In short
We store: a record each time an invite is used; the name and email address of anyone who asks for an invite; and, if you sign in, your account (your email address and name) with the things you choose to save.
We don't store: your IP address, a password (there isn't one), or anything that follows what you do from one day to the next. We don't keep the Team IDs you look up either, with one exception: if you're signed in, your account remembers the last Team ID you loaded, so it opens on your other devices.
One cookie keeps you signed in. Nothing is used for tracking, and nothing is sold or shared for marketing.
Counting visits: Gaffer Lab counts visits and which sections are used, so we know what is worth building. No cookies, and nothing counted identifies you: no IP address, no Team ID, no email. Cloudflare Web Analytics counts page visits; our own server counts which sections are opened, as daily totals. No advertising trackers. Turn counting off
What we store
| When | What we keep | Why | How long |
|---|---|---|---|
| You use an invite link or code | The code, a random ID your browser makes for itself, the time, the country your connection comes from, and the first name of the person who invited you if the link carries one | To let one person in per personal invite, on up to four of their own browsers, to count places on shared links, and to switch an invite off if it is misused | While the site is invite-only |
| You ask for an invite | Your name, your email address, who invited you if you came by a link, the page you asked from, and the time | To send you an invite. Nothing else is sent to that address. | Until you ask us to delete it, or the site stops being invite-only |
| A code is typed in wrongly, or sign-in codes are asked for | A scrambled, salted fingerprint of your connection. It can't be turned back into your IP address. | To slow down anyone guessing codes | Deleted after one day |
| You sign in | Your email address; your first name (from Google) or the part of your email before the @; if you use Google, Google's ID for your account; the invite your account came in on; when the account was made and last used | So you can sign in on any device and your invite goes with you | Until you delete your account |
| You're signed in | A sign-in session: a scrambled copy of the random key in your cookie, when it started, when it was last used, and your browser's name (for example "Chrome on Android") | To keep you signed in without asking again | Six months after it was last used, or until you sign out |
| You sign in by email | A scrambled copy of the six-digit code we sent, and how many times it was tried | To check the code | Deleted once used, or after 10 minutes |
| You use the site | Daily totals of which sections were opened and which of a few actions were used, each with a scrambled version of your browser's random ID that changes every day (so one browser counts once a day). See Counting visits. | To see what is used and what is worth building | 400 days |
| You save something while signed in | The items listed under "What stays in your browser" below that are marked as following your account, with when each last changed | So your work is there on every device | Until you delete them or your account |
This data sits in a database run by Cloudflare. Only the site's owner can read it. Our lawful basis is legitimate interest for running the invite list and for counting which parts of the site are used; your request in the case of an invite request; and our agreement with you (providing the account you asked for) in the case of accounts.
What stays in your browser
These are saved in your own browser's storage. If you're not signed in, they never leave it, and clearing your browser's site data for gafferlab.app removes them. If you are signed in, the items marked "Yes" are also copied to your account. Signing out removes them from that browser; your account keeps them.
| Saved | What it is for | Follows your account |
|---|---|---|
| Your invite | So you don't need the code again. The code and your browser's random ID are checked with our server now and then, so a withdrawn invite stops working. | Your account remembers which invite it came in on |
| Theme and table columns | Light or dark mode, and the columns you picked | Yes |
| Page guides | Which first-visit guides you've already seen, and whether they're switched on | Yes |
| Last Team ID loaded | The FPL Team ID you last loaded on My Team, so it opens again next time. Clearing the team on My Team forgets it. | Yes |
| Simulator squads and templates | The squad you're building, and squads you saved | Yes |
| Squad league readings and custom squads | The squads Scout built each week, and your own entries | Yes |
| Planned transfers and lineup | Your plans for a Team ID, kept for the coming gameweek. This includes the Team ID those plans are for. | Yes |
| Counting switched off | Remembers that you turned counting off in this browser | No |
| Invite request marker | Shows that you already asked, so the form isn't offered twice | No |
| Who is signed in, and what was last synced | So the page knows you're signed in before our server answers, and which changes still need sending | No |
Counting visits
We count which parts of Gaffer Lab are used, so we build more of what people use and less of what they don't. Two things do the counting, and neither uses a cookie.
Cloudflare Web Analytics counts visits to the pages: which page, the site you came from, your country, browser and type of device, and how long the page took to load. It keeps no IP address and does not follow you to other sites.
Our own server counts, as daily totals, which sections of the site are opened (Players, Simulator and so on, and the tabs inside them) and a few actions: loading a team, building a best squad, opening a player, finishing a page guide, asking for an invite, signing in, copying a share link. Your browser sends its random ID with the counts; the server keeps only a scrambled version of it that changes every day, so the same browser counts once a day and cannot be recognised the next. No IP address, Team ID, email or player name is kept with the counts. The totals are deleted after 400 days.
Counting is already off if your browser sends Do Not Track or Global Privacy Control. You can also switch our own count off in this browser here:
Cloudflare's count is part of the page itself, so the switch cannot stop it; an ad blocker usually does.
Loading an FPL team
When you load a Team ID or open the live scores, your browser asks our server, which fetches the public data from Fantasy Premier League and passes it back. The answer is cached for about a minute so repeat requests are fast. We don't record which Team IDs are looked up, and we never ask for your FPL password. The one Team ID we keep is the last one a signed-in account loaded (see the table above), and it's deleted with your account.
A Team ID's squad, history and league positions are public on the Fantasy Premier League website. Anyone who has the number can see them.
If you load a squad from a photo, the picture goes to our server, which has Cloudflare's AI read the player names off it and sends them back. The picture and the names are not kept. We count how many photos an address sends in a day, as a hash that cannot be turned back into the address, and that count is gone the next day.
Services we use
| Service | What it does | What it sees |
|---|---|---|
| Cloudflare | Hosts the site, its server and the invite database, protects it from attacks, and reads player names off a squad photo you choose to load (Workers AI) | Your connection, as any web host does, and a squad photo while it is being read. Cloudflare may set a strictly necessary security cookie. |
| Cloudflare Web Analytics | Counts visits to the site's pages, so we can see what is used | The page, the site you came from, your country, browser and device type, and page load times. No cookies, no IP address kept, nothing that follows you to other sites. Browsers with an ad blocker often block it, and that is fine. |
| Google sign-in | Lets you sign in with your Google account, if you choose to | That you signed in to Gaffer Lab. We receive your email address, name and Google's ID for your account, nothing else. |
| Resend | Sends the six-digit sign-in codes | Your email address and the code, to deliver the email |
| Google Fonts | Serves the site's two typefaces | Your IP address when the fonts load |
| Fantasy Premier League | The source of the football data | Requests from our server, not from your browser |
Your rights
Under UK and EU data protection law you can ask to see the data we hold about you, have it corrected or deleted, or object to how we use it. Email us from the address in question and we'll act within one month. To have an invite request deleted, just send the email address it was made with.
If you have an account, you can do the two most common requests yourself: open the account menu (the person icon at the top) and choose Download my data for a copy of everything saved to it, or Delete my account to remove the account and everything saved to it straight away.
If you're unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
Gaffer Lab isn't aimed at children under 13, and we don't knowingly keep their details.
Contact
Gaffer Lab is an independent project. For anything about your data, email labgaffer@gmail.com.
If this page changes, the date below changes with it.