Privacy Policy

Information you give us when you create an account:

• Your email address, which you use to sign in and which we use to verify your account and send account emails.
• Your password. It is handled by our sign-in provider (Amazon Cognito), which stores it in hashed form. We never see or store your password in readable form.
• A username, generated from your email address and shown on your profile.

Information you create while playing: your fantasy team name and squad, captain choices, transfers, boosters used, points and rankings, and the leagues you create or join (including league names and invite codes). Your team name, username and scores are visible to other players on leaderboards and in leagues you join.

Information collected automatically:

• Your IP address and basic request details (such as the time of the request and the page or feature used), which our servers log to keep the Service running, to limit abuse such as repeated failed sign-in attempts, and to keep a security record of account actions such as sign-ins, password changes and account deletion.
• Anonymous, aggregated usage and performance statistics on the website (Vercel Web Analytics and Speed Insights). These tools do not use cookies and do not identify you personally.
• On the mobile apps, technical information such as your device's operating system and the app version, which is sent when the app checks for and downloads updates.
• If you allow notifications in the mobile app, a push notification token for your device. We use it only to send you notifications from us (for example that a new gameweek is open). It is removed when you sign out or delete your account, and you can turn notifications off in your phone's settings.

We do not collect your location, contacts, photos, camera or microphone input, payment details, or any government ID. If you email our support team, we receive your email address and whatever you choose to include in your message.

• To create and secure your account, sign you in, and let you reset your password.
• To run the game: save your team, calculate points, and show leaderboards and league standings.
• To send you service emails, such as verification codes and password resets. We do not send marketing emails.
• To protect the Service and our players: rate limiting, detecting abuse and cheating, and investigating security issues.
• To understand, in aggregate, how the Service is used so we can fix problems and improve it.
• To answer your support requests and to comply with the law.

Where data-protection laws require a legal basis, we rely on performing our agreement with you (running your account and the game), our legitimate interests (keeping the Service secure and working), and our legal obligations.

The website uses strictly necessary cookies to keep you signed in. They are not used for advertising or tracking across other sites. If you choose "Remember my email" or a light/dark theme, that preference is saved in your browser's local storage on your own device. The mobile apps keep your sign-in tokens in your device's secure storage (Keychain on iOS, Keystore-backed storage on Android).

We share personal information only with service providers that host and run the Service for us:

• Amazon Web Services (account sign-in, account emails, database hosting and abuse protection).
• Vercel (website and API hosting, server logs, and cookieless analytics).
• Expo (delivery of mobile app updates).

These providers may process data in the United States and other countries where they operate. They may use the data only to provide their services to us. We may also disclose information if required by law, to protect the rights and safety of our players or the public, or as part of a merger or transfer of the Service, in which case this policy will continue to apply. We do not sell or rent personal information, and we do not share it for targeted advertising.

We keep your account and game data for as long as your account exists. When you delete your account, we immediately and permanently delete your account, sign-in credentials, team, transfers, points history and league memberships. A minimal security record that your account was deleted, including the email address and username it used, is kept for security, fraud-prevention and legal purposes. Server logs are kept for a limited period by our hosting provider and then deleted automatically.

You can delete your account at any time, from the Profile screen in the app or the Profile page on the website. See how to delete your account for step-by-step instructions, including what to do if you can no longer sign in.

Depending on where you live, you may also have the right to access a copy of your data, correct it, object to or restrict how we use it, or receive it in a portable format. To make any of these requests, email support@nplfantasy.com from the address on your account. We will respond within 30 days. You may also complain to your local data-protection authority.

We use encrypted connections (HTTPS) for all traffic, store data in access-controlled databases, and rely on a dedicated identity provider for passwords. No service can be perfectly secure, so please use a strong password that you don't use elsewhere.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us at support@nplfantasy.com and we will delete it.

We may update this policy as the Service changes. We will change the "Last updated" date above and, for significant changes, let you know in the app or by email before they take effect.

Questions about this policy or your data? Contact NPL Fantasy at support@nplfantasy.com.