Your data stays
yours.
We built Signals on infrastructure we trust with our own accounts. Here's an honest look at how we protect your data — no marketing fluff, no overclaiming.
No passwords. Ever.
Signals uses passwordless authentication — we send a one-time code to your email and issue a short-lived session token. There are no stored passwords on our servers and nothing to leak in a credential breach. Session tokens are managed by AWS Cognito, a battle-tested identity platform.
Encrypted end to end.
All communication between your browser and our servers travels over HTTPS/TLS. There is no unencrypted path into Signals. Data stored on our infrastructure uses AWS-managed encryption at rest.
Private APIs stay authenticated.
Every product and account API requires a valid AWS Cognito JWT, validated by API Gateway before its handler runs. Signals exposes one deliberately public, read-only rankings route containing only the same sanitized rows already embedded in our public HTML. Its isolated reader can only fetch complete public releases; it cannot write data or access user, league, billing, credential, or model-source tables.
We never see your card.
All billing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. Your full card number and CVV never touch our servers. We retain only what's needed to manage your subscription — card brand, last four digits, and billing status.
Read-only by default. Minimal credentials.
When you connect a platform, we request only the league and roster data needed to power your Signals account. We never post, chat, trade, or add or drop players on your behalf. The one exception is Auto Lineups, an optional paid feature that submits a lineup change only after you confirm that specific move in the app. Sleeper connects with just your username; no password exists in the flow. ESPN private leagues connect with browser session cookies (espn_s2 and SWID), never your ESPN password — you can paste them yourself, or let the Signals Draft Overlay extension read those two cookies for you (see 06 below). MFL private leagues sign in with your MFL credentials once, over an encrypted connection: your password is used a single time to establish an MFL session and is never stored — we retain only the session credential MFL issues. CBS leagues connect with the league-scoped API token CBS itself writes into your own league page, never your CBS password — you can paste it yourself, or let the extension read it for you (see 06 below); CBS access is read-only, with no Auto Lineups. Stored platform credentials can never be read back by a browser, including your own, and you can disconnect any integration from Settings at any time.
Named values only, on your click.
The Signals Draft Overlay extension installs with no access to your cookies at all — the permission is optional and is requested only when you click "Connect my ESPN leagues." ESPN publishes no OAuth, and its espn_s2 cookie is HttpOnly, so an extension is the only thing that can read it. When you ask it to, the extension reads exactly two cookies by exact name, espn_s2 and SWID, never a bulk read of the espn.com jar, and only inside a single-use two-minute window opened by your click. It hands them to the Signals app in your browser and keeps no copy: no extension storage, no cache, no logs. Its CBS path asks for even less: on "Connect my CBS league" it reads no cookie at all — it fetches your own CBS league page with the session already in your browser and takes only the league token and league name. Revoke either any time from the extension popup, your browser's extension settings, or by uninstalling. The extension ships with no analytics, no telemetry, and no remotely loaded code.
Serverless. Minimal surface area.
Signals runs on AWS — serverless Lambda functions, DynamoDB, and API Gateway. There are no persistent app servers sitting exposed on the internet. Each function runs in isolation and is granted only the permissions it needs to do its job.
Found something? Tell us.
We're a small team and we take security seriously. If you discover a vulnerability or something that doesn't look right, please reach out before disclosing it publicly. We'll respond promptly, keep you informed, and do our best to fix it fast.
Report a vulnerability →For full details on data collection, retention, and your privacy rights, see our Privacy Policy and Terms of Service. No security measure is 100% foolproof — but we'll always be transparent about incidents that affect your data, as required by applicable law.