Privacy Policy

Last updated: 2026-08-06

Overview

You can search managers and read the blog on FPL Rivals without an account. An account is only needed to track rivals, use the AI assistant, or subscribe to Pro. FPL Rivals does not run advertising, does not use tracking or profiling cookies, and does not sell your data.

Data we process

• Account details - if you sign up we store your email address, a hashed password (Argon2, never the password itself), your plan status, and your saved rivals. Email is used for verification, password resets, and account notices.
• Session cookie - signing in sets one first-party cookie holding a session token, valid for 30 days. It is what keeps you logged in. Nothing else is stored in it.
• Search queries - the manager name or team name you enter is sent to the FPL Rivals API to query the Fantasy Premier League API on your behalf. Queries are not stored beyond the duration of the request.
• AI assistant messages - your questions, the conversation they sit in, and the squad context they are answered against are processed to generate a reply, then discarded. Conversations are not stored on our servers: they live in your browser tab and are gone when you close it. The only thing kept is a per-day count of how many questions you asked, which enforces the free-plan limit.
• Payment details - subscriptions are handled by Stripe. Card details are entered on Stripe's checkout and never reach FPL Rivals servers. We store only your Stripe customer and subscription identifiers and whether the subscription is active.
• IP address - standard server and CDN access logs may temporarily retain your IP address for security, rate limiting, and abuse prevention. These logs are not used for profiling or advertising.

The AI assistant and your data

Chat replies and the weekly insight briefs are generated by a self-hosted language model running on Modal, not by a consumer AI product. Your messages are not sold, not used for advertising, and not handed to a third party to train their models.

Cookies

One first-party cookie: the session cookie described above, set only when you sign in. There are no advertising, analytics, or cross-site tracking cookies. Site analytics are cookieless (see Cloudflare below).

Third-party services

• Fantasy Premier League API - all manager and squad data is fetched from fantasy.premierleague.com. FPL Rivals does not control that data.
• Cloudflare - serves the site and provides cookieless Web Analytics (page views and referrers, no cookies and no cross-site fingerprinting). Cloudflare may process request metadata such as IP and headers per their privacy policy.
• Stripe - payment processing and subscription management, per their privacy policy.
• Resend - delivers transactional email such as verification and password reset messages, per their privacy policy.
• Modal - hosts the language model that generates chat replies and insight briefs, per their privacy policy.

Fonts are served from FPL Rivals' own domain, so no font requests go to Google or any other third party.

Retention

Account data is kept while your account is open and deleted when you ask us to close it. Session tokens expire after 30 days. Access logs are short-lived and kept only for security and abuse prevention. Search queries and assistant conversations are not retained after the request completes.

Your rights (UK/EU)

Under UK GDPR and the EU GDPR you have the right to access, rectify, export, or erase the personal data we hold about you, and to object to or restrict its processing. Email support@fplrivals.org and we will action it. Deleting your account removes your email, password hash, saved rivals, and usage counts.

Changes

This policy may be updated occasionally. The "last updated" date at the top of this page reflects the most recent revision.