Privacy policy

Controller and contact

FPL Mania is operated by its independent owner in Portugal, who is the controller of the personal data described in this notice.

Contact email: contact.fplmania@gmail.com

Questions about this notice, data handling, or rights requests can be sent to that address.

Data this site processes

• The FPL team ID you submit.
• Public Fantasy Premier League data returned for that team, including public manager name, team name, squad data, chip history, and transfer history.
• An anonymous planner session identifier stored in the fplmania_session cookie and a security token stored in the fplmania_csrf cookie.
• The selected player-catalogue statistic stored for the current browser-tab session under planner-player-stat-v2.
• Planner actions taken during the session, such as transfers, captaincy changes, chip selection, and committed gameweeks.
• Temporary server-side planner state stored in Postgres to keep the active workspace available while you use the site.
• Manually saved browser or account draft state when you choose to save a draft.
• If you create or use an account, your Clerk user identifier, email address, authentication session information, optional default FPL team ID, and account-linked saved draft.
• Operational request and security information, including request time, method, path, response status, request identifier, duration, and a shortened non-reversible hash of the planner session identifier where available.
• If you accept analytics, Google Analytics measurement data such as pages viewed, interaction events, approximate location, device and browser information, referring page, and identifiers stored in analytics cookies.

How and why the data is used

FPL Mania uses this data to load a public FPL squad, reconstruct the current planning context, run the planner interface, apply FPL rules, keep your in-progress plan available across requests, authenticate an account, remember an optional default team, restore a draft when requested, prevent forged requests and abuse, troubleshoot faults, and protect the service.

Processing needed to provide planner, saved-draft, and account features requested by you is based on GDPR Article 6(1)(b), performance of the service agreement reflected in the terms of use. Processing needed to secure, operate, diagnose, and prevent abuse of the service, and the limited processing of publicly accessible FPL information, is based on GDPR Article 6(1)(f), the controller's legitimate interests. You may object to processing based on legitimate interests as described under “Your rights”.

If you accept analytics, FPL Mania uses Google Analytics measurement data to understand aggregate site usage, diagnose usability issues, and improve the service. This optional processing is based on your consent under GDPR Article 6(1)(a). Refusing or withdrawing analytics consent does not affect access to the site, and withdrawal does not affect processing that occurred before withdrawal.

The site does not use personal data for advertising, newsletter delivery, or automated decisions with legal or similarly significant effects. Google advertising signals and ad-personalization signals are disabled in the site's Google Analytics configuration.

Where the data comes from

Some data is collected directly from the site visitor, such as the submitted team ID, planner actions, and account information submitted through Clerk. Clerk also supplies FPL Mania with the authenticated user identifier and email address needed to maintain the local account.

Other data is obtained indirectly from publicly accessible Fantasy Premier League endpoints. That matters when a visitor loads a public team that may belong to another person.

Recipients and transfers

FPL Mania fetches public squad and player data from publicly accessible Fantasy Premier League endpoints at fantasy.premierleague.com.

The site is hosted on Render. Render processes hosted application data, Postgres data, and operational logs on FPL Mania's behalf.

Clerk provides account authentication and user management. When authentication is configured, Clerk browser resources are initialized throughout the site to resolve and maintain authentication state. Clerk processes authentication, account, device, network, and session information needed to provide those services. FPL Mania stores the resulting Clerk user identifier and email address, but does not receive or store your Clerk password.

Clerk and its subprocessors may process data in the United States and other countries. Clerk states that eligible EEA transfers rely on the EU-U.S. Data Privacy Framework and, where that mechanism is unavailable, contractual safeguards including the European Commission's Standard Contractual Clauses. Details are available in Clerk's Data Processing Addendum.

Google provides Google Analytics. After you accept analytics, the site sends measurement data to Google and Google sets first-party analytics cookies. Google and its subprocessors may process this data outside Portugal, including in the United States. Google describes its use of the EU-U.S. Data Privacy Framework and Standard Contractual Clauses in its data-transfer framework notice. More information is available in Google's privacy policy.

The site does not use advertising pixels or payment processors.

Cookies and similar technologies

The site uses required storage to provide requested functionality, protect the service, maintain authentication, and remember interface or consent choices. Google Analytics storage is optional and remains disabled unless you select “Accept analytics”.

You can accept or reject analytics in the consent panel. You can later change or withdraw that choice through “Manage analytics cookies” in the footer. When analytics is rejected or withdrawn, the site disables Analytics and removes accessible Google Analytics cookies. You can also clear cookies and site data using browser controls.

Retention

The fplmania_session and fplmania_csrf cookies end with the browser session. The player-statistic preference ends with the current browser-tab session. The analytics consent choice remains until it is changed or site data is cleared. Google Analytics cookies can last up to 2 years unless consent is withdrawn or the cookies are cleared. Clerk controls the lifetime of its authentication cookies and session records according to the account, browser, and Clerk configuration.

Google Analytics user-level and event-level data is retained for up to 14 months depending on the Analytics property configuration. Google's standard aggregated reports are not controlled by that user and event data-retention setting.

Server-side active planner state expires after 24 hours of inactivity. Manually saved browser and account drafts expire after 30 days of inactivity and are reset when their first planned gameweek is no longer the upcoming gameweek. Cached upstream FPL responses are stored temporarily to protect the service from repeated identical requests and expire automatically after short retention windows.

The local account record, Clerk user identifier, email address, and optional default FPL team ID are retained while the account remains active. When Clerk reports that an account has been deleted, FPL Mania deletes the corresponding local account and its account-linked saved draft. Temporary browser planner state and cached public FPL data remain subject to their normal expiry periods because they are not account records.

Application request and security logs are retained by Render according to the workspace's configured plan and are then removed from the log explorer.

Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, objection, and data portability where those rights apply.

You may also lodge a complaint with a competent EU or EEA supervisory authority, including the authority in your habitual residence, workplace, or the place of the alleged infringement. In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

What the site does not do

• No FPL login is requested.
• No private FPL credentials are stored.
• No Clerk password is received or stored by FPL Mania.
• No payment card or billing data is collected.
• No automated decision-making under GDPR Article 22 is used.

Changes to this notice

FPL Mania may update this privacy policy as the product, hosting, or legal setup changes. Material updates should be reflected on this page before the changed processing begins.

Last updated: July 27, 2026.