Privacy & Terms

FPL Optimiser — last updated 16 August 2026

The short version

This is a private, invite-only tool run by one person for a small group of friends. It is free, carries no advertising, and makes no money. It stores the least it can get away with: your email address, a hashed password, and the Fantasy Premier League squad you choose to save. Nothing is sold, shared or sent to anyone else.

Who is responsible

This site is operated by a private individual. For anything on this page, including a request to see or delete your data, contact the person who invited you — they run the site.

What is stored, and why

Data	Why	Lawful basis
Email address	Identifies your account and lets you reset your password	Contract — you cannot have an account without it
Password (hashed)	Signs you in. Stored as a PBKDF2-SHA256 hash with a per-user salt; the password itself is never written down and cannot be recovered, only replaced	Contract
Your saved squad, purchase prices, bank and free transfers	The tool cannot advise on a team it does not know	Contract
Your "inside information" notes	Adjusts projections for what you know that the model does not	Contract
Session records	Keeps you signed in for 30 days	Contract
Authentication log — time, IP address, outcome	Diagnosing sign-in problems and spotting repeated failed attempts	Legitimate interests — keeping accounts secure

What is not done

• No advertising, and no advertising or analytics cookies.
• No third-party trackers, no analytics service, no social media pixels.
• Your data is never sold, rented or shared.
• No profiling and no automated decisions with legal effects.
• No marketing email. The only email sent is a password reset or an invite you asked for.

Cookies

Two, both strictly necessary, so no consent banner is required:

• fpl_session — keeps you signed in. Expires after 30 days.
• fpl_csrf — blocks another site from acting on your behalf. Expires when the browser closes.

How long it is kept

Your account and its data are kept until you delete them. Sessions expire after 30 days. Authentication log entries are short-lived and only useful for troubleshooting. Deleting your account removes everything immediately.

Your rights

Under UK GDPR you may see, correct, export, or delete your data, and object to its processing. Two of these are built in and need no request:

• Export — Account → EXPORT downloads everything held about you as JSON.
• Delete — Account → DELETE permanently removes your account and all of its data. It cannot be undone.

If you are unhappy with how your data has been handled you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Traffic is encrypted with HTTPS. Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations and a per-user salt. Session tokens are stored hashed. Each account's data lives in its own directory and no request can reach another account's. Repeated failed sign-ins lock an account temporarily.

No system is perfectly secure. This is a hobby project run on a single server, not a bank. Please do not reuse an important password here.

Where the data comes from

Player, fixture and scoring data comes from the Fantasy Premier League game, published by the Premier League at www.premierleague.com; all rights in it are theirs and are reserved. Their terms apply to that material and to your use of it, and you confirmed as much when you signed up: this tool is for your own private and personal use. Match results come from football-data.co.uk.

This site is independent and is not affiliated with, endorsed by, or connected to the Premier League, Fantasy Premier League, or any football club.

Terms of use

• Invite-only, personal use, no charge and no warranty.
• Projections are estimates. Football is largely unpredictable and the model is wrong often. Nothing here is advice of any kind, and no result is promised.
• Do not share your account, and do not republish or redistribute the data the site shows you.
• Accounts that abuse the service may be removed.

← Back to FPL Optimiser