Privacy Policy

What we collect, and why

We only collect what each feature actually needs:

• Account email — if you sign up, to identify your account and manage your subscription. Legal basis: performance of a contract.
• Newsletter email — if you sign up for gameweek tips separately, to send that newsletter. Legal basis: consent — you can unsubscribe at any time.
• Billing information — we never see or store your card details. Payments are handled entirely by Stripe; we only store the subscription status and Stripe's own reference IDs so we know what you're entitled to. Legal basis: performance of a contract.
• FPL manager ID — only if you link it yourself after joining the FPL Shattered League, so we know which account is yours if we ever need to check league membership. Legal basis: performance of a contract.
• Affiliate link clicks — when you click a `/go/` link to a partner site, we log the referring page and a one-way hash of your browser's user agent (not the raw value, and never your IP address) to understand which links are useful. Legal basis: legitimate interest.

We don't run any first-party analytics that track you across other sites — we use Vercel Analytics for basic, privacy-friendly page-view counts, which doesn't use cookies or collect personal data. We do show ads via Google AdSense — see "Advertising" below for what that means and how to control it.

Advertising

We show ads through Google AdSense to help fund the site. Depending on your consent choice, AdSense may set cookies or use similar technologies to serve and measure ads, including personalised ones. If you're in the UK, EEA, or Switzerland, you'll see a consent banner on your first visit asking whether you're OK with this — you can change your answer at any time via "Manage ad consent" in the footer. See Google's how Google uses information from sites that use their services for details on what Google itself does with this data.

Cookies

Beyond the advertising cookies described above (only set with consent, where required), we use a small number of strictly functional cookies: one to keep you signed in, and (for site administrators only) one to access the admin area. Your language preference is stored in your browser's local storage, not a cookie, and never leaves your device.

Who we share data with

We use a small number of infrastructure providers to run the site, each acting as a processor on our behalf:

• Supabase — database and account authentication.
• Vercel — website hosting.
• Stripe — payment processing. Stripe is PCI-DSS compliant; we never handle your card details directly.

We don't sell your data, and we don't share it with anyone for their own marketing purposes. Some of these providers process data outside the UK/EEA as part of their global infrastructure; where that happens, they do so under recognised safeguards such as Standard Contractual Clauses.

How long we keep it

We keep account and billing data for as long as your account is active, and for a reasonable period afterwards to meet accounting and legal obligations. Newsletter emails are kept until you unsubscribe. You can ask us to delete your data sooner — see your rights below.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Ask us to delete your data ("right to be forgotten")
• Restrict or object to how we process it
• Receive your data in a portable format
• Withdraw consent at any time (e.g. unsubscribe from the newsletter)

To exercise any of these, email support@fplshattered.com. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to sort things out directly first.

Children

FPL Shattered isn't directed at children, and we don't knowingly collect data from anyone under 16.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page. Continuing to use FPL Shattered after a change means you accept the updated policy.