Skip to content
FPLWiseFPLWise
GW10Deadline

Updated

Menu

Privacy Policy

Last updated 4 November 2026.

Ali Kara, an individual based in Canada, runs FPLWise and is responsible for your personal data. Privacy contact: [email protected].

We keep a broad source category (ChatGPT, Claude, web search, direct visit, another website, or other) when you create an account. A short-lived cookie carries this category for up to 15 minutes during sign-in. We store the category with your account and use it to count payments and refunds by source. We do not retain the referring URL, search terms, OAuth client identifier or conversation information for this purpose. Older accounts have an unknown source. The account category is removed with account data; aggregate counts are retained for up to 400 days.

What we collect

We keep only what the service needs to work:

  • your email address and an internal account ID
  • single-use sign-in links, stored in hashed form
  • session and access tokens, stored in hashed form
  • the dates your access was granted
  • payment references and referral or creator attribution
  • simple usage counters that limit how often the service is used

Sessions use essential, secure cookies. We count page visits with Cloudflare Web Analytics, which is cookieless.

We also keep daily totals of page visits, referrer host categories, sign-in links, new accounts, checkout outcomes, payments, refunds, planner outcomes, and shared-plan links and their next steps for 400 days, without identifiers, cookies or full URLs in these counters.

When you calculate a plan, we use your FPL team ID or the squad you enter. Planner jobs and cached inputs expire automatically. A squad saved in the squad builder stays in your browser until you clear it there.

If you save FPL team IDs and names to your account, we store them to fill in your team automatically and to share them with apps you connect, such as ChatGPT or Claude. They are deleted with your account data, 30 days after you delete your account.

We never ask for your Fantasy Premier League password, and we do not collect your birth date or any identity document.

We do not sell your personal data.

Age

The free service is for people aged 13 and over, and paid plans are for people aged 18 and over. When you sign up, you confirm that you meet the free-service age, and you confirm the paid-plan age again before you pay. We do not run ads or behavioural profiling.

Why we use it, and our legal basis

If you are in the UK or the European Union, these are the legal bases we rely on:

  • Contract: signing you in, giving you access to what you have signed up or paid for, and billing and refunds.
  • Legitimate interests: keeping the service secure, preventing abuse, applying rate limits, and counting aggregate usage so we can run and improve the service. We balance this against your rights, and you can object by contacting [email protected].
  • Consent: marketing email, only if we ever offer it and only if you opt in. You can withdraw consent at any time. We do not send marketing email today.
  • Legal obligation: keeping billing and tax records for the period the law requires.

Using FPLWise through ChatGPT or Claude

You can use FPLWise through ChatGPT or Claude. We then receive the tool requests the connected client makes and the inputs to them, such as an FPL team ID. If you link your FPLWise account, we also receive an access token that identifies your account to us. We do not ask OpenAI or Anthropic for your email address or profile, and we do not receive your conversation. What you share with ChatGPT is covered by OpenAI's privacy policyor Anthropic's privacy policy, as applicable. Access tokens last 15 minutes and are renewed with a refresh token that lasts up to 90 days. You can revoke connections from your account at any time.

Who processes your data

  • Resend sends our sign-in and renewal-reminder emails.
  • Cloudflare carries traffic to our server through a secure tunnel, caches and delivers the site through its network, and hosts parts of the site on Cloudflare Pages. To do this it processes IP addresses and request logs, and uses them to protect the site.
  • Stripe (Managed Payments) takes payment. Link, LLC is the merchant of record that sells to you, and it handles billing, tax and related records. They keep your payment details; we do not see your card number.
  • Our own server runs the service. It is self-hosted on a server in Canada.

Where your data is processed

Our servers are in Canada. If you live in the UK or the European Union, your data is therefore processed in Canada, outside the UK and the EU. Both the UK and the EU recognise Canada as providing adequate protection for commercial organisations covered by PIPEDA, Canada's federal private-sector privacy law, which applies to personal information that crosses borders in the course of commercial activity. We are in Alberta, so Alberta's Personal Information Protection Act also applies to us. We rely on this adequacy recognition for transfers to Canada. Our providers have their own transfer arrangements, described in their policies.

How long we keep it

We retain deduplicated linked-account activity membership by UTC calendar week and season/gameweek for 90 days to calculate private aggregate activity and return rates. Expired membership is removed when later activity is recorded; account deletion removes it. No prompt, IP address, team ID, tool name or per-call timeline is retained for these metrics.

We keep hashed card fingerprints for referral abuse checks, never card numbers. These hashes remain for the life of the account and are removed with account data 30 days after a deletion request, unless retention is required by law. Connected apps cannot read them.

Sign-in links expire after 15 minutes. Website sessions expire after 30 days. Rate-limit counters reset at the end of their window. Expired records are removed when they are next used.

We back up account data every hour, including sign-in requests that have not yet been removed. Backups are stored only on our own computers, which use full-disk encryption, and are copied between them over an encrypted connection. We keep the latest 48 hourly backups and 14 daily backups, then delete older ones.

If you delete your account, we delete your account data 30 days later, and it leaves our backups within about 15 days after that.

Billing records are kept for the period the law requires, mostly by Link, LLC.

Your choices and rights

You can sign out, revoke an app connection or access token from your account, and clear squad data stored in your browser. You have the right to ask for access to your data, correction, deletion, a copy, and to object to or restrict some uses. Contact [email protected] and we will answer within one month. We do not send marketing email or publish testimonials without your separate consent.

Complaints

Please contact us first so we can put things right. You also have the right to complain to a regulator:

Pricing