Privacy Policy

1. Introduction

Welcome to Draft FPL Live ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your information when you visit www.draftfpl.live and use our services.

By using our website, you agree to the collection and use of information in accordance with this policy. Our Terms of Service also apply to your use of this site.

2. Information We Collect

2a. Account Information

When you sign in with Google, we receive:

• Your email address
• Your name and profile picture (as provided by Google)
• A unique user identifier

We do not receive or store your Google password.

2b. FPL Draft Data

When you connect your Fantasy Premier League draft team (via the website or the DraftFPL Live mobile app), we store:

• Your FPL draft team ID (entry ID)
• Your league ID
• An anonymous identifier to link your browser session to your account

This data is sourced from the publicly available FPL draft API and is used solely to personalise your experience.

2e. Discord Bot & Integration

If you add the Draft FPL Live Discord bot to your server, or link your personal Discord account for DMs, we collect:

• Discord guild (server) ID, name, and default channel ID — where the bot is installed and where it should post league-wide messages
• The ID of the Discord user who installed the bot or linked their account
• Discord username (the handle you've chosen publicly; we do not store your display name, email, or any server membership beyond the install target)
• The Draft FPL league the server is linked to, set by the commissioner via the /link-league command or the web install flow
• Per-user and per-server dedup flags — short-lived records (TTL'd, auto-deleted within days) indicating that a specific reminder has been sent, so we don't double-message you

We do not request or receive: message content, server member lists, presence (online/offline status), voice activity, or any data from servers where you have not installed our bot. Our Discord application runs with minimal OAuth scopes (bot, applications.commands, and identify for the personal-DM flow) and no privileged gateway intents.

You can remove the bot from a Discord server at any time by kicking it in Discord's server settings, or by running /unlink-league. You can unlink your personal Discord account from the Discord section of the account modal on draftfpl.live.

2f. Mobile App & Push Notifications

If you use the DraftFPL Live mobile app, we may additionally collect:

• Your device push token (provided by Apple or Google) to send you notifications
• Your device platform (iOS or Android)
• Your notification preferences (which types of alerts you have enabled)

Push tokens are stored securely and used solely to deliver the notifications you have opted in to (e.g. goal alerts, bonus point updates, waiver deadline reminders). You can disable any notification type at any time in the app's notification settings, or disable notifications entirely through your device settings. If you uninstall the app or change your team, your push token is removed from our systems.

2c. Payment Information

If you subscribe to Draft FPL Live Pro, payments are processed by Stripe. We do not see or store your card details. We receive from Stripe:

• A Stripe customer ID and subscription ID
• Your subscription status and billing period

2d. Analytics Data

We use Google Analytics 4 (GA4) to understand how visitors use our site. This includes:

• Pages visited and time spent
• Referring website
• Browser type and device information
• Approximate location (country/city level)
• Interaction data (clicks, scrolling)

IP addresses are automatically anonymised by GA4.

3. How We Use Your Information

• Account & authentication: to sign you in and maintain your session
• Personalisation: to show your team's fixtures, league standings, and waiver suggestions
• Subscription management: to verify your plan status and manage billing
• Analytics: to understand site usage, identify issues, and improve the experience
• Communication: to respond if you contact us (we do not send marketing emails)

4. Legal Basis for Processing

• Contract: processing your account and subscription data is necessary to provide our service
• Consent: analytics cookies are set only after you give consent via our cookie banner
• Legitimate interest: improving our website and detecting abuse

5. Data Storage & Retention

5a. Where we store data

• Supabase (hosted on AWS): account profiles and subscription records
• AWS DynamoDB: Discord guild and user link records, waiver/claim data, ephemeral notification dedup flags
• Stripe: payment and billing data
• Discord: the Discord API returns bot and channel data transiently; we persist only the IDs listed in section 2e
• Google: analytics data (GA4)

5b. Browser storage

We use your browser's localStorage and sessionStorage to keep you signed in, remember your team selection, and cache your subscription status. This data stays on your device and is not transmitted to third parties.

5c. Cookies

5d. Retention periods

• Account data: retained while your account is active; deleted upon request
• Subscription records: retained for 7 years for financial record-keeping obligations
• Analytics data: retained for 14 months (Google's default), then automatically deleted

6. Data Sharing

We do not sell your personal data. Your data may be processed by:

• Google — authentication (OAuth) and analytics (GA4)
• Supabase — database and authentication infrastructure
• Stripe — payment processing
• Our hosting provider — serving the website

Each processor handles data under their own privacy policy and in accordance with applicable data protection law.

7. Your Rights

Under UK GDPR and other applicable data protection laws, you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Delete your personal data ("right to be forgotten")
• Object to processing of your personal data
• Restrict processing of your personal data
• Data portability — receive your data in a portable format
• Withdraw consent at any time (this does not affect prior processing)

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Cookie Management

We use a minimal set of cookies — strictly necessary cookies for the site to function, and first-party Google Analytics cookies for usage measurement. We do not use advertising or personalization cookies. To disable analytics tracking:

• Adjust your browser settings to refuse third-party cookies, or use private/incognito mode
• Install the Google Analytics Opt-out Browser Add-on
• Email [email protected] to request data removal under GDPR/CCPA

9. International Transfers

Data may be processed in data centres outside the UK/EEA (including the United States). Our processors (Google, Supabase, Stripe) provide appropriate safeguards for international transfers through Standard Contractual Clauses or equivalent mechanisms.

10. Account Deletion

You can sign out at any time via the identity menu. To permanently delete your account and all associated data, email [email protected] and we will process your request within 30 days.

11. Children's Privacy

Our website is not intended for children under 18 years of age. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the site after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this privacy policy or our data practices, contact us at:

• Email: [email protected]

14. Supervisory Authority

If you are located in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). If you are in the EEA, you may contact your local data protection authority.