04 · Trust Page 4 of 5
Plain answers before private setup.
DimeDropper is a beta fantasy assistant. It should earn trust by saying exactly what it needs, what it stores, and what still depends on correct production configuration.
We never see your ESPN password
The connector reads cookies already in your browser. There is no field that would accept a password.
Not ESPN OAuth
ESPN offers none for fantasy, so cookies are the only route in, and we say so before you start.
Encrypted server-side
When the encryption key is configured, which DimeDropper checks at startup. Used only to sync your league.
The extension stores no cookies
Just league IDs, sync progress and your auto-sync preference.
This is not official ESPN OAuth.
DimeDropper is not official ESPN OAuth, is not an ESPN login screen, and does not claim an ESPN partnership. ESPN does not provide OAuth for this app today, so DimeDropper uses ESPN fantasy cookies only after you choose to connect a league.
- Why SWID is needed SWID is ESPN's account/browser identifier. DimeDropper uses it to match the ESPN account to the team owner inside your fantasy league.
- Why espn_s2 is needed espn_s2 is ESPN's private login-session cookie. DimeDropper uses it to ask ESPN for your private fantasy league data after you explicitly connect.
- Why reconnect may be required Cookies may expire after logout, password changes, browser changes, ESPN security checks, or normal ESPN session rotation. If that happens, reconnect may be required.
- What DimeDropper never asks for DimeDropper never stores ESPN passwords and should never ask you for your ESPN password.
Credential storage depends on production env.
ESPN credentials are encrypted when ESPN_CREDENTIALS_KEY is configured.
If that key is missing, new ESPN credential rows are not encrypted and the deployment should not be treated as paid-production ready.
Existing plaintext ESPN credential rows must be replaced by reconnecting leagues after the key is configured. Strict production health should stay red until this is fixed.
The connector is a setup helper, not OAuth.
The Chrome and Firefox connectors read ESPN fantasy cookies only to connect your league to your configured DimeDropper backend over HTTPS.
Local testing may use localhost or 127.0.0.1.
Read the connector's full privacy policy.
- Stored by the extensionBrowser extensions store only connected league IDs with team name and last sync time, the active league, sync progress, and the auto-sync preference.
- Never stored by the extensionSWID and espn_s2 are never stored in extension storage.
- Not loggedThe connector should not print SWID or espn_s2 to the console.
DimeDropper does not store card numbers.
DimeDropper never stores card numbers or raw payment data. Stripe handles payment details when billing is configured. DimeDropper stores only billing provider references such as customer id, subscription id, access status, and a note on the entitlement record.
Starting checkout never unlocks recommendations by itself. Premium access changes only after a verified Stripe webhook or an authenticated manual admin entitlement update.
Normal users should use login.
API keys are for advanced/API use, scripts, debugging, and integrations. They are secret because anyone with a valid key can act as that account. Normal customer setup should use website login and the browser connector.
DimeDropper stores API keys as hashes and cannot show the old raw key again. If a key is rotated, the previous key stops working.
Do not trust a deployment just because the page loads.
DimeDropper should not look production-live unless Postgres, migrations, ESPN_CREDENTIALS_KEY, live workers,
player stats, injuries, news, opportunity evidence, alert evaluation, billing state, and entitlement state are healthy.
If a page says locked, stale, degraded, missing player stats, billing not configured, or reconnect required, treat that as part of the recommendation. Do not act on a confident-looking answer that conflicts with those warnings.
Privacy and data questions.
Email support@dimedropper.app for privacy questions, data export, or account deletion requests.