Privacy Policy — FPL11 India

What data we collect

FPL11 India collects: (1) anonymous usage data via Google Analytics (page views, session duration, country, device type), (2) email address if you sign up for our captain pick newsletter, (3) Telegram handle if you join our Telegram group, (4) FPL team ID if you enter it in the FPL11 app for squad sync.

We do NOT collect: (1) payment information (the FPL11 Pro subscription is processed by Google Play / App Store — we never see your card details), (2) Aadhaar or PAN (those go to FPL platforms like Dream11, not us), (3) precise location (we only know your country from IP), (4) contacts, photos, microphone or any sensitive data.

If you sign up for our newsletter, we collect your email and (optionally) your name. We use this only for newsletter delivery and never share with third parties. You can unsubscribe at any time via the link in every newsletter.

How we use your data

We use the data we collect for: (1) improving the site (analytics show which pages are most popular, where users drop off), (2) sending you the weekly captain pick newsletter (if you subscribed), (3) syncing your FPL squad in the FPL11 app (if you entered your team ID), (4) responding to your queries (if you contacted us).

We do NOT use your data for: (1) targeted advertising (we show contextual ads, not behaviour-based), (2) selling to third parties (we never sell user data), (3) credit scoring or financial decisions, (4) any purpose unrelated to FPL11 India's editorial mission.

We may use aggregated, anonymised data for research purposes (e.g. 'the median India FPL manager finishes OR X'). Aggregated data cannot be linked back to individual users.

How we protect your data

Data in transit: TLS 1.3 encryption on all pages (HTTPS). Data at rest: AES-256 encryption on our database servers. Access control: only the FPL11 India core team can access user data, with 2FA mandatory for all admin accounts.

We use Cloudflare for DDoS protection and SSL/TLS. Our servers are hosted in Mumbai (for India user data) and Frankfurt (for EU user data, GDPR compliance). Email is sent via SendGrid with DKIM/SPF/DMARC authentication.

In the event of a data breach, we notify affected users within 72 hours via email. We also report the breach to India's CERT-In within 6 hours (as required by the IT Act 2000 amendments 2022).

Your rights (India DPDP Act 2023)

Under the India Digital Personal Data Protection Act 2023, you have the right to: (1) access your personal data we hold, (2) correct inaccurate data, (3) erase your data ('right to be forgotten'), (4) nominate another person to exercise your rights in case of death or incapacity, (5) file a complaint with the Data Protection Board of India.

To exercise any of these rights, email [email protected] with: (1) your full name, (2) the email address associated with your FPL11 account, (3) the specific right you're exercising, (4) any supporting documents. We respond within 30 days.

If you're not satisfied with our response, you can file a complaint with the Data Protection Board of India at dpb.gov.in. We will cooperate fully with any investigation.

Cookies and tracking

FPL11 India uses cookies for: (1) Google Analytics (analytics cookie, expires 2 years), (2) Cloudflare (__cf_bm cookie, security bot management, expires 30 minutes), (3) session cookie (expires when you close the browser), (4) newsletter signup cookie (remembers your email if you partially fill the form).

We do NOT use: (1) third-party advertising cookies, (2) cross-site tracking cookies, (3) social media tracking pixels (we don't embed Facebook, Twitter or Instagram widgets), (4) fingerprinting or device-tracking technologies.

You can disable cookies in your browser settings. Note that disabling cookies may affect site functionality (e.g. newsletter signup won't remember your email). We honour the 'Do Not Track' browser header — DNT-enabled browsers are not tracked by Google Analytics.

Data retention

We retain user data for: (1) email subscribers: until you unsubscribe (you can unsubscribe at any time), (2) FPL team ID in the app: until you log out of the app or delete your account, (3) Google Analytics data: 26 months (then auto-deleted), (4) support emails: 2 years (then archived), (5) Telegram group membership: until you leave the group.

After retention period expires, we delete the data within 30 days. For deletion requests, email [email protected] and we will delete your data within 30 days.

Aggregated, anonymised data (e.g. 'X% of India managers prefer Salah as captain') may be retained indefinitely because it cannot be linked back to individual users.

Children's privacy

FPL11 India does not knowingly collect data from children under 18. The official FPL game is for users 18+, and we follow the same age restriction. If we discover we have collected data from a child under 18, we delete it immediately upon discovery.

If you believe a child under 18 has provided us with personal data, please email [email protected] with the details. We will delete the data within 7 days.

We do not direct our content or marketing to children under 18. Our captain pick newsletter is only sent to subscribers who have confirmed they are 18+.

Children's privacy (expanded)

Beyond the FPL age requirement, we take additional steps to protect children's privacy: (1) we don't knowingly collect data from anyone under 18, (2) we don't show FPL ads or marketing to anyone under 18, (3) we don't create content targeted at children.

Parents who want to restrict their children's access to FPL-related content can use: (1) parental controls on Android (Google Family Link) or iOS (Screen Time), (2) DNS-based content filtering (OpenDNS, CleanBrowsing), (3) router-level blocking of fantasy sports websites.

If you suspect a child under 18 has provided us with personal data, please email [email protected] with the details. We will investigate and delete the data within 7 days.

International data transfers

FPL11 India stores India user data in Mumbai (primary) with backups in Singapore (disaster recovery). For EU users (some India managers travel to the EU), we comply with GDPR's Standard Contractual Clauses for international data transfers.

If you're an EU resident using our services from the EU, you have additional rights under GDPR: (1) right to access, (2) right to rectification, (3) right to erasure, (4) right to restrict processing, (5) right to data portability, (6) right to object. To exercise these rights, email [email protected].

We do not sell user data to any third party, including data brokers, advertisers or analytics providers. Our funding comes from app subscriptions, display ads and affiliate links — not data sales.

Children's privacy (expanded)

Beyond the FPL age requirement, we take additional steps to protect children's privacy: (1) we don't knowingly collect data from anyone under 18, (2) we don't show FPL ads or marketing to anyone under 18, (3) we don't create content targeted at children.

Parents who want to restrict their children's access to FPL-related content can use: (1) parental controls on Android (Google Family Link) or iOS (Screen Time), (2) DNS-based content filtering (OpenDNS, CleanBrowsing), (3) router-level blocking of fantasy sports websites.

If you suspect a child under 18 has provided us with personal data, please email [email protected] with the details. We will investigate and delete the data within 7 days.

International data transfers

FPL11 India stores India user data in Mumbai (primary) with backups in Singapore (disaster recovery). For EU users (some India managers travel to the EU), we comply with GDPR's Standard Contractual Clauses for international data transfers.

If you're an EU resident using our services from the EU, you have additional rights under GDPR: (1) right to access, (2) right to rectification, (3) right to erasure, (4) right to restrict processing, (5) right to data portability, (6) right to object. To exercise these rights, email [email protected].

We do not sell user data to any third party, including data brokers, advertisers or analytics providers. Our funding comes from app subscriptions, display ads and affiliate links — not data sales.

Frequently asked questions