Privacy Policy

1. What we collect

Account details. Your email address. If you sign in with Google, we receive your email address from Google. Sign-in is by emailed login link by default; if you choose to set a password, we store only a salted hash of it, never the password itself.

Your squad. If you provide your FPL ID, we fetch your publicly visible FPL entry from the official game's public API. If you upload a squad screenshot, we process it to identify the players in it and store the resulting squad, not the image.

Purchases. A record of what you bought, when, and for which season. Payment itself is handled by Polar as merchant of record — your card details go to Polar, never to us.

Technical basics. Standard server logs (IP address, request time) kept briefly for security and debugging, and one essential session cookie that keeps you signed in. There are no advertising or analytics trackers on FPLXI.

2. How we use it

To run the service: rating your squad, generating recommendations, keeping your gameweek history, signing you in, and honouring your Season Pass. We also send service emails such as login links. We do not sell or rent your data, and we do not use it for advertising.

3. AI processing

Two features use an external AI provider (currently OpenAI): reading the squad screenshot you upload, and writing the plain-English explanations of your recommendations. Only what's needed is sent — the screenshot, or your squad and the model's numbers. We don't send your email address or payment history to AI providers, and we don't use your data to train models.

4. Who else touches your data

A small set of processors, each only for their job: Polar (payments and receipts), OpenAI (the AI processing above), our email delivery provider (login links and service emails) and our hosting provider (running the service). We fetch public football data from the official FPL API; nothing about you is sent there beyond the FPL ID you asked us to look up.

5. How long we keep it

Your account data is kept while your account exists. If you ask us to delete your account, we delete it, keeping only what we're legally required to retain — purchase records for tax and accounting. Server logs are rotated automatically.

6. Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and take your data elsewhere. To exercise any of these, contact us — see below. You can also complain to the Information Commissioner's Office (ico.org.uk) if you think we've handled your data badly.

7. Cookies

One strictly necessary session cookie, used to keep you signed in. No consent banner is needed because there is nothing to consent to — no tracking, no third-party cookies.

8. Changes to this policy

If this policy changes, the date at the top changes with it, and material changes will be flagged in the app.

9. Contact

For anything privacy-related, reply to any email FPLXI has sent you, and it will reach us.