Privacy policy
Fourth Officials stores as little as it can: the team you audit, and an email address if you create an account. This page says what, why, and how to have it removed.
Last updated
Who we are
Fourth Officials is a small independent site that grades Fantasy Premier League teams. It is not affiliated with the Premier League or Fantasy Premier League. Questions about this policy go to contact@fourthofficials.com.
What we store
When you audit a team
We keep the team ID you paste, the squad we read from FPL and the audit we produce (grade, sub-scores and recommendations), so the result page keeps working and you can share it. Any transfers or captain you type in are stored with it. Result pages are public to anyone who has the link, like the FPL team page itself, and are kept out of search engines.
When you create an account
- Email and password: your name, email address and a hash of your password. The password itself is never stored. Until you click the confirmation link, the sign-up waits as a pending record with the same three things, and is dropped after a day if the link is never used.
- Google: the name, email address and picture Google gives us stay in an encrypted session cookie in your browser. Your name and email address reach our database; the picture does not.
- Either way: when you first signed in and when you last did, and whether it was with Google or a password.
- Weekly emails: whether you said yes or no to the weekly deadline reminder and grade email, and when you answered.
- Account emails: one welcome email about an hour after you first sign in, with your team's grade if it has been audited; one reminder five days later if your team or alerts are still not set up, unless you said no to weekly emails; and, only if you said yes, a reminder the day before each FPL deadline and your grade after each gameweek, never more than one of these every two days. We keep a record of which of these emails we sent and when. Each one has an unsubscribe link that works without signing in; using it records a no to weekly emails. The link carries a random key, never your email address.
- Your team: the team ID saved to your account and the transfer plans you build in the planner.
- Alerts: if you turn on injury alerts, the email address or Telegram chat ID to send them to, and a record of what was sent.
To stop abuse
Sign-in, sign-up and password reset attempts are counted against a hash of the email address or IP address for a short time. The address itself is not stored.
Where FPL data comes from
Squads, fixtures, prices and injury flags come from the public FPL API, the same source as the FPL site. Teams are public on FPL by default; we read the same pages anyone can. Projections are produced by our own model from that data and are estimates, not advice.
Who processes it
We do not sell or share your data. These services run the site for us and only see what their job needs:
| Service | What it does |
|---|---|
| Neon | The database, hosted in Frankfurt (EU). |
| Railway | Runs the app, in Amsterdam (EU). Its request logs hold IP addresses for a short time. |
| Resend | Sends sign-up, password reset, welcome, weekly and injury alert emails, and delivers messages from the contact page to us. |
| Telegram | Delivers injury alerts, only if you connect the bot. |
| Sign-in, only if you choose Continue with Google. | |
| PostHog | Cookieless analytics, on servers in the EU. |
| Sentry | Error reporting, on servers in the EU. When a page or request fails it receives the error with the URL, browser and request headers it happened in. |
| Cloudflare | DNS and forwarding of mail sent to us. |
Analytics and cookies
We use PostHog to see how the site is used: pages viewed, audits started and finished with their grade, sign-ups, what was picked on the one-time setup after sign-up, shares and alert subscriptions. It runs without cookies or any identifier that persists between visits, so there is no consent banner. It may record a replay of a session to find bugs; anything you type is masked.
The cookies we set are the one that keeps you signed in and the short-lived ones the sign-in flow needs: a token that stops forged sign-in requests, the page to send you back to, and during Google sign-in a one-time code. When you audit a team without an account, a cookie remembers its team ID for 30 days so that signing up saves that team to your account; it is deleted once you sign in. Your light or dark theme choice is kept in your browser's local storage. There are no advertising or tracking cookies.
Your rights
You can ask for a copy of what we hold about you, or have it deleted, by emailing contact@fourthofficials.com from the address on your account. We reply within a few days. Audits you ran while signed out are not linked to you, so tell us the team ID and we will remove those too. If you are in the EU or UK and think we have handled your data badly, you can also complain to your local data protection authority.
Changes
If this policy changes in a way that matters, the date at the top moves and account holders get an email. See also the terms of use.