Privacy Policy

Last updated: 25 October 2026

This policy explains what MyFantasyPlan stores about you and why. The controller is Gediminas Butkus, Vilnius, Lithuania, bugedas@gmail.com.

What we store

Account: your email address and a securely hashed password, or, if you sign in with Google, your Google account ID and email.
Where you came from: if you create an account after following a link from one of our public pages (such as the captain picks), the address of that page, so we can tell which pages are useful. It is kept with your account and deleted with it.
Your team per round: the players and lineup of the team you save, for each round, so we can show it on your devices and score your round report and season. A saved team carries over to the next round by itself.
Your preferences: your team’s name, the players you watch, the club you support (if you choose one, when you sign up or in your account’s settings) and the language you choose while signed in, so the site shows them on every device you sign in on.
Which features you use: for each round, how many times you visit the site while signed in, open the MyFantasyPlan team and ask My team for a best team or changes, and when you first and last did, so we can tell which features are useful. It is kept with your account and deleted with it.
Saved copies: the names, players and budgets of the copies of a team you save in the team builder (up to 3).
Email preferences: which emails you want (each is off unless you turn it on), the site’s language and your browser’s time zone when you last changed them, so we write in your language and your time, and which of them we last sent.
Subscription: your Paddle customer and subscription IDs, the subscription status and when the current period ends. Paddle handles payment details; we never see your card number.
Technical logs: our hosting and database providers keep short-lived logs (such as IP address and browser type) for security and debugging.
Visit statistics: anonymous counts of visits (the page, the site that linked here, country, browser and device type), collected by Vercel Web Analytics without cookies. Visitors are counted with a hash of the request that is discarded within 24 hours, so nothing identifies you or follows you to other sites. Sign-in links’ tokens are removed before anything is sent. We also count visitors a day ourselves, in our database, the same way: one line per visitor and day, made from a hash of your IP address and browser with a secret that changes every day and is deleted once the day is over, with the first page you opened, the site that linked here and whether your screen is a touch screen. Nothing is stored in your browser, and two days of visits can’t be linked to each other or to you. These lines are deleted after 400 days.

Without an account, we keep nothing about you apart from those logs and the anonymous visit statistics. A team you build without an account is on the page only: it is gone when you reload or close the page. One exception: if you sign in or create an account in a way that leaves the page (a new account whose email has to be confirmed first, or Google’s own sign-in page), the team waits in your browser for up to an hour so that it can go into the account. Your browser also keeps the language you choose while not signed in, the address of the public page you last followed into the planner (for 30 days, and sent to us only if you create an account) and, when signed in, your login session and a copy of your saved teams. Your team’s name, your watchlist and the language you choose while signed in are kept with your account, not in your browser: without an account there is no team name or watchlist. Nothing about your team is saved until you press Save. We use no advertising trackers and no tracking cookies. Paddle’s checkout may use its own cookies to process payments and prevent fraud.

Why we use it

To run your account and save your teams, and to provide Premium (performing our contract with you).
To keep the service secure and working (our legitimate interest).
To see how many people visit and where they come from, from anonymous statistics (our legitimate interest).
To keep payment and tax records, which Paddle does as the Merchant of Record (legal obligation).

We don’t sell your data or use it for advertising.

Who processes it for us

Supabase: database and sign-in (region: West Europe, London, United Kingdom).
Paddle: payments, invoices and taxes, as Merchant of Record. See Paddle’s privacy notice.
Google: sign-in with Google. When you open the sign-in window, Google’s sign-in button loads from Google’s servers; Google shares your account ID and email with us only if you choose “Continue with Google”.
Resend: sends the emails you turn on (before deadlines, round results, news about your players). Every email has a link to turn them off.
Vercel (Vercel Inc., USA): serves the website and counts visits anonymously (Web Analytics, no cookies).

Some of these providers may process data outside the EU/EEA; they do so under the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep it

Until you delete your account. “Delete account…” in the account menu removes your account and saved teams and subscription records from our database straight away and cancels any active subscription. Paddle keeps its transaction records for as long as tax law requires.

Your rights

You can ask for a copy of your data, correct it, delete it, move it elsewhere or object to how we use it: email bugedas@gmail.com. You can also complain to your data-protection authority (in Lithuania, the State Data Protection Inspectorate, vdai.lrv.lt, or the one in the country where you live).

Children

The service is not meant for children under 16.

Changes

We will post updates here and change the date above. Important changes will be announced on the site or by email.