1. Introduction

FPL Copilot ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services at fplcopilot.com.

2. Information We Collect

Account information

Email address (provided at sign-up or via Google OAuth)
Name (provided at sign-up or from your Google profile)
Profile picture (from Google OAuth, if applicable)
FPL Team ID (optionally provided by you)
Avatar / display preferences you set on your profile

Usage data

Solver runs, chip strategy runs, and the settings you used (to provide optimisation results and so you can review your past runs)
Expected-minutes overrides you make on the Expected Points page
Copilot Chat conversations (to improve the AI assistant and debug failures)
Mini-league interactions (which leagues you view + Copilot Rank requests)
Pages visited and features used (basic analytics)
Cancellation reasons and optional free-text feedback, if you fill in the exit survey

FPL login (one-time lookups)

Some screens offer "Log in with FPL" as a shortcut: to find your Team ID, or to read your drafted squad before the season starts. In those cases your Fantasy Premier League email and password are used once, for that single request, and are never stored: no database write, no cache, nothing kept after the response. If your FPL account uses two-factor authentication the lookup cannot work and you enter your Team ID by hand instead.

Connected FPL account (Autopilot and squad sync)

If you connect your FPL account, to keep your squad in sync or to enable Autopilot, you provide your Fantasy Premier League login email and password so we can sign in on your behalf, read your team, and, with Autopilot, stage and execute transfers or chip plays you have approved. These credentials are encrypted at rest using strong, industry-standard encryption with a server-side key, are only used by our backend to log into FPL for you, are never shown back to you in plain text, never sent to third parties, and are deleted when you delete your account. Connecting is strictly opt-in; the rest of the app works without it.

Payment information

Payments are processed by Stripe. We never see or store your full card number. Stripe collects billing details in accordance with their own privacy policy. We store your Stripe customer ID, subscription status (trialing / active / paused / cancelled), plan, currency, and renewal / trial-end dates so we can show your billing status in the app and trigger reminder emails.

Email communications

We send transactional emails (welcome, password reset, trial-ending reminder ~24 h before the trial ends, subscription receipts, GW pre-deadline alerts when you opt in, and GW debrief summaries when you opt in) via Resend. We do not send marketing email and we do not share your address with anyone else. You can opt out of any non-essential email from your profile page; transactional emails (e.g. trial reminders, password resets) bypass that opt-out so legally-required notices still reach you.

3. AI Assistant Integrations (Claude, ChatGPT, Muse)

You can use FPL Copilot inside AI assistants such as Claude, ChatGPT and Muse. When you do, the assistant sends our tools only the inputs they need, for example an FPL team ID, a mini-league ID, player names or a search query.

We do not receive your conversation. It stays with the assistant and is covered by its provider's own privacy policy
We keep technical logs (which tool ran, how long it took, and whether it worked) for up to 90 days to keep the service reliable
ChatGPT may send an anonymous user identifier. We use it for rate limiting and, if you give us your team ID, to remember it for next time. It is kept for up to 180 days
Nothing we receive through an AI assistant is used to train AI models

4. How We Use Your Information

To provide and improve our services (solver, expected points, chip strategies, mini-leagues, Copilot Chat, Autopilot)
To authenticate you and manage your account, subscription, and billing
To process subscription payments via Stripe
To send transactional emails (welcome, password reset, trial-ending reminder, billing receipts, optional GW alerts)
To respond to support requests sent to our address
To detect, prevent, and respond to abuse (rate-limit evasion, scraping, paywall bypass)

Legal bases

Where data-protection law (such as the UK GDPR / EU GDPR) applies, we process your personal data on these bases: to perform our contract with you (running the app, your account, and billing); our legitimate interests (keeping the service secure, preventing abuse, and improving features through anonymous, aggregated analytics); your consent (for optional emails and where otherwise required); and to meet our legal obligations. Where we rely on consent, you can withdraw it at any time.

We do not sell your personal data to third parties.

5. Cookies & Local Storage

We use the following cookies, all of which are strictly necessary for sign-in and security:

fplcopilot_session: httpOnly session cookie for authentication
fplcopilot_csrf: CSRF protection token
fplcopilot_authed: lightweight presence hint (no secret) that lets the frontend skip the anonymous shell before the auth check resolves
fpl_oauth_state: short-lived (10 min) CSRF nonce for the Google OAuth round trip
fplcopilot_team: your saved FPL Team ID, so the app can show your squad before the account check completes

These cookies are not used for advertising or cross-site tracking, and no data is shared with ad networks. We also store a small amount of functional data in your browser's local storage (for example, your Team ID, display preferences, minute overrides you make on the Expected Points page, and which leagues you follow) so the app loads your settings without re-fetching them. The browser also holds a random anonymous identifier that lets us keep your minute overrides consistent between visits before you sign in and count aggregate feature usage; it contains no personal data and is not linked to your identity unless you create an account.

For product analytics we use first-party, privacy-friendly measurement that records anonymous, aggregated usage (page views, feature usage, funnel steps) to help us improve the app. It does not build an advertising profile or track you across other sites.

6. Service Providers

We use a small number of trusted third-party providers to operate the service. Each processes only the data needed for its function, under its own privacy policy and our data-processing terms:

Fantasy Premier League (FPL): we read your public FPL team, standings and fixtures data, and, only if you connect your FPL account, use your FPL login to read your squad and, with Autopilot, act on your team on your behalf
Data partners: a small number of partner sites display FPL Copilot projections (expected points, expected minutes, predicted lineups) through our partner API. That feed contains player projections only; it never includes any personal data about you
Sign-in provider (Google): to authenticate you when you choose social sign-in
Payment processor (Stripe): to handle subscription payments and billing. We never see or store your full card details
AI provider: powers the Copilot Chat assistant. Your message and the squad context needed to answer it are sent for the duration of the request only, and are not used to train any AI model
Email provider: delivers transactional and reminder emails
Product analytics provider: anonymous, aggregated usage measurement — no advertising profile, no cross-site tracking
Hosting, database & content-delivery providers: run our website, backend, database and cache on our behalf

A current list of the specific sub-processors we use is available on request — just email us at the address in the Contact section below.

7. International Data Transfers

Some of our providers process data on servers outside your country, which may include outside the UK and the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards offered by those providers — such as Standard Contractual Clauses or an equivalent approved transfer mechanism — so that your data stays protected to the same standard.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data, solver runs, chat conversations, minute overrides, events, feedback, email preferences, Autopilot settings and any connected FPL credentials are removed together within 30 days. Anonymised, aggregated usage data may be retained for analytics purposes. Data from AI assistant integrations is kept for the periods in section 3.

9. Your Rights

Depending on where you live, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and data
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent at any time, where we rely on it
Lodge a complaint with your local data-protection authority (in the UK, the Information Commissioner's Office)

You can delete your account and data directly from your profile page, or exercise any of these rights by contacting us at the address below.

10. Security

We use industry-standard security measures including httpOnly session cookies, CSRF protection, salted password hashing, encryption of sensitive data at rest, rate limiting on authentication endpoints, and encrypted connections (HTTPS) to protect your data. No method of transmission or storage is completely secure, but we work to protect your data using appropriate safeguards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact

If you have questions about this Privacy Policy or your data, contact us at fplcopilot.service@gmail.com.