Privacy Policy — Fantasy Football IQ

Last updated: 2026-10-23 · Controller: Fantasy Football IQ Limited, a company registered in England & Wales (company no. 17371385) with registered office at 66 Paul Street, London, EC2A 4NA, United Kingdom · Contact: privacy@fantasyfootballiq.app · Support: support@fantasyfootballiq.app

Fantasy Football IQ is a Fantasy Premier League assistant. It gives you transfer, captaincy and rank advice — it never signs in to, or makes changes to, your FPL team. This policy explains what we collect and why. Not affiliated with or endorsed by the Premier League or Fantasy Premier League.

What we collect

• Account: a private, one-way identifier derived from your Sign in with Apple / Google ID, plus the email address from that sign-in (or the address you use to request an email sign-in link). We use the email to send you service emails — a sign-in confirmation, a reminder before your free Premium ends, your subscription receipt, and confirmation if you delete your account. These are essential to the service and are not marketing, so they have no unsubscribe. We also send marketing about our own service — a welcome, notes about what we've built, tips, FPL analysis and editorial, pricing and subscription offers, a nudge if you signed up but never linked a team, and, if you take part in one, your Rivals gameweek dossier — by email, push notification and in-app message. Every one of those carries an unsubscribe link, and one click stops all of it. You can turn off a single kind or all of them, and we keep that choice even if you later delete your account, so it is never quietly undone. We never send anyone else's offers unless you have separately opted in to them. With Sign in with Apple you can choose Apple's private-relay address; we store whichever address the sign-in gives us. We don't store your name, and we don't sell or share your address with anyone.
• Your FPL setup: the one FPL Team ID you link, the mini-league IDs you choose to track, and your preferences (risk setting, players/teams to include or ignore).
• Subscription status: your plan (free trial or Premium) and entitlements, managed through the app stores and our subscription provider. We never see or store your card details.
• Assistant messages: what you type to the in-app assistant, to generate a reply.
• Push token: if you enable notifications, a device push token so we can deliver alerts.
• How you use the app: which screens you open, how long you spend on them, taps on a few key buttons, and the steps you complete while setting up your account — for example whether you got as far as confirming your FPL team. We also note the kind of device you use it on — phone, tablet or computer, its operating system and browser, the screen size, and your language and time zone — and, if you connect your FPL team, whether connecting or sending a change to FPL worked. When something in the app breaks, we record the error — what failed and on which screen. While you are signed in, this is recorded against your account, and the setup steps you took just before signing in are joined to it. We use it for one purpose: to find where the app is broken or confusing and fix it. It is our own measurement — no third party receives it, it sets no cookies and stores nothing on your device, and it is never used to build an advertising profile of you. On our website there is no sign-in, so your visits there stay anonymous unless you go on to create an account. Then the pages you viewed on our website on the way to signing up are joined to your new account, together with where you first came to us from — the page you landed on, the site or advert that sent you, any campaign tags on that link and, if you clicked one of our Google ads, the ad's click reference (a code Google adds to the link). This is carried in the links between our pages, never stored on your device.
• Guests and partners: if you contribute to our content, we use your name, email, FPL Team ID and contribution to make, publish and promote that content and to stay in touch about it, under our Partnerships T&Cs. You keep your data protection rights, including to ask about or object to this (privacy@fantasyfootballiq.app).

Cookies, analytics & advertising: on our website and web app we use Google Analytics and Google Ads only if you accept our cookie banner (see the *Cookies, analytics & advertising* section below). Decline and no analytics or advertising cookies are set. Our native mobile apps contain no third-party analytics or advertising SDKs.

Public FPL data we read (not "collected from you"): to show your squad, ownership and rivals we read publicly available Fantasy Premier League data via the official FPL API — including your public team and the public standings/team names in the mini-leagues you track. This is factual, already-public information.

How we use it & legal basis (UK GDPR)

• Provide the service (advice, your squad, rivals, notifications) — *performance of a contract*.
• Manage your subscription & the one-team lock — *contract*.
• Send you service (transactional) emails — a sign-in confirmation, a reminder before your free Premium ends, and your subscription receipt — *contract / legitimate interests*.
• Keep it working and improve it (diagnostics) — *legitimate interests*.
• Measure how the app is used, including against your account while signed in — so we can see where sign-up and setup break, learn which parts of the app actually help people make decisions, and improve the advice we give — *legitimate interests*. We have weighed this against your privacy: it is first-party only; it is limited to the screens you open and how long for, what you search for, open, compare, sort and filter, the recommendations we show you, the transfers, captain and chip choices you make (which are already public on the FPL site), the kind of device and browser you use, whether connecting or sending to your FPL team worked, and any errors the app hits; it is never shared, never used for advertising or automated decisions about you, and kept for no more than 13 months. You can switch this off at any time in Settings → *Your data* → *Link my usage to my account*: from then on your usage is counted without your account attached, and anything we already held against your account is unlinked. You can also object by emailing privacy@fantasyfootballiq.app.
• Understand what brought you to us — where you first arrived from (the page you landed on, the referring site or advert, any campaign tags on the link and, if it was one of our Google ads, the ad's click reference) and the pages you viewed on our website before signing up — *legitimate interests*: knowing which pages and adverts actually lead people to sign up is how we decide where to spend. It is first-party, never sold and never used to target you. The page-by-page record is kept for no more than 13 months and is unlinked from your account if you switch off *Link my usage to my account*; where you first came from stays with your account, like the date you joined.
• Improve and measure our projection models — we compare what our models predicted against what actually happened, and publish statistics about how they performed — *legitimate interests*. Anything we publish is aggregated or anonymised and does not identify you or your team.
• Marketing about our own service (email, push, in-app) — *legitimate interests*, relying on the "soft opt-in" in the UK's Privacy and Electronic Communications Regulations: you gave us your details when you signed up for an FPL service, this is that service, and you were offered an opt-out at sign-up and in every message. An opt-out is honoured for good, including if you delete your account.
• The weekly email without an account (the box on our website's pages), and the occasional emails about Fantasy Football IQ you agree to with it — *consent*. The soft opt-in above does not apply, because you have not signed up for our service: we send it only after you tick the box and then press the button in the confirmation email we send you. We keep your email address, the wording you agreed to, when you agreed and confirmed, and the page you signed up on, so we can show what you consented to. Every email has a one-click unsubscribe, and we delete your address within 30 days of you unsubscribing (keeping only the one-way hash that stops us emailing you again). If you never confirm, we delete the address after 30 days.
• Third-party or partner marketing — only with your explicit, separate *consent*, which we do not currently ask for.
• Third-party analytics & advertising cookies — only with your *consent*.

Cookies, analytics & advertising

On our website (fantasyfootballiq.app) and web app (play.fantasyfootballiq.app) — only after you accept our cookie banner — we use:

• Google Analytics 4 — to understand how the site is used (pages, features, sign-ups) so we can improve it. Sets analytics cookies.
• Google Ads — to measure which of our ads lead to sign-ups and subscriptions, so we spend our advertising budget wisely. Sets advertising cookies. When you create an account — unless you have declined advertising cookies — we also send Google the click reference of the ad you came from and a hashed (scrambled) copy of your email address, so Google can tell us whether one of our ads led to your sign-up.

Both are provided by Google, which processes this data under its own Privacy Policy. We use Google Consent Mode: until you accept, no analytics or advertising cookies are set; if you decline, none are set at all. You can change your choice at any time via the Cookie settings link in our website footer, or through your browser's cookie controls. Legal basis: your consent (UK GDPR / PECR). Our native mobile apps contain no third-party analytics or advertising SDKs.

Our own usage measurement is separate from the above, and declining cookies does not switch it off. It sets no cookies and writes nothing to your device — which is why it isn't part of the cookie banner — and no third party receives it. It records the screens you open, how long you spend on them, a few key taps, the setup steps you complete, the kind of device you use and any errors the app hits, linked to your account while you are signed in, plus the website pages you viewed on the way to creating it (see *How you use the app*). Its legal basis is our legitimate interests in finding and fixing what breaks, not consent; you can object at any time at privacy@fantasyfootballiq.app and we will unlink it from your account.

One strictly necessary security cookie on our website. To detect automated abuse of the site (scripts that copy our pages in bulk), each page on fantasyfootballiq.app sets one first-party cookie, _fp, that tells a web browser from an automated script. It holds a random value and an expiry, lasts 30 days, is readable only by our own server (HttpOnly), is never shared with anyone and is not used for analytics, advertising or to identify you. It is strictly necessary for the security of the site, so it is not part of the cookie banner (UK PECR). Our servers also keep a short-lived record of requests that look automated (the network address, browser description and pages fetched) for up to 14 days, under our legitimate interests in protecting the site. For the same reason we count how many different data pages and articles each _fp value opens on the website, and how many different players and player lists each account opens in the app, in a day and in a week, and how many new _fp values each network address and browser receives in a day — a person never reads the whole site or keeps resetting the cookie, a copying program does. The count is kept as scrambled tokens, not the pages or players themselves, and is deleted after 8 days.

Who we share it with (processors — we do NOT sell your data)

We use a small number of trusted providers to run the app, sharing only the minimum data each needs. We do not sell your data. With your consent, we use Google's analytics and advertising cookies to measure our own ads and improve the product (see *Cookies, analytics & advertising* above). Our providers include:

• The Apple and Google app stores — process payments and manage subscriptions bought in the iPhone or Android app.
• Our subscription provider (RevenueCat) — records your plan and entitlements, and runs the checkout when you subscribe on our website.
• A card payment processor (Stripe) — takes card payments made on our website, for RevenueCat. It receives your card and billing details (such as name, email and country); we never see or store your full card number.
• An AI provider — processes your assistant messages to generate replies.
• Hosting and infrastructure providers — run and store the app's backend.
• A push-notification provider — delivers alerts, if you enable them.
• An email provider — delivers your service emails (sign-in confirmation, free-week reminder, receipt, cancellation confirmation).
• Google (Analytics & Ads) — with your consent, measures site usage and the performance of our ads.
• The public Fantasy Premier League API — the read-only source of public game data.

A current list of the specific providers we use is available on request at privacy@fantasyfootballiq.app. Some providers are in the US; such transfers are covered by Standard Contractual Clauses or equivalent safeguards.

Retention & deletion

We keep your data while your account is active. You can delete your account in-app (Settings → Delete account), which erases your profile, email, linked Team ID, preferences, saved scenarios, watchlist, push tokens and your assistant history. You can also email privacy@fantasyfootballiq.app. Backups are purged on a rolling 30-day cycle.

One record survives deletion. A one-way hash of your email address (never the address itself), the FPL Team ID that was linked to it, and your subscription state are retained to prevent abuse of the service: it stops a deleted account being used to claim repeat free trials, and keeps an FPL Team ID linked to one person so nobody else can claim your team. It contains nothing you wrote and nothing we can contact you with. If you sign in again we restore your account from it — your Team ID and subscription state come back, your free trial resumes where it stopped rather than restarting, and everything else stays deleted.

Usage measurement (see *How you use the app*) is kept for a maximum of 13 months and then deleted automatically. When you delete your account, those records are unlinked from you in the same operation — the account identifier is removed, leaving an anonymous screen name and duration that can no longer be connected to any person — so our overall traffic totals stay intact while nothing identifies you.

Your rights (UK/EU)

Access, rectification, erasure, portability, restriction, and objection. Email privacy@fantasyfootballiq.app; we respond within one month. You may complain to the ICO (UK) or your local authority.

Children

Not directed at children under 16. FPL is a general-audience game; we don't knowingly collect data from children under that age.

Security & changes

We use encryption in transit, access controls, and least-privilege data handling. We'll post changes here and, for material changes, notify you in-app. Continued use means acceptance.

Privacy questions and data requests: privacy@fantasyfootballiq.app. General support: support@fantasyfootballiq.app.