1. Introduction

FPL Copilot ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services at fplcopilot.com.

2. Information We Collect

Account information

Email address (provided at sign-up or via Google OAuth)
Name (provided at sign-up or from your Google profile)
Profile picture (from Google OAuth, if applicable)
FPL Team ID (optionally provided by you)
Avatar / display preferences you set on your profile

Usage data

Solver runs, chip strategy runs, and the settings you used (to provide optimisation results and so you can review your past runs)
Expected-minutes overrides you make on the Expected Points page
Copilot Chat conversations (to improve the AI assistant and debug failures)
Mini-league interactions (which leagues you view + Copilot Rank requests)
Pages visited and features used (basic analytics)
Cancellation reasons and optional free-text feedback, if you fill in the exit survey

FPL account credentials (Autopilot only)

If you enable Autopilot, you provide your Fantasy Premier League login email and password so we can stage and execute transfers / chip plays on your behalf. These credentials are encrypted at rest using strong, industry-standard encryption with a server-side key, and are only used by our backend to log into FPL on your behalf. They are never shown back to you in plain text, never sent to third parties, and are deleted when you disable Autopilot or delete your account. Autopilot is strictly opt-in; the rest of the app works without it.

Payment information

Payments are processed by Stripe. We never see or store your full card number. Stripe collects billing details in accordance with their own privacy policy. We store your Stripe customer ID, subscription status (trialing / active / paused / cancelled), plan, currency, and renewal / trial-end dates so we can show your billing status in the app and trigger reminder emails.

Email communications

We send transactional emails (welcome, password reset, trial-ending reminder ~24 h before the trial ends, subscription receipts, GW pre-deadline alerts when you opt in, and GW debrief summaries when you opt in) via Resend. We do not send marketing email and we do not share your address with anyone else. You can opt out of any non-essential email from your profile page; transactional emails (e.g. trial reminders, password resets) bypass that opt-out so legally-required notices still reach you.

3. How We Use Your Information

To provide and improve our services (solver, expected points, chip strategies, mini-leagues, Copilot Chat, Autopilot)
To authenticate you and manage your account, subscription, and billing
To process subscription payments via Stripe
To send transactional emails (welcome, password reset, trial-ending reminder, billing receipts, optional GW alerts)
To respond to support requests sent to our address
To detect, prevent, and respond to abuse (rate-limit evasion, scraping, paywall bypass)

Legal bases

Where data-protection law (such as the UK GDPR / EU GDPR) applies, we process your personal data on these bases: to perform our contract with you (running the app, your account, and billing); our legitimate interests (keeping the service secure, preventing abuse, and improving features through anonymous, aggregated analytics); your consent (for optional emails and where otherwise required); and to meet our legal obligations. Where we rely on consent, you can withdraw it at any time.

We do not sell your personal data to third parties.

4. Cookies & Local Storage

We use the following cookies, all of which are strictly necessary for sign-in and security:

fplcopilot_session: httpOnly session cookie for authentication
fplcopilot_csrf: CSRF protection token
fplcopilot_authed: lightweight presence hint (no secret) that lets the frontend skip the anonymous shell before the auth check resolves
fpl_oauth_state: short-lived (10 min) CSRF nonce for the Google OAuth round trip

These cookies are not used for advertising or cross-site tracking, and no data is shared with ad networks. We also store a small amount of functional data in your browser's local storage (for example, your Team ID and display preferences) so the app loads your settings without re-fetching them.

For product analytics we use first-party, privacy-friendly measurement that records anonymous, aggregated usage (page views, feature usage, funnel steps) to help us improve the app. It does not build an advertising profile or track you across other sites.

5. Service Providers

We use a small number of trusted third-party providers to operate the service. Each processes only the data needed for its function, under its own privacy policy and our data-processing terms:

Fantasy Premier League (FPL): we read your public FPL team / standings / fixtures data, and — only if you enable Autopilot — use your FPL login to stage and execute transfers on your behalf
Sign-in provider (Google): to authenticate you when you choose social sign-in
Payment processor (Stripe): to handle subscription payments and billing. We never see or store your full card details
AI provider: powers the Copilot Chat assistant. Your message and the squad context needed to answer it are sent for the duration of the request only, and are not used to train any AI model
Email provider: delivers transactional and reminder emails
Product analytics provider: anonymous, aggregated usage measurement — no advertising profile, no cross-site tracking
Hosting, database & content-delivery providers: run our website, backend, database and cache on our behalf

A current list of the specific sub-processors we use is available on request — just email us at the address in the Contact section below.

6. International Data Transfers

Some of our providers process data on servers outside your country, which may include outside the UK and the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards offered by those providers — such as Standard Contractual Clauses or an equivalent approved transfer mechanism — so that your data stays protected to the same standard.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days. Anonymised, aggregated usage data may be retained for analytics purposes.

8. Your Rights

Depending on where you live, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and data
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent at any time, where we rely on it
Lodge a complaint with your local data-protection authority (in the UK, the Information Commissioner's Office)

You can delete your account and data directly from your profile page, or exercise any of these rights by contacting us at the address below.

9. Security

We use industry-standard security measures including httpOnly session cookies, CSRF protection, salted password hashing, encryption of sensitive data at rest, rate limiting on authentication endpoints, and encrypted connections (HTTPS) to protect your data. No method of transmission or storage is completely secure, but we work to protect your data using appropriate safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact

If you have questions about this Privacy Policy or your data, contact us at fplcopilot.service@gmail.com.