Cookie policy

1. What cookies are

Cookies are small text files stored on your device by a website. Similar technologies include local storage. UK law (the Privacy and Electronic Communications Regulations, alongside UK GDPR) treats some of these as requiring information, and non-essential ones as requiring consent.

2. Who sets them

FPL Desk is operated by Greig Dunbar, trading as FPL Desk, from the United Kingdom.

19 Curlew Drive
Dumfries
DG1 3TP

ICO registration: ZC240680.

Email: hello@fpldesk.com · Privacy: privacy@fpldesk.com

3. Essential cookies we set

These are strictly necessary for the service. They do not require consent. Without them you cannot stay signed in, and a referral link cannot apply the free first month.

• Session cookie (set by our auth library, Better Auth) — a token that identifies your signed-in session. It is HTTP-only, and marked Secure in production. It lasts until the session expires or you sign out.
• Session metadata — we store the session against your account in our database, including expiry and, where available, IP address and user agent, so we can invalidate sessions and spot abuse.
• Referral cookie (fpldesk_ref) — if you open a referral link, we store their code for 60 days so we can apply the first month free when you start your own desk. It is HTTP-only, and marked Secure in production.

We do not set analytics, advertising, or social-media tracking cookies on fpldesk.com. If you dismiss the in-desk referral reminder, we store that choice in local storage on your device so we do not keep showing it; it is not sent to us and is not used to recognise you.

We do count page views, but without storing anything on your device: a visitor is counted once a day using a one-way hash of your IP address and user agent that is re-salted every midnight. Because nothing is written to your browser, there is nothing here for you to consent to or switch off. The privacy policy describes it in full.

4. Third-party cookies

If you choose Continue with Google, Google will set its own cookies on Google’s domains as part of sign-in. That is Google’s processing, governed by Google’s privacy policy. You do not have to use Google sign-in; email and password works without it.

The public Fantasy Premier League API is requested by our servers, not by a tracking pixel in your browser.

5. How to control cookies

You can delete cookies in your browser settings, or block them. If you block essential cookies, sign-in will not work, and a referral link will not remember who invited you.

Most browsers explain how to do this in their help pages (search for “clear cookies” plus your browser name). On a shared device, sign out when you are finished.

6. Changes

If we later add non-essential cookies (for example privacy-friendly analytics), we will update this policy and, where the law requires it, ask for consent before setting them.

More on personal data: privacy policy. Questions: privacy@fpldesk.com.