Privacy Policy

1. Who We Are and How to Reach Us

FPL Assistant ("we," "our," or "us") operates the FPL Assistant website and application at fplassistant.ai (the "Service"). This Privacy Policy explains what personal information the Service collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

The Service is run by Joseph Depew, an individual operating as a sole trader rather than through a company, based in the United States. For the purposes of the UK GDPR and the EU GDPR, Joseph Depew is the "controller" of the personal information described in this policy. "We" and "us" throughout this policy mean Joseph Depew.

Because the Service is run by one person rather than a company, we do not publish a postal address. fplassistant.ai@gmail.com is the contact point for every purpose in this policy, it is monitored, and we will answer from it in writing.

The fastest way to reach us about privacy, or to exercise any of the rights in section 13 and section 14, is fplassistant.ai@gmail.com. You can also reach us in the FPL Assistant Discord, though we recommend email for anything involving your personal data so we have a written record.

We are not affiliated with, endorsed by, or sponsored by the Premier League, Fantasy Premier League, or any football club.

2. Summary

This summary is provided for convenience. The sections that follow control if there is any inconsistency.

• We collect user data. Creating an account and linking your FPL team means we store your email address, your FPL manager name as registered with the Premier League, your team name and region, your saved squads and plans, and your settings.
• We use AI, and your messages leave our systems. The assistant is powered by a third-party model provider. Your chat messages and a summary of your FPL team are sent to that provider to generate a response. Section 5 describes exactly what is sent.
• We keep a record of AI conversations. Your messages to the assistant and its replies are logged on our servers so we can debug problems and prevent abuse.
• We use third-party processors. Section 6 names every company that receives data from the Service and says what each one receives.
• We do not sell your personal information and we do not share it for cross-context behavioural advertising or targeted advertising.
• You can ask us to delete your data at any time by emailing fplassistant.ai@gmail.com.

3. Information We Collect

We collect the categories of personal information described below. Some of it you give us directly, some is generated as you use the Service, and some comes from third parties.

3.1 Information you provide to us

• Account credentials. Your email address and a password. Passwords are hashed and stored by our authentication provider; we never see or store your password in plain text. If you sign in with Google instead, we do not handle a password at all.
• Google profile data (optional). If you choose "Sign in with Google," Google provides us with your email address, your display name and the URL of your Google profile picture, and we store them on your profile.
• Your Fantasy Premier League link. When you link your FPL team we store your FPL entry (team) ID, and we retrieve and store from the public FPL API your FPL manager name (which is normally your real first and last name), team name, and region or country.
• Squads, plans and transfers. The teams you build in the Service, saved per gameweek, including selected players, captain and vice-captain, bench order, purchase prices and remaining budget.
• Price watches. The players whose price changes you choose to watch or mute.
• Assistant preferences. Your risk tolerance, clubs you want the assistant to avoid, a rival manager name if you enter one, verbosity setting, and a free-text notes field of up to 280 characters. Anything you type into these fields is stored and is sent to our AI provider as described in section 5, so please do not put sensitive information in them.
• AI conversations. Every message you send to the assistant, and every reply it generates. See section 5.
• Notification settings. If you enable push notifications, we store the push endpoint URL issued by your browser, the encryption keys your browser generates for that subscription, your browser's user agent string, your timezone, the notification types you have enabled, and the date you consented.
• Communications. Anything you send us by email or in our Discord.

3.2 Information collected automatically

• Log and technical data. Our hosting provider records your IP address, browser user agent, the URLs you request, timestamps, and referring URLs. Our server-side code also writes diagnostic logs when errors occur.
• Product analytics. We use Vercel Analytics and Vercel Speed Insights to understand which pages are used and how quickly they load. These collect page views, referrer, approximate country, device and browser type, and page performance metrics. They operate without cookies and we do not use them to build a profile of you or to track you across other websites.
• AI usage counters. For each assistant request we record your user ID, the timestamp, the model used, and token counts, so that we can enforce the daily usage limit and monitor cost.
• AI conversation logs. For each assistant request we also record the text of your message, the assistant's reply, the FPL context assembled for that request, the names of any internal tools the assistant used, latency, and any error. See section 5 and section 11.

3.3 Information we receive from third parties

• Fantasy Premier League. Once you link your team, we fetch publicly available data associated with your FPL entry ID: your manager and team name, overall and gameweek ranks, points, squad picks, transfer history, chips used, and the standings of the mini-leagues you belong to.
• Google. If you sign in with Google, the profile data described in section 3.1.

3.4 Information about other people

Features such as mini-league tables, head-to-head comparisons and effective-ownership analysis necessarily involve data about other FPL managers in your leagues, including their manager names and team names. That information is published by the Premier League through the public FPL API. We process it so that we can show you your leagues, on the basis of our legitimate interests in providing the Service. If you are an FPL manager who appears in the Service and you object to that processing, contact fplassistant.ai@gmail.com.

3.5 What we do not collect

We do not collect payment card details, government identifiers, precise geolocation, or any special category data such as health, biometric, religious or political information. The Service has no file upload feature, so we do not hold any documents, images or other files you might otherwise submit. We do not ask for your FPL account password and you should never give it to us.

4. How We Use Your Information, and Our Legal Bases

If you are in the UK or the European Economic Area, we must have a lawful basis for each use of your personal information. The table below sets out what we do and why we are allowed to do it.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time as described in section 13.

We do not use your personal information for advertising, and we do not build advertising or marketing profiles.

5. Artificial Intelligence Features

The Service includes an AI assistant. This section explains, specifically, what happens to your data when you use it. Please read it before typing anything into the assistant.

5.1 Who provides the model

The assistant is powered by a large language model operated by a third party, not by us. We currently use Google's Gemini API (Google LLC) as our model provider. We have also integrated OpenAI and the Vercel AI Gateway as alternatives and may switch between them for availability, cost or quality reasons. We will update this policy if we change the default provider.

5.2 What is sent to the model provider

When you send a message to the assistant, the following is transmitted to the provider:

• The text of your message, and recent messages in the same conversation.
• Your FPL manager name (normally your real name as registered with the Premier League) and your team name.
• Your FPL performance context: overall rank, gameweek rank, points, money in the bank, team value, free transfers, chips available, and the gameweek being planned.
• Your saved squad, transfers and price watches, when relevant to your question.
• Your assistant preferences, including any rival manager name and any free text you entered in the notes field.
• Your timezone, so that deadlines can be described in local time.
• Where you ask about a mini-league, the names and team names of other managers in that league, as published by the FPL API.

5.3 What is not sent to the model provider

We do not send your email address, your password or password hash, your IP address, your Google profile picture, or your push notification details to the model provider.

5.4 Training

We use our AI providers under commercial API terms and we do not consent to your conversations being used to train their models. We do not use your conversations to train any model of our own. If this ever changes, we will update this policy and tell you before the change takes effect.

5.5 How conversations are stored

• In your browser. Your conversation is kept in your browser's local storage so it survives a page refresh. It is cleared when you sign out, after seven days, or after 48 hours of inactivity.
• On our servers. We keep a log of each exchange containing your message text, the assistant's reply, the FPL context assembled for that request, token counts, timing and any error. These logs are restricted to our operations staff and are used for debugging, abuse prevention and improving accuracy. Members of our team may read them. Retention is described in section 11.

5.6 Limits on the assistant, and what it is not for

• The assistant produces estimates and suggestions about a fantasy football game. Its output may be incomplete, out of date or simply wrong, and you are responsible for any decision you make using it.
• The assistant is not a source of medical, mental-health, legal, financial or investment advice, and it is not a crisis or emergency service. It is not monitored by a human in real time. If you are in distress or in danger, please contact your local emergency services or a crisis helpline immediately. In the UK you can call or text 111, or contact Samaritans free on 116 123. In the US and Canada you can call or text 988.
• Some features display bookmaker odds sourced from a third-party data provider. These are shown as a statistical input to our projections. They are not betting advice, not an inducement to gamble, and not an offer of any gambling product. Gambling carries a risk of financial loss and addiction, and is restricted to adults.
• Assistant usage is capped per user per day. We may change, limit or withdraw AI features at any time.

5.7 Automated decision-making

We do not make decisions about you that produce legal effects, or similarly significant effects, based solely on automated processing. Projections, ratings and assistant recommendations are informational; you decide what to do with them.

6. Third Parties Who Process Data For Us

We use the third-party service providers below to run the Service. Each acts as a processor or service provider on our behalf, or as an independent controller where noted, and each is bound by its own terms and data protection commitments. We do not authorise any of them to use your information for their own marketing.

We also use fal.ai to generate stylised player artwork. That process runs offline against public player photographs and never receives user data.

We do not use Google Analytics, Meta pixels, advertising networks, session-replay tools, or any third-party marketing or profiling trackers.

7. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. We have not done so in the preceding twelve months. Beyond the service providers listed insection 6, we disclose personal information only as follows:

• Legal requirements. Where we are required to by law, or in response to a valid request from a court, regulator or law enforcement. Where we are legally permitted to do so, we will attempt to notify you first.
• To protect rights and safety. Where we reasonably believe disclosure is necessary to investigate or prevent fraud, abuse of the Service, security incidents, or a threat to the safety of any person.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred as part of that transaction. We will notify you and this policy will continue to apply until it is replaced.
• With your direction. Where you ask us to share something, or make it visible yourself.

8. Cookies and Local Storage

We use a small number of first-party cookies and browser storage entries. We do not use advertising cookies, and no third party sets a tracking cookie through the Service.

Because we set only strictly necessary cookies and our analytics is cookieless, we do not display a cookie consent banner. You can clear cookies and local storage through your browser settings at any time; clearing the authentication cookies will sign you out.

We do not respond to browser Do Not Track signals, as there is no common standard for them. We do not track you across other websites, so there is nothing to opt out of.

9. Push Notifications

Push notifications are optional and off by default. If you turn them on, your browser issues a subscription endpoint and a pair of encryption keys, and we store those along with your browser's user agent string, your timezone, the notification types you enabled, and the time you gave consent. We use these solely to send the alerts you asked for, such as gameweek deadline reminders and price change alerts.

You can withdraw consent at any time, in any of these ways:

• Turn off individual notification types in your notification settings.
• Pause or remove a specific device from your notification settings.
• Revoke notification permission for the site in your browser settings.

Removing a device deletes its subscription record. Subscriptions that your browser vendor reports as expired are marked inactive automatically.

10. International Data Transfers

Joseph Depew is based in the United States, so if you use the Service from the United Kingdom or the European Economic Area your personal information is transferred to, and administered from, the United States. The Service's own request processing runs principally in Dublin, Ireland, and our database is hosted in the European Union, but several of the providers in section 6 are United States companies, and AI requests and push notification delivery necessarily involve transfers to the United States.

The United States is not the subject of a general adequacy decision. Where personal information leaves the UK or the EEA, we rely on the safeguards our providers offer for those transfers — the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or the EU-US and UK-US Data Privacy Framework where the recipient is certified under it. You can ask which applies to a given provider by emailing fplassistant.ai@gmail.com.

11. How Long We Keep Information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as the law requires.

12. Security

We take technical and organisational measures appropriate to the risk, including encryption in transit using HTTPS, encryption at rest for our database, hashed passwords, row-level security policies restricting each account to its own records, server-side validation of all writes, scoped access keys, and separation of our production and testing environments so that test deployments cannot reach production data.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for using a unique password. If you believe your account has been compromised, contact fplassistant.ai@gmail.com immediately.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, within the timeframes the law prescribes.

If you believe you have found a security vulnerability in the Service, please report it to fplassistant.ai@gmail.com rather than disclosing it publicly. We will not pursue action against good-faith researchers who report responsibly and do not access or modify other users' data.

13. Your Rights

Subject to local law, you have the following rights over your personal information. These rights apply in full if you are in the UK or the EEA, and many apply elsewhere.

• Access. Ask for a copy of the personal information we hold about you.
• Rectification. Ask us to correct information that is inaccurate or incomplete.
• Erasure. Ask us to delete your personal information, including your account and your AI conversation logs.
• Restriction. Ask us to limit how we use your information while a dispute about it is resolved.
• Portability. Ask for the information you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another provider.
• Objection. Object to processing we carry out on the basis of legitimate interests, including any profiling.
• Withdraw consent. Where we rely on your consent, such as push notifications, withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Complain. Lodge a complaint with a data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is the authority in your country of residence. We would appreciate the chance to address your concern first.

To exercise any of these rights, email fplassistant.ai@gmail.com from the address on your account, or tell us which account you are writing about so we can verify your identity. We will respond within one month. We may extend that by two further months for complex requests, and we will tell you if we do. We will not charge a fee or treat you differently for making a request.

You can delete your account yourself. Go to Settings, open Delete account, and confirm. This is immediate and permanent: it removes your profile and sign-in, your linked FPL team and manager name, every squad and plan you have saved, your assistant preferences and stored conversation logs, your price watches and your notification devices. It cannot be undone, and it does not affect your FPL account with the Premier League.

You can also delete narrower things without closing your account: unlink your FPL team from your settings, remove notification devices from your notification settings, and clear your assistant conversation from the assistant panel. If you would rather we did any of this for you, email fplassistant.ai@gmail.com.

14. Additional Rights for United States Residents

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another US state with a comprehensive privacy law, you have rights to know what personal information we collect, to access a copy of it, to correct it, to delete it, and to not be discriminated against for exercising those rights.

In the twelve months preceding the date of this policy we collected the categories of personal information described in section 3, which correspond to the following categories under the California Consumer Privacy Act: identifiers (email address, user ID, IP address); personal information under Cal. Civ. Code 1798.80 (name); internet or other electronic network activity information (usage and log data); geolocation data limited to approximate country; and inferences drawn to generate projections and recommendations. We collected them from you, from your device, and from the public Fantasy Premier League API, for the business purposes described in section 4, and we disclosed them for business purposes to the service providers named in section 6.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA, and we have not done so in the past twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not process sensitive personal information for the purpose of inferring characteristics.

To exercise these rights, email fplassistant.ai@gmail.com. We will verify your request by confirming control of the email address on the account. You may use an authorised agent, in which case we will require written proof of their authority. If we deny a request you may appeal by replying to our decision, and we will respond to the appeal within the period your state law allows.

15. Children

The Service is not directed to children. You must be at least 16 years old to create an account. We do not knowingly collect personal information from anyone under 16, and we do not knowingly collect personal information from children under 13 within the meaning of the United States Children's Online Privacy Protection Act.

If you are a parent or guardian and you believe a child has provided us with personal information, contact fplassistant.ai@gmail.com and we will delete the account and its data promptly.

16. Third-Party Links

The Service links to third-party websites, including the official Fantasy Premier League site, Discord and content from other creators. We do not control those sites and we are not responsible for their privacy practices. This policy does not apply to them, and we encourage you to read their policies before providing information to them.

17. Changes to This Policy

We may update this Privacy Policy as the Service changes. When we do, we will revise the "Last updated" date at the top of this page.

If we make a material change, such as adding a new category of personal information, adding a new AI provider or an advertising partner, or changing the purposes for which we use your data, we will give you notice by a prominent notice in the Service or by email to the address on your account before the change takes effect, and where the law requires it we will ask for your consent.

18. Contact Us

For any question about this policy, our privacy practices, or to exercise your rights, email fplassistant.ai@gmail.com. For general product support you can also reach us in the FPL Assistant Discord.

The controller is Joseph Depew, operating the Service as an individual from the United States. Written correspondence should go to fplassistant.ai@gmail.com; we do not maintain a separate postal address for the Service.

If you are in the UK and are not satisfied with our response, you may complain to the Information Commissioner's Office at ico.org.uk. If you are in the EEA, you may complain to the supervisory authority in your country of residence.