Privacy policy

Introduction

This policy applies to information processed through the Touchline website and its account, league-analysis and subscription features. It explains what information is used, the purposes of that use and the choices available to you.

Account and league information

When you sign in, we process account identifiers and the profile information supplied by your sign-in method, such as your email, display name and profile image. We use Firebase Authentication and store account-linked settings to support access across devices. League IDs, entry IDs, saved connections and planning preferences help us display your selected league and personalise the service. Public league data can include team and manager names.

Browser storage and private league access

Guest settings and draft plans are saved in localStorage. Cached Decision Room data is saved in IndexedDB to speed up return visits. If you provide an FPL session cookie for a private league, it is stored locally and forwarded through our server to the upstream FPL service for authorised requests; it is not synced to your Touchline account or persisted by our server. Clear site data to remove local settings and cached content. Doing so does not delete server-held account or billing records.

Payments

Paddle processes checkout and payments as merchant of record. We receive customer, transaction and subscription information needed to connect purchases to your account and provide paid access. Card details are entered into Paddle’s checkout. Paddle’s own processing is described in its Privacy policy.

Usage information and analytics

Touchline uses Google Analytics through Firebase, and Microsoft Clarity for session recordings and heatmaps, to measure visits and product interactions. Identified analytics runs only after you accept analytics in the cookie banner shown on your first visit, and nothing is sent to Microsoft before that choice. Once accepted, events and recordings can include a browser visitor identifier, signed-in user identifier, league and entry IDs, page paths, on-screen interactions and actions such as opening a feature or completing a form. These identifiers mean analytics should not be treated as anonymous. Google and Microsoft may also process device and network information. You can withdraw consent at any time from "Cookie preferences" in the site footer, which stops further analytics collection; browser controls can also restrict cookies and storage, and clearing site storage resets locally stored identifiers.

Advertising measurement

Touchline advertises on Google Ads, X (formerly Twitter), Reddit, Meta and ChatGPT (OpenAI) and uses Google Consent Mode to measure which ads lead to sign-ups. Google Tag Manager loads only after you accept analytics or advertising in the cookie banner. The X, Reddit, Meta and OpenAI pixels fire only if you accept advertising; they may tell those platforms which pages you viewed and whether you signed up, so they can measure and optimise ads. With advertising consent, a new registration is also sent to OpenAI from our server, with the ad-click and browser references when available; the browser and server events share an ID so they can be counted once. This event does not include your email, account ID or saved league details. If you decline or have not yet chosen, Google sets no cookies; it receives only cookieless signals — that a page was viewed or an account was registered, with the page address, ad-click reference and device and network information — without our visitor, user, league or entry identifiers. Google uses these signals to estimate ad performance in aggregate. Touchline shows no ads and does not use your data for ad personalisation. Change your choice any time from "Cookie preferences" in the site footer.

Marketing communications

When you create an account, you can optionally check a box to receive occasional Touchline product updates and tips by email. This is off by default and separate from the analytics cookie choice above. We record your choice at that moment; it is not requested again on a later sign-in to the same account. We do not currently send marketing email, and checking the box does not add you to any list run by a third party. To change a choice you already made, contact support@fpldraft.me.

AI-assisted recommendations

Draft pick recommendations and Equinox squad/waiver analysis are generated using OpenAI.

Why we process information

We use information to deliver requested features, authenticate accounts, sync settings, manage subscriptions, respond to support requests, maintain security and understand product usage. Where applicable, processing is based on performing our contract with you, compliance with legal obligations, legitimate interests in operating and protecting the service, or consent where required. You may object to processing based on legitimate interests and withdraw consent where consent is the basis.

Service providers and international processing

We use the following processors to run Touchline. Each receives only the data needed for its function and may process it outside your country, subject to that provider’s own transfer safeguards and terms:

• Hetzner
• Google / Firebase
• Microsoft Clarity
• Paddle
• OpenAI

Information may also be disclosed where legally required or necessary to protect the service and users.

Retention and security

Local settings remain until removed or cleared by your browser. We retain account settings and service records while needed to provide your account and related features, and may retain relevant records afterwards for legal obligations or dispute resolution. Saved Equinox reports are overwritten by each new analysis rather than retained as an unlimited archive. We use access controls and other safeguards to protect information, but no online service can guarantee absolute security.

Your choices and rights

Depending on your location, you may request access, correction, deletion, restriction or portability of personal data, or object to certain processing. Contact support@fpldraft.me; we may need to verify your identity. You can also complain to the relevant data-protection authority. Account deletion does not itself cancel a Paddle subscription, and some records may remain where required by law.

Updates

We will update this notice when our processing changes and display its effective date. Material changes will be communicated where required.