Privacy

fplam stores your email address, your FPL team's public entry id, and, if you subscribe, a Stripe customer reference. It never receives your Fantasy Premier League password, because it never asks for one.

• Your email address. Used only to send sign-in links and, if you subscribe, billing receipts. It is how your account is identified.
• Your FPL entry id, once you choose to link a team. This is the public number in your FPL Points page URL, not a credential.
• Sign-in and authorisation records: sessions, and the consents you granted to AI clients you connected, so you are not asked again on every message.
• A count of solver runs per gameweek, to apply the free-tier limit. It is a number, not a history of what you asked.
• If you subscribe: a Stripe customer id and your subscription status and renewal date. Card details are handled by Stripe and never reach fplam.

The server writes diagnostic logs so failures can be investigated. A log line records which tool was called, whether it succeeded, how long it took, and two opaque identifiers: your internal account id and the id of the AI client you connected.

Access tokens, sign-in links and email addresses are deliberately never written to logs. Logs are held by Vercel for the retention period of its platform and are not used for anything but debugging.

• Your FPL password or login. fplam reads only public Fantasy Premier League endpoints, keyed on your entry id. Any FPL tool that asks you to type your FPL password is doing something fplam does not do.
• Payment card details. Checkout happens on Stripe's own pages.
• Advertising and tracking. There are no advertising cookies, no third-party analytics scripts, and nothing is sold or shared for marketing.

fplam uses a small number of providers to run the service. Each sees only what it needs to.

• Supabase: the database, hosted in the EU (eu-west-1). Holds your account, linked entry id and run counts.
• Resend: sends sign-in emails. Sees your email address.
• Stripe: payments and subscription management, and merchant of record for purchases. Sees your email and payment details.
• Vercel: hosting and runtime logs.

When you connect fplam to an AI assistant, your questions and fplam's answers are also processed by whoever runs that assistant, under their privacy policy, not this one.

Only what signing in requires: a session cookie, and short-lived state during the authorisation handshake. No advertising or analytics cookies are set.

You can ask for a copy of what fplam holds about you, ask for it to be corrected, or ask for the account and everything attached to it to be deleted. Deletion is final and includes your linked team and run history. If you are in the UK or EU you also have the right to complain to your data protection regulator.

Email privacy@fplam.co.uk and it will be handled.

If this policy changes materially, the date at the top of this page changes with it, and anyone with an account gets an email.