Privacy Policy

FPL Copycat Detective is operated at fplcopycat.com. We provide Fantasy Premier League analytics and copycat-detection tools. We are not affiliated with, endorsed by, or connected to the Premier League or Fantasy Premier League.

For privacy questions or to exercise your data rights, contact us at hello@fplcopycat.com.

Account data (if you register): email address, optional display name, password (stored as a secure hash — we never store plain text passwords), subscription plan, referral code, and linked FPL entry ID / team name if you connect your team.

Usage data: saved league IDs, scan history, watchlists, transfer scenarios, notification preferences (email and push opt-in), and session/authentication tokens required to keep you logged in.

Payment data: if you subscribe, Stripe processes your payment. We store Stripe customer and subscription IDs — not your full card number.

FPL public data: we fetch publicly available data from the official Fantasy Premier League API (league standings, team picks, transfers, player prices). This data relates to public FPL profiles and leagues, not private messages or payment details held by FPL.

Technical data: IP address, browser type, device information, and error logs — collected automatically by our hosting provider for security and reliability.

Analytics (optional): if enabled, we use Plausible Analytics, a privacy-oriented tool that does not use tracking cookies for advertising and does not build personal advertising profiles.

• To create and manage your account and authenticate you.
• To run league scans, store results, and show your history.
• To process subscriptions and provide paid features.
• To send emails or push notifications you have opted into.
• To improve reliability, prevent abuse, and fix bugs.
• To comply with legal obligations.

• Contract: processing needed to provide the service you signed up for.
• Legitimate interests: security, fraud prevention, service improvement, and operating a fan analytics tool — balanced against your rights.
• Consent: marketing emails and browser push notifications (you can withdraw consent anytime in Settings).
• Legal obligation: where required by law (e.g. tax or accounting records for payments).

League scan results may be stored with a public report link that anyone with the URL can view. Scans use publicly accessible FPL league data. By running a scan on a league ID, you confirm you have a legitimate reason to analyse that league (e.g. you are a member or commissioner). Do not use the service to harass or doxx other managers.

We use trusted processors to run the service. Data may be processed by:

• Vercel (hosting)
• Supabase / PostgreSQL (database)
• Stripe (payments)
• Resend (transactional email, if enabled)
• Cloudflare (FPL API relay)
• Upstash (optional scan cache)
• Plausible (optional analytics)

We do not sell your personal data. We may disclose information if required by law or to protect our rights, users, or the public.

Some processors may store or process data outside the UK/EEA (for example, United States hosting). Where this happens, we rely on appropriate safeguards such as standard contractual clauses or processor certifications, as applicable.

• Account data: while your account is active, then deleted on request.
• Scan results: retained to power history and public reports unless deleted.
• Payment records: kept as long as required for tax and accounting rules.
• Server logs: typically rotated within a few weeks.

If you are in the UK or EEA, you have the right to access, correct, delete, restrict, or object to certain processing, and to data portability where applicable. You may also lodge a complaint with your local data protection authority.

You can delete your account instantly from Settings. For a data export or other requests, email hello@fplcopycat.com from the address linked to your account. We will respond within 30 days.

We use essential cookies and local storage for authentication sessions and basic app preferences (e.g. remembering your last scan). We do not use advertising cookies. Optional analytics, if enabled, is designed to minimise personal tracking.

The service is intended for users aged 16 and over. We do not knowingly collect data from children under 16. Contact us if you believe a child has registered and we will delete the account.

We may update this policy as the product evolves. Material changes will be noted on this page with a new "last updated" date. Continued use after changes constitutes acceptance of the updated policy.