Last updated 8 September 2026
Privacy policy
This policy explains what personal data we hold, why we hold it, and how you can exercise your rights. It is written for the UK GDPR and the Data Protection Act 2018.
1. Who is the controller
FPL Desk is operated by Greig Dunbar, trading as FPL Desk, from the United Kingdom.
19 Curlew Drive
Dumfries
DG1 3TP
ICO registration: ZC240680.
Email: hello@fpldesk.com · Privacy: privacy@fpldesk.com
For UK GDPR purposes, the controller of your personal data is the operator named above. If you have a privacy question, email privacy@fpldesk.com.
2. Data we collect
We collect:
- Account data: your name, email address, password hash (we never store your password in plain text), and whether your email is verified.
- Google sign-in data. If you use Google, we receive the identifier, name, email and (where provided) profile image that Google shares with us.
- League data: the FPL classic league ID, desk name and crest, pot rules, invite code, membership and role, and the FPL entry ID you claim.
- Invite emails. When an admin pastes addresses to invite people, we hold those addresses for long enough to send the join link.
- Session data: a session token, its expiry, and where available your IP address and browser user agent. We use these to keep you signed in and to spot abuse.
- FPL public data. Team names, manager names, points, chips, picks and related fields for leagues you wrap or join. That data is already public on FPL; we cache it and display it.
- Payment data. When you subscribe, Stripe processes the payment. We keep the Stripe customer and subscription IDs, the billing status and the current period end. We never see or store card numbers.
- Referral data: if you share or follow a referral link, the code and who referred whom, so we can apply the free month.
- Site measurement. When you view a public page such as the homepage or the pricing page, we record which page it was, any campaign tag in the link, and the website that referred you. To count a visitor once per day without storing anything on your device, we turn your IP address and browser user agent into a short one-way hash with a secret that changes every midnight (UTC). We do not keep the IP address itself, the hash cannot be reversed, and yesterday’s hashes cannot be matched to today’s — so this cannot follow you between days or between devices, and it is never linked to your account.
- Support. Whatever you send to our email addresses.
We do not ask for FPL passwords, payment-card details on our own forms, or special-category data.
3. How we use data and our lawful bases
- Contract. Creating and securing your account, running the desk, sending password-reset, email-verification and billing messages, applying free trials, referral credits, and managing the admin’s subscription when billing is on.
- Legitimate interests: keeping the service secure, preventing abuse, debugging, and understanding whether the product works. We balance these against your rights.
- Consent. Optional emails that are not needed to run the service. We do not currently send any marketing, and you can withdraw consent at any time.
- Legal obligation: records we are required to keep, including tax and accounting records if you pay us.
5. International transfers
Your account, league and membership records are stored and processed in the United States (San Francisco).
Railway, Resend, Stripe and Google are United States companies, and each may process data outside the UK in the course of providing their service. Where that happens we rely on the UK adequacy regulations for the US (the UK-US data bridge) where the provider is certified, and otherwise on the International Data Transfer Addendum to the standard contractual clauses.
If you want to know where a particular provider processes your data, email privacy@fpldesk.com and we will tell you what we know.
6. How long we keep data
- Account and membership data — until you delete the account, plus a short backup window.
- League desks — until the admin deletes the league, or we close it after unpaid invoices.
- Sessions — until they expire or you sign out.
- Verification and reset tokens — until they expire (typically one hour).
- Invite email lists we send — only as needed to deliver the message and handle bounces.
- Site-measurement records — 180 days, then deleted automatically.
- Billing records — as required by UK tax law (usually six years).
7. Security
We use hashed passwords, HTTPS, session cookies marked Secure in production, and access controls on the database. No method of transmission or storage is perfectly secure. Tell us at privacy@fpldesk.com if you think there has been a breach involving your account.
8. Your rights
Under UK GDPR you can ask to:
- access a copy of your personal data;
- correct inaccurate data;
- erase data in certain cases;
- restrict or object to certain processing;
- receive data you provided in a portable format;
- withdraw consent where we rely on it.
You can update your name and password, and delete your account, in the product. For anything else email privacy@fpldesk.com. We may need to verify it is you.
You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would like the chance to fix the issue first.
9. Children
The service is not aimed at children under 16. We do not knowingly create accounts for them. If you think we have, email us and we will delete the account.
11. Automated decisions
We do not make solely automated decisions that have legal or similarly significant effects on you. Live rankings and pot projections are calculations from public FPL scores, not credit or eligibility decisions.
12. Changes
We may update this policy. The “last updated” date will change. Material changes will be flagged in the product or by email where we have a working address for you.