coachme

Privacy Policy

Last updated: 12 October 2026

This policy covers the coachme website at fplcoachme.com and the coachme apps for iOS and Android. The apps present the same service as the website, so unless we say otherwise, everything here applies to both.

1. Who we are

coachme is operated by COACHMEFPL AS, organisation number 937332718, registered at Eiganesveien 76, 4009 Stavanger, Norway. We are the data controller for the personal data described in this policy.

You can reach us about anything in this policy at privacy@fplcoachme.com.

2. What data we collect

  • Account information: Your email address and name, from Google sign-in, Sign in with Apple, or email and password. If you use Sign in with Apple and choose to hide your email, we only ever see Apple's private relay address. During onboarding we also ask for your age, so we can confirm you meet our minimum age requirement — see section 12.
  • FPL team data: Your Fantasy Premier League team ID and squad data, fetched from the public FPL API with your permission. We never ask for your FPL password and cannot make changes to your FPL team.
  • Your settings: Risk preference, locked players, notification preferences, and onboarding progress.
  • Referral programme: Your own referral code. If you used a friend's code, we store a record linking your account to theirs and the date you first subscribed. It is used only to work out whether — and when — your friend has earned their reward.
  • Push notification identifiers: On the web, a browser push endpoint. In the iOS and Android apps, a device token issued by Firebase Cloud Messaging. Both are stored only if you opt in, and only so we can deliver deadline reminders and gameweek alerts.
  • Technical data: IP address, device and operating system type, app version, and browser type. This reaches our servers as an unavoidable part of serving requests, and is used for security, rate limiting, abuse prevention, and diagnosing faults.
  • Diagnostic and crash data: If the app or site errors, we record what went wrong — error type, stack trace, app version, and the account it happened to — so we can fix it.
  • Usage data: Pages visited and features used. What gets collected here depends on your cookie choice — see section 6 for exactly who receives what.
  • Payment data: If you buy a paid plan on the website, Stripe processes your card details. We never see or store your card number. We store your Stripe customer ID and subscription status. If you subscribe in the iOS app, Apple handles the payment and RevenueCat tells us which plan you hold; we store that plan, its status and your RevenueCat customer ID (which is your coachme account ID), never your Apple payment details.
  • Marketing preferences: Whether you have agreed to receive marketing email from us, and when.
  • Waitlist email: If you sign up for the waitlist before creating an account, we store your email address.

3. How we use your data, and why we're allowed to

Under the GDPR we need a legal basis for each thing we do with your data. Here is ours, purpose by purpose.

  • Running your account and delivering predictions, captain picks, and transfer suggestions — necessary to perform our contract with you.
  • Syncing and displaying your FPL squad — necessary to perform our contract with you.
  • Taking payment and managing your subscription — necessary to perform our contract with you.
  • Sending deadline reminders and gameweek summaries — your consent, given when you enable notifications. You can withdraw it at any time in your notification settings or in your device settings.
  • Marketing email — captain picks, tips and offers, including occasional service-related promotional messages such as a note when your free trial ends. Your consent, given by ticking the opt-in box (it is never pre-ticked) or turning the setting on in your profile. Every marketing email has a one-click unsubscribe link, and you can also turn it off in your profile at any time.
  • Keeping the service secure, preventing abuse, and fixing faults — our legitimate interest in operating a working, non-abused service.
  • Aggregate page-view and performance statistics — our legitimate interest in knowing the site works. See section 6.
  • Advertising measurement — your consent. It runs on the website only, and only if you accept. See section 6.
  • Product analytics — your consent, on the website and in the iOS and Android apps alike. It runs only if you accept. See section 6.
  • Improving our prediction models — our legitimate interest in improving the service. Model training uses match and player performance data, which is not personal data. Where we look at how the service is used, we work with aggregated figures rather than individual accounts.

4. Who processes your data for us

We use the following providers to operate coachme. Each of them processes data on our instructions under a data processing agreement.

  • Supabase: Authentication and database hosting.
  • Vercel: Web application hosting, plus cookieless analytics and performance monitoring.
  • Railway: Hosting for our prediction service.
  • Upstash: Redis caching and rate limiting. Rate limiting processes your IP address (or account ID) so we can stop abuse.
  • Sentry: Error monitoring. When something breaks on the website, in the apps or on our servers, Sentry receives the error details, browser or device type and app version. We configure it not to collect names, email addresses, cookies or request contents, and to strip email addresses and tokens from error text.
  • Google Firebase Cloud Messaging: Delivery of push notifications to the iOS and Android apps. Firebase receives your device token and the notification content.
  • Google: OAuth sign-in. We receive your email and name and nothing else. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its limited use requirements.
  • Apple: Sign in with Apple, delivery of push notifications to iOS devices, and payment for subscriptions bought in the iOS app.
  • RevenueCat: Manages subscriptions bought in the iOS app. It receives your coachme account ID and your App Store purchase records, and tells us which plan you hold.
  • Stripe: Payment processing for paid plans bought on the website.
  • Resend: Email delivery — transactional email, such as account and deletion confirmations, and marketing email if you have opted in.
  • PostHog: Product analytics, EU-hosted. Only if you accept analytics cookies — see section 6.
  • Meta: Advertising measurement and retargeting via the Meta Pixel, on the website only. Only if you accept advertising cookies — see section 6.
  • TikTok: Advertising measurement and retargeting via the TikTok Pixel, on the website only. Only if you accept advertising cookies — see section 6.

5. Where your data goes

Our database and our product analytics are hosted in the EU. Some of the providers above are based in the United States or may process data outside the EEA — this includes Vercel, Stripe, Google, Apple, RevenueCat, Sentry, Resend, Upstash, Railway and, if you consent to advertising cookies, Meta and TikTok. Where data leaves the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses, by the provider's certification under the EU–US Data Privacy Framework, or by both.

6. Cookies & tracking

Four things run on this site that are worth being specific about. Three of them only run if you say yes.

The iOS and Android apps work a little differently. The Meta and TikTok advertising pixels never run there at all, so the app asks only about analytics: PostHog product analytics runs in the app only if you accept — see the PostHog note below. Everything else in this section describes the website.

Essential cookies — always on

Supabase authentication session cookies. These are what keep you signed in. Without them the service can't work, so there's nothing to opt out of. We also store your cookie choice itself on your device, so we don't have to keep asking.

Referral link storage — only if you arrive on a referral link

If you follow a friend's invite link, we store the referral code in it on your device so it is still there if you sign up later: a first-party cookie named coachme_ref, and an entry named coachme-fpl-referral-ref in your browser's local storage. Both hold nothing but the code, both expire after 30 days, and neither is sent to anyone else or used to track you. They are removed once the code has been applied to your account.

Vercel Analytics — always on, no cookies

Aggregate page-view and performance statistics: which pages get visited, how fast they load, roughly where in the world traffic comes from. It sets no cookie, assigns you no identifier, and cannot follow you to other sites or be used to build a profile of you. We run it under legitimate interest to keep the service working, which means it isn't part of the consent choice below. It is also the only one of the four that runs if you reject.

PostHog — only with your consent

Product analytics, so we can see which features managers actually use and where people get stuck. It sets a first-party cookie holding a random ID, and records page views and when you leave a page, plus named events for key steps: signing up, connecting an FPL team, starting a free trial, and moving through and using the squad builder. Once you are signed in, these events are linked to your coachme account ID. Automatic click-tracking and session recording are switched off, so we are not capturing your screen or your keystrokes. PostHog requests are served from our own domain rather than PostHog's, so they travel as first-party requests and arrive reliably; the data still goes to PostHog, who process it on our behalf on EU infrastructure.

On the website and in the iOS and Android apps this runs only after you accept. The apps ask with their own prompt, which covers analytics only, and use the same minimal setup (no click-tracking, no session recording). If you reject or don't answer, PostHog is never loaded in the app. The advertising pixels below never run in the app, so nothing there tracks you across other companies' apps or websites.

Meta Pixel — website only, and only with your consent

Advertising. This is the one that does what people mean by “tracking”. It tells Meta (Facebook and Instagram) that a browser visited our website and whether it signed up, so we can measure whether our ads work and show ads to people who've been here before or who resemble our visitors. Meta can link that visit to your Facebook or Instagram account if you have one, and the data goes to Meta in the US under their own privacy policy. We do not send them your email, your name, or anything about your FPL team.

The Meta Pixel does not run inside the coachme iOS or Android apps. We do not track you across other companies' apps and websites from within the apps at all.

TikTok Pixel — website only, and only with your consent

Advertising, and the same kind of tracking as the Meta Pixel. It tells TikTok that a browser visited our website and whether it signed up, so we can measure whether our ads work and show ads to people who've been here before or who resemble our visitors. TikTok can link that visit to your TikTok account if you have one, and the data goes to TikTok in the US under their own privacy policy. We do not send them your email, your name, or anything about your FPL team.

The TikTok Pixel does not run inside the coachme iOS or Android apps. Like the Meta Pixel, it is loaded only on the website, and only after you accept advertising cookies.

Rejecting is a real reject: PostHog, the Meta Pixel and the TikTok Pixel are never downloaded or executed, not merely told to stay quiet. Nothing loads before you choose, and ignoring the banner counts as a no. You can change your mind whenever you like:

7. Notifications

Notifications are entirely optional and off until you turn them on. When you do, we store a push identifier for that browser or device so we can send deadline reminders and gameweek summaries. Pre-deadline reminders are available on the free plan too; like every push, they are only sent if you have turned notifications on and given your browser or device permission. Turning notifications off in coachme, or revoking permission in your browser or device settings, stops them and we delete the identifier.

8. Data storage & security

Your data is stored in a Supabase-hosted PostgreSQL database in the EU, protected by row-level security policies so that one account cannot read another's data. All data is encrypted in transit via TLS and at rest. We never sell your personal data.

We also never share your account details, email address, or FPL squad with advertisers. The one exception to “we don't share anything for marketing” is the Meta Pixel and the TikTok Pixel described in section 6: if — and only if — you accept advertising cookies on the website, Meta and TikTok learn that your browser visited it and whether it signed up. That is browsing data, not account data, and it stops the moment you reject or withdraw consent.

9. Data retention

  • Account data, settings, and FPL squad data: Retained until you delete your account.
  • Waitlist emails: Retained until you unsubscribe, or removed after onboarding.
  • Referral records: Retained for as long as the accounts involved exist, since a reward earned by a referrer is a permanent fact about their account. If a referred account is deleted, its referral record is anonymised — the link to the deleted account is removed and only the reward it earned remains.
  • Notification logs: Automatically deleted after 90 days.
  • Player change history: Automatically deleted after 30 days.
  • Diagnostic and crash data: Kept only in our hosting provider's operational logs, not in our own database, and retained according to their log retention schedule.
  • Payment and billing records: Retained for as long as Norwegian accounting law requires, currently five years from the end of the financial year. This is a legal obligation and survives account deletion.

10. Deleting your account

You can delete your coachme account and its data at any time, from inside the app or on the web:

  • In the app or on the website, signed in: Profile → Delete account. This removes your account immediately.
  • On the web, without signing in: submit a deletion request at fplcoachme.com/account-deletion, which we verify and process within 30 days.

Deleting your account cancels any active paid plan you bought on the website (through Stripe), so it won't renew; we don't refund the period you've already paid for. It cannot cancel a subscription bought in the iOS app, because Apple bills it: cancel that in Settings › Apple ID › Subscriptions. Deletion permanently removes your profile, settings, FPL team link, squad data, saved recommendations, and push identifiers. This cannot be undone. The only things that survive are billing records we are legally required to keep, as described in section 9, and aggregated statistics that can no longer be linked to you.

11. Your rights

Under the GDPR you have the right to:

  • Request a copy of the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and all associated data — see section 10.
  • Request your data in a machine-readable format.
  • Object to, or ask us to restrict, processing based on legitimate interest.
  • Withdraw consent at any time — for cookies, use the “Change cookie settings” button in section 6, which works in the app too; for notifications, use your notification settings; for marketing email, use the unsubscribe link in any email or your profile. Withdrawing consent doesn't affect processing that already happened.

To exercise any of these, email privacy@fplcoachme.com. We will respond within one month.

If you think we've handled your data badly, please tell us first — but you also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no), or to the supervisory authority in the EEA country where you live.

12. Children

coachme is not intended for children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, email us and we will delete it.

13. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

14. Contact

COACHMEFPL AS, Eiganesveien 76, 4009 Stavanger, Norway. privacy@fplcoachme.com.