Privacy policy

1. Who we are

FUT Flipper (“we”, “us”) runs the website futflipper.com, the FUT Flipper apps for Mac and Windows and the FC 27 Season Pass. We are the controller of the personal information described in this policy. You can contact us about privacy at [email protected]. Company details are provided on request at [email protected].

2. What we collect

• Account: your email address, your password (stored only as a one-way hash), whether and when you confirmed your email, and your email notification settings. If you turn on two-step verification: its authenticator secret (encrypted) and one-way hashes of your recovery codes.
• Sign in with Google or Apple: if you use it, the account identifier Google or Apple gives us for FUT Flipper and the email address it shared (with Apple this may be a private relay address). We never receive your Google or Apple password, and we do not keep your name.
• Season Pass and payments: your plan, when the pass started and ends, its payment status, your Stripe customer ID, the payment reference and the link to Stripe's receipt. You enter and update card details on Stripe's pages; we never receive or store them.
• Sign-ins and devices: your sign-in sessions and app refresh tokens, and the devices signed in to your account (app type, the device name, when first and last used).
• Clubs and EA accounts: each club's nickname and platform, its EA persona name and ID once linked, the players you watch and your trading settings (prices and safeguards), your trading activity (searches, bids, purchases, listings and errors), your EA web sign-in saved encrypted so the app stays signed in to EA, proxy settings you add, and the public IP address and browser details of the device running each club. We never ask for or store your EA password.
• Support: the messages you send us (by the form or by email), our replies and the address we reply to.
• Emails we send: which account emails were sent, to which address and when.
• Website page counts: how many times each page was viewed per day, which websites visitors came from and how often each page's sponsored links were clicked, counted without cookies and without storing IP addresses or anything else about you.
• Server logs: IP address, time, the address requested and browser type, for security and troubleshooting.

3. Why we use it (lawful bases)

• To provide FUT Flipper (contract): your account, the apps and trading, the Season Pass, account emails such as verification, password resets, sign-in and payment notices, and support.
• To keep it safe and working (legitimate interests): preventing fraud and abuse, rate limits, security alerts, fixing problems and counting page views.
• To meet legal obligations: keeping payment and accounting records and answering lawful requests.
• Optional notices (consent): EA restriction, club and app update emails, which you can switch off at any time in Your desk.

We do not sell your personal information and do not use it for advertising.

4. Who we share it with

Only with service providers that run parts of FUT Flipper for us, under contracts that require them to protect it:

• Stripe: payments, refunds and disputes.
• Google and Apple: only if you choose to sign in with them; they tell us who signed in and the email address you agreed to share.
• Relaytera: email delivery. Account emails come from [email protected] and support conversations from [email protected].
• Hosting and backup providers: the servers that run FUT Flipper and encrypted off-site copies of the database.

Your apps talk to EA directly from your device when they trade; EA handles that data under its own terms and privacy policy. Our price data provider receives only which cards to price, never your account details. We may also disclose information when the law requires it, to protect our rights or users, or as part of a sale of the business, in which case this policy continues to apply.

5. International transfers

Our providers may process information outside the UK. Where the law requires it, these transfers are protected by adequacy regulations or approved contract clauses (such as the UK International Data Transfer Addendum).

6. How long we keep it

• Account, club and trading settings: while your account exists. When you delete your account, they are deleted straight away.
• Trading activity log: 7 days.
• Sign-in sessions: 12 hours on the website; app refresh tokens 30 days, or until you sign out.
• Records of emails sent: 90 days.
• Support conversations: until you ask us to remove them.
• Payment records: as long as tax and accounting law requires (normally 6 years). After account deletion the licence is kept only with an anonymised email.
• Page counts: 400 days (they contain no personal information). Server logs: a limited period for security and troubleshooting.
• Backups: encrypted database backups are kept for up to 6 months, so deleted information can remain in them until they expire.

7. Security

We use encryption in transit, one-way hashing of passwords, encryption of your saved EA sign-in, single-use hashed links for account emails, and restricted access. No system is completely secure, so please use a strong password you do not use elsewhere.

8. Your rights

Under UK data protection law (UK GDPR) you have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to receive it in a portable format, to object to or restrict processing based on our legitimate interests, and to withdraw consent at any time. You can change your email, switch optional notices off and delete your account yourself in Your desk; for anything else email [email protected]. We may need to confirm your identity first and reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), though we would like the chance to put things right first.

9. Cookies and browser storage

The website sets strictly necessary security cookies only while you create an account or sign in with Google or Apple: the sign-in cookies expire within 10 minutes, and the account-confirmation cookie lasts a day. It keeps your sign-in and a few display settings in your browser's local storage so you stay signed in, and the page counter stores nothing about you. Stripe's checkout pages set their own cookies under Stripe's policy.

10. Children

FUT Flipper is not directed at children, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We post the new version here with a new date, and tell you by email before a material change applies.

12. Contact

Privacy questions and requests: [email protected] or contact support. See also our terms of service.