Privacy Policy

1. Who we are

The service is operated under the trading name FPL Pals. Contact: contact@fplpals.com (no postal address is published at this time).

FPL Pals is not affiliated with the Premier League or Fantasy Premier League.

2. Information we collect

• Account data — such as display name (nickname), email, password hash (for local accounts), Google account identifiers when you sign in with or link Google, and password-reset tokens (hashed, short-lived).
• FPL Entry ID and public FPL data — when you link a team. We fetch public Fantasy Premier League API data for that entry and related leagues. We never collect your FPL password.
• Messages and reactions — content you send in league chat, help chat, AI chat, and guest/demo chat, plus related metadata (for example timestamps and gameweek).
• Notifications and preferences — in-app notifications and settings you choose (for example reminder preferences).
• Billing records — product purchased, Stripe session/payment references, and fulfilment status. Card details are processed by Stripe, not stored as full card numbers on FPL Pals servers.
• Technical data — cookies and similar storage needed to run the service (see Cookies below), plus standard server logs such as IP address and request metadata.

3. How we use information

• Provide accounts, authentication, and session security
• Show FPL team, league, and community features
• Power chat, reactions, and real-time updates
• Generate AI replies using configured providers
• Send in-app notifications according to your preferences
• Process once-off Stripe payments for Pro or league activation
• Maintain, secure, and improve the service
• Respond to support requests you send us

4. AI providers

AI features use configurable providers, including Google Gemini and OpenAI. When you use AI chat or similar features, your messages and relevant FPL-derived context may be sent to the configured provider so it can generate a reply. Guest/demo experiences may use preconfigured replies instead of live AI calls.

5. Payments

Payments are once-off charges via Stripe Checkout. Stripe processes payment details under its own terms and privacy policy. For billing issues, contact contact@fplpals.com.

6. Sharing and processors

We do not sell personal data. We do not use third-party advertising analytics.

We use service providers that process data on our behalf or as independent controllers where required, including:

• Google (OAuth sign-in; Gemini when configured as the AI provider)
• OpenAI (when configured as the AI provider)
• Stripe (Checkout and payment processing)
• Hosting and database providers (application hosting and PostgreSQL)

Because these providers may operate in multiple countries, your information may be processed internationally subject to their safeguards and applicable law.

7. Cookies and similar technologies

FPL Pals currently uses essential cookies and local storage only — no marketing or advertising cookies. Our cookie banner asks you to acknowledge this. Essential cookies are required for the service to work.

• Authentication cookie — keeps you signed in (HTTP-only session cookie, typically lasting up to about 30 days with sliding renewal).
• OAuth correlation cookie — short-lived cookie used during Google sign-in to complete the secure login round-trip.
• fpl_demo_chat — essential cookie for Guest Hub / demo chat sessions (typically lasts a few hours).
• PWA / localStorage — the service worker and browser localStorage support installable app behaviour, update checks, and small UI preferences (for example stored UI choices and your cookie-consent acknowledgement under a key such as fpl_cookie_consent).

8. Retention

Account and billing-related records are kept while your account is active and as needed for the service, security, and legal obligations. League chat, help chat, and related AI chat messages are kept for the active FPL gameweek window; messages from earlier gameweeks may be permanently deleted.

Demo chat session cookies expire automatically. You can clear local browser storage and cookies through your browser settings.

9. Your choices and requests

Depending on where you live (including under EU/EEA rules), you may have rights to access, correct, delete, or restrict processing of your personal data, and to object or complain to a supervisory authority.

In-product self-serve account deletion is not built yet (it is planned). You can update your nickname and password in Settings, and request a password reset by email from the login page. To request account or personal data deletion, or for other privacy requests, email contact@fplpals.com.

You can manage in-app notification preferences in Settings when signed in.

10. Security

We use reasonable technical and organisational measures (such as HTTPS, HTTP-only auth cookies, and hashed local passwords). No service is perfectly secure; please use a strong unique password for local accounts.

11. Governing law

This policy is intended to align with our operations under the laws of Cyprus and applicable EU law.

12. Changes

We may update this Privacy Policy. The “Last updated” date will change when we do. Material changes may also be highlighted in the product when practical.