Privacy policy

Draft. The operator's details and the hosting provider will be named before publication. The list below was checked against the server API description of 30 September 2026 and is updated before data collection changes.

In short

• We store your email, a password hash, the log of calculations and tokens, and service identifiers used against abuse.
• Your club contents go to the server only for the duration of a calculation and are not written to the database.
• The EA club identifier is stored only as an irreversible hash.
• The extension does not read EA passwords, cookies or login data and does not send them anywhere.
• The server never contacts EA's servers.
• There are no third-party trackers or ad networks on the site.

What is collected

Data	Source	Purpose	Retention
Email and password hash (scrypt)	Registration	Sign-in, password reset, payment emails	While the account exists
Sessions: token hash, expiry, last use	Sign-in	Keeping you signed in on 3 devices	60 days without use, or until sign-out
Install identifier: a random UUID the extension creates on first run	Extension	Seeing several accounts in one browser	While the account exists
Hash of the EA club identifier (HMAC with a server key) and platform	Every calculation	Starting tokens once per club; links between accounts	Indefinitely: otherwise a new account would receive free tokens again
Club contents and challenge requirements: card IDs and attributes, without player names or squad names	Every calculation	The calculation itself	Only in server memory for the duration of the calculation; the result for up to 1 hour; on disk as a temporary file while the solver runs
Card prices	Loaded by the extension from FUT.GG and sent with the task	Top-up calculation	With the task
Calculation record: challenge, number of stages, state, outcome, price, payment method, duration	Every calculation	History, token charging, free repeat	While the account exists
Token ledger: credits and charges with reasons	Calculations, purchases, bonuses	Balance	While the account exists
Security events: registration, sign-in, failed sign-in, sign-out, password change and reset, account deletion — with time, IP address and install identifier	Account actions	Protection against brute force, abuse review	12 months; after account deletion the records lose their link to it
Server request log: path, response code, time, IP address. The authorization header, email, passwords, tokens, codes and club data are stripped from it	Every request	Failure diagnostics	30 days
Support requests: email, text, optionally a diagnostics file from the extension	Site form	Answering the request	12 months after closing
Referral code and who invited whom	Referral programme	Granting bonuses	While the account exists
Site page views: path, language, device type — no cookie, no identifier	Site	Understanding which pages are read	Anonymous counters, indefinitely

We do not receive payment details (card numbers etc.): the payment provider processes them. From the provider we receive the fact of payment, the amount and an anonymised fingerprint of the payment method for linking accounts. This section takes effect together with payments; the provider will be named here before they are enabled.

What is not collected

• EA passwords, cookies, session headers or other login data.
• Player names and squad names — they are not in the task the extension sends.
• A browser fingerprint.
• Your actions in the Web App: the extension does not track what you do on the page, except for the events needed to update the club snapshot, and those events do not go to the server.

Cookies

The site uses two cookies, both ours and not for tracking: the account session after sign-in, and the invitation code for 30 days if you arrived through an /r/<code> link (the same code is kept in the browser's localStorage). There is no cookie banner: there are no third-party cookies.

Who receives the data

• The hosting provider whose servers run the service (to be named before publication).
• The payment provider — on payment (to be named before payments are enabled).
• The email provider — for password reset and payment emails.
• Nobody else. We do not sell or share data for advertising.

The extension loads prices from FUT.GG directly from your browser; FUT.GG sees your IP address under its own rules. Only the Web App itself contacts EA's servers; our server never does.

Your rights

In the account area on the site you can:

• export everything the server stores about the account;
• change the password and end sessions on all devices;
• delete the account. Deletion removes sessions, calculations, the token ledger and links; the club record with the date of the starting tokens remains so that a new account does not receive them again; security events remain without a link to the account.

For data questions, write to the support email at the bottom of the page.

Security

Passwords are stored as scrypt hashes, session tokens as hashes; the server cannot recover the token itself. The club identifier is hashed with a secret key. Connections are HTTPS only. Only the service administrator has access to the database; their actions on accounts are logged.

Children

The service is not intended for persons under 16.

Changes

A new revision is published here with a number and a date. If we start collecting something new, the policy is updated before the collection begins.