coachme

Privacy Policy

Last updated: 17 August 2026

This policy covers the coachme website at fplcoachme.com and the coachme apps for iOS and Android. The apps present the same service as the website, so unless we say otherwise, everything here applies to both.

1. Who we are

coachme is operated by COACHMEFPL AS, organisation number 937332718, registered at Eiganesveien 76, 4009 Stavanger, Norway. We are the data controller for the personal data described in this policy.

You can reach us about anything in this policy at privacy@fplcoachme.com.

2. What data we collect

  • Account information:Your email address and name, from Google sign-in, Sign in with Apple, or email and password. If you use Sign in with Apple and choose to hide your email, we only ever see Apple's private relay address. During onboarding we also ask for your age, so we can confirm you meet our minimum age requirement — see section 12.
  • FPL team data: Your Fantasy Premier League team ID and squad data, fetched from the public FPL API with your permission. We never ask for your FPL password and cannot make changes to your FPL team.
  • Your settings: Risk preference, locked players, notification preferences, and onboarding progress.
  • Push notification identifiers: On the web, a browser push endpoint. In the iOS and Android apps, a device token issued by Firebase Cloud Messaging. Both are stored only if you opt in, and only so we can deliver deadline reminders and gameweek alerts.
  • Technical data: IP address, device and operating system type, app version, and browser type. This reaches our servers as an unavoidable part of serving requests, and is used for security, rate limiting, abuse prevention, and diagnosing faults.
  • Diagnostic and crash data: If the app or site errors, we record what went wrong — error type, stack trace, app version, and the account it happened to — so we can fix it.
  • Usage data: Pages visited and features used. What gets collected here depends on your cookie choice — see section 6 for exactly who receives what.
  • Payment data: If you subscribe to Pro, Stripe processes your card details. We never see or store your card number. We store your Stripe customer ID and subscription status.
  • Waitlist email: If you sign up for the waitlist before creating an account, we store your email address.

3. How we use your data, and why we're allowed to

Under the GDPR we need a legal basis for each thing we do with your data. Here is ours, purpose by purpose.

  • Running your account and delivering predictions, captain picks, and transfer suggestions — necessary to perform our contract with you.
  • Syncing and displaying your FPL squad — necessary to perform our contract with you.
  • Taking payment and managing your subscription — necessary to perform our contract with you.
  • Sending deadline reminders and gameweek summaries — your consent, given when you enable notifications. You can withdraw it at any time in your notification settings or in your device settings.
  • Keeping the service secure, preventing abuse, and fixing faults — our legitimate interest in operating a working, non-abused service.
  • Aggregate page-view and performance statistics — our legitimate interest in knowing the site works. See section 6.
  • Advertising measurement — your consent. It runs on the website only, and only if you accept. See section 6.
  • Product analytics — on the website, your consent. In the iOS and Android apps, where there is no cookie banner, our legitimate interest in understanding how the app is used and where people get stuck; you can object at any time. See section 6.
  • Improving our prediction models — our legitimate interest in improving the service. Model training uses match and player performance data, which is not personal data. Where we look at how the service is used, we work with aggregated figures rather than individual accounts.

4. Who processes your data for us

We use the following providers to operate coachme. Each of them processes data on our instructions under a data processing agreement.

  • Supabase: Authentication and database hosting.
  • Vercel: Web application hosting, plus cookieless analytics and performance monitoring.
  • Railway: Hosting for our prediction service.
  • Upstash: Redis caching for performance.
  • Google Firebase Cloud Messaging: Delivery of push notifications to the iOS and Android apps. Firebase receives your device token and the notification content.
  • Google: OAuth sign-in. We receive your email and name and nothing else. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its limited use requirements.
  • Apple: Sign in with Apple, and delivery of push notifications to iOS devices.
  • Stripe: Payment processing for Pro subscriptions.
  • Resend: Transactional email, such as account and deletion confirmations.
  • PostHog: Product analytics, EU-hosted. Only if you accept analytics cookies — see section 6.
  • Meta: Advertising measurement and retargeting via the Meta Pixel, on the website only. Only if you accept advertising cookies — see section 6.
  • TikTok: Advertising measurement and retargeting via the TikTok Pixel, on the website only. Only if you accept advertising cookies — see section 6.

5. Where your data goes

Our database and our product analytics are hosted in the EU. Some of the providers above are based in the United States or process data there — this includes Vercel, Stripe, Google, Apple, and, if you consent to advertising cookies, Meta and TikTok. Where data leaves the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses, by the provider's certification under the EU–US Data Privacy Framework, or by both.

6. Cookies & tracking

Four things run on this site that are worth being specific about. Three of them only run if you say yes.

The iOS and Android apps work differently: there is no cookie banner in the app. The Meta and TikTok advertising pixels never run there at all, and PostHog product analytics runs as first-party analytics under our legitimate interest rather than behind a consent prompt — see the PostHog note below. Everything else in this section describes the website.

Essential cookies — always on

Supabase authentication session cookies. These are what keep you signed in. Without them the service can't work, so there's nothing to opt out of. We also store your cookie choice itself on your device, so we don't have to keep asking.

Vercel Analytics — always on, no cookies

Aggregate page-view and performance statistics: which pages get visited, how fast they load, roughly where in the world traffic comes from. It sets no cookie, assigns you no identifier, and cannot follow you to other sites or be used to build a profile of you. We run it under legitimate interest to keep the service working, which means it isn't part of the consent choice below. It is also the only one of the four that runs if you reject.

PostHog — only with your consent

Product analytics, so we can see which features managers actually use and where people get stuck. It sets a first-party cookie holding a random ID, and records page views plus a small number of named events — currently just “signed up” and “connected an FPL team”. Automatic click-tracking and session recording are switched off, so we are not capturing your screen or your keystrokes. PostHog requests are served from our own domain rather than PostHog's, so they travel as first-party requests and arrive reliably; the data still goes to PostHog, who process it on our behalf on EU infrastructure.

On the website this runs only after you accept. In the iOS and Android apps, where there is no cookie banner, it runs as first-party product analytics under our legitimate interest — the same minimal setup (no click-tracking, no session recording, page views plus the two named events above). You can object at any time by emailing privacy@fplcoachme.com. The advertising pixels below never run in the app, so nothing there tracks you across other companies' apps or websites.

Meta Pixel — website only, and only with your consent

Advertising. This is the one that does what people mean by “tracking”. It tells Meta (Facebook and Instagram) that a browser visited our website and whether it signed up, so we can measure whether our ads work and show ads to people who've been here before or who resemble our visitors. Meta can link that visit to your Facebook or Instagram account if you have one, and the data goes to Meta in the US under their own privacy policy. We do not send them your email, your name, or anything about your FPL team.

The Meta Pixel does not run inside the coachme iOS or Android apps. We do not track you across other companies' apps and websites from within the apps at all.

TikTok Pixel — website only, and only with your consent

Advertising, and the same kind of tracking as the Meta Pixel. It tells TikTok that a browser visited our website and whether it signed up, so we can measure whether our ads work and show ads to people who've been here before or who resemble our visitors. TikTok can link that visit to your TikTok account if you have one, and the data goes to TikTok in the US under their own privacy policy. We do not send them your email, your name, or anything about your FPL team.

The TikTok Pixel does not run inside the coachme iOS or Android apps. Like the Meta Pixel, it is loaded only on the website, and only after you accept advertising cookies.

Rejecting is a real reject: PostHog, the Meta Pixel and the TikTok Pixel are never downloaded or executed, not merely told to stay quiet. Nothing loads before you choose, and ignoring the banner counts as a no. You can change your mind whenever you like:

7. Notifications

Notifications are entirely optional and off until you turn them on. When you do, we store a push identifier for that browser or device so we can send deadline reminders and gameweek summaries. Turning notifications off in coachme, or revoking permission in your browser or device settings, stops them and we delete the identifier.

8. Data storage & security

Your data is stored in a Supabase-hosted PostgreSQL database in the EU, protected by row-level security policies so that one account cannot read another's data. All data is encrypted in transit via TLS and at rest. We never sell your personal data.

We also never share your account details, email address, or FPL squad with advertisers. The one exception to “we don't share anything for marketing” is the Meta Pixel and the TikTok Pixel described in section 6: if — and only if — you accept advertising cookies on the website, Meta and TikTok learn that your browser visited it and whether it signed up. That is browsing data, not account data, and it stops the moment you reject or withdraw consent.

9. Data retention

  • Account data, settings, and FPL squad data: Retained until you delete your account.
  • Waitlist emails: Retained until you unsubscribe, or removed after onboarding.
  • Notification logs: Automatically deleted after 90 days.
  • Player change history: Automatically deleted after 30 days.
  • Diagnostic and crash data:Kept only in our hosting provider's operational logs, not in our own database, and retained according to their log retention schedule.
  • Payment and billing records: Retained for as long as Norwegian accounting law requires, currently five years from the end of the financial year. This is a legal obligation and survives account deletion.

10. Deleting your account

You can delete your coachme account and its data at any time, from inside the app or on the web:

  • In the app or on the website, signed in: Profile → Delete account. This removes your account immediately.
  • On the web, without signing in: submit a deletion request at fplcoachme.com/account-deletion, which we verify and process within 30 days.

Deleting your account cancels any active Pro subscription and permanently removes your profile, settings, FPL team link, squad data, saved recommendations, and push identifiers. This cannot be undone. The only things that survive are billing records we are legally required to keep, as described in section 9, and aggregated statistics that can no longer be linked to you.

11. Your rights

Under the GDPR you have the right to:

  • Request a copy of the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and all associated data — see section 10.
  • Request your data in a machine-readable format.
  • Object to, or ask us to restrict, processing based on legitimate interest.
  • Withdraw consent at any time — for cookies, use the “Change cookie settings” button in section 6; for notifications, use your notification settings. Withdrawing consent doesn't affect processing that already happened.

To exercise any of these, email privacy@fplcoachme.com. We will respond within one month.

If you think we've handled your data badly, please tell us first — but you also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no), or to the supervisory authority in the EEA country where you live.

12. Children

coachme is not intended for children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, email us and we will delete it.

13. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

14. Contact

COACHMEFPL AS, Eiganesveien 76, 4009 Stavanger, Norway. privacy@fplcoachme.com.