys as hashes and cannot show the old raw key again. If a key is rotated, the previous key stops working.
Do not trust a deployment just because the page loads.
DimeDropper should not look production-live unless Postgres, migrations, ESPN_CREDENTIALS_KEY, live workers,
player stats, injuries, news, opportunity evidence, alert evaluation, billing state, and entitlement state are healthy.
If a page says locked, stale, degraded, missing player stats, billing not configured, or reconnect required, treat that as part of the recommendation. Do not act on a confident-looking answer that conflicts with those warnings.
Privacy and data questions.
Support email not configured for this deployment, so there is no published address for privacy, data export,
or account deletion requests. Whoever operates this instance must set FREEDOM_SUPPORT_EMAIL.