Privacy policy

Your account

Loading a team is open to everyone; the squad review needs a free account. Creating one asks for your email address, a password, your country, the Premier League club you support and the club you follow in your home league, plus an optional tick to receive emails before deadlines. We use these answers to keep you signed in, to understand who uses Fantasy League and, only if you ticked the box, to send you deadline tips. They are stored in our database together with a session token; a cookie named fl_session holds that token for up to a year and is strictly necessary for signing in. You can change your answers, sign out, or delete the account and everything stored with it at any time on the Account page.

Accounts are kept in our database, hosted by Supabase in London (UK), which only Fantasy League's server can reach. Your session token is stored there only as a hash, so a copy of the database could not sign anyone in.

Your password is stored only as a salted scrypt hash, never as the password itself, so nobody at Fantasy League can read it. After five wrong passwords in a row, signing in to that email pauses for 15 minutes. We never ask for your FPL or UEFA password. When you load a team we request its public data from the official FPL API using the team ID you enter; the same information is visible to anyone who knows that ID. So that FPL isn’t asked for the same data again, we keep a team’s public round history and its picks for rounds whose deadline has passed in our database and delete them 14 days after they were saved; we also keep each player’s record of finished matches.

If you sign up from a UCL Fantasy page, we ask for the Champions League club you support instead of the Premier League one.

While you are signed in, the mini-leagues you open are saved with your account too: the league ID and name of the last eight, so your Recently viewed list is there again after you sign out and back in, on any device. Removing a league from the list removes it from your account; deleting the account removes them all.

What stays in your browser

Your theme choice, consent decision and compare selections are stored in your browser’s local storage. Your team ID, drafts, planned transfers and chip plans are kept there only while you are signed in to a free account; without one they last until you reload or close the page, and signing out removes them. None of it leaves your device unless you share it yourself. Clearing site data for this website removes it.

Advertising and cookies

The site is funded by display advertising served by Google AdSense. Advertising scripts and cookies load only after you accept the consent banner. If you reject, the ad slots stay empty placeholders and no advertising cookies are set. Google’s use of advertising cookies is described in its own privacy policy, and you can manage personalised advertising in your Google account settings.

Server logs

The site is hosted by Vercel, whose servers record standard request logs (IP address, user agent, requested page and time) for security and capacity planning. The logs are kept for a short period and are not combined with any other data.

Withdrawing consent

To withdraw advertising consent, clear this site’s data in your browser; the consent banner will appear again on your next visit.

Contact

Questions about this policy can be sent to the address on the Contact page.