Privacy Policy

1. Data we collect

When you create an account we collect your email address, display name, and password (stored as a secure hash). We also store your league activity, squad selections, transfer history, and credit transactions.

If you contact us through the contact form, we store your name, email address, and message so we can reply.

2. How we use your data

Your data is used to operate the Service: to authenticate your account, manage your leagues and squads, process credit purchases, and send transactional email (verification, password reset, low-credit warnings). We do not use your data for advertising, and we do not sell it to third parties.

3. Cookies and analytics

Nothing is loaded or stored for analytics unless you accept it. On your first visit to these public pages you are asked whether we may use Google Analytics. Until you accept, no analytics script is requested, no third-party connection is made, and no analytics cookies are set. If you decline, that stays true permanently.

Your answer is recorded in your browser’s local storage rather than in a cookie, so a decline leaves nothing that travels with your requests. You can change your mind by clearing site data for this domain.

If you accept, Google Analytics sets its own cookies and receives usage data — which pages were visited, roughly where from, and what kind of device. We use it to understand which pages are useful. It is configured to anonymise IP addresses. We do not use it for advertising and we do not sell data to anyone.

Inside the application we use only essential cookies required for authentication — specifically an HTTP-only refresh token cookie used to maintain your login session. Your access token is stored in browser local storage. There are no advertising cookies anywhere.

4. Third-party services

• Stripe — processes credit purchases. Stripe handles all payment card data directly; we never see or store your card details.
• Sportmonks — supplies player statistics and fixture data. No personal data is shared with this provider.
• Resend — delivers transactional email. Your email address is shared for that purpose only.
• Sentry — error tracking. Anonymised error reports may be sent to help us fix bugs.
• Google Analytics — usage analytics on the public pages, only if you accept it. See the section above.

5. Data retention

Your data is retained for as long as your account is active. If you delete your account, all personal data is permanently removed. Anonymised, aggregated data (for example, total user counts) may be retained.

Contact-form messages are retained only as long as needed to handle the enquiry.

6. Your rights

Under UK data protection law and the GDPR you have the right to:

• Access your data — download a full export from your profile page.
• Rectify your data — edit your display name and profile from your profile page.
• Delete your data — permanently delete your account from your profile page.
• Port your data — the export is in JSON format for portability.

To exercise any right not covered by the profile page, contact us.

7. Data security

All data is transmitted over HTTPS. Passwords are hashed with bcrypt. Authentication tokens are short-lived and rotated. The Service is hosted on infrastructure within the EU.

8. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of the Service after changes constitutes acceptance.

9. Contact

For privacy-related questions, contact us.