Privacy

What's stored

Your account. A username, an email address, and optionally a full name and a nickname. If you sign in with a password, a scrambled version of it that cannot be turned back into your password. If you sign in with Google or Microsoft, an identifier from them instead, and the email address they tell us.

Your profile picture, if you add one. What's kept is a small square copy made from the file you upload. The file itself is discarded, along with anything recorded inside it, such as where and when a photo was taken. You can remove the picture at any time from your account settings, and it goes when your account does.

Your game. Your predictions, the points they scored, which leagues you are in, and whether a league owner has marked you as having paid their entry fee.

Notifications. If you turn on push notifications, the subscription your browser gives us so the message can reach your device. A record of which notifications were sent to you, kept for 60 days so a failed send can be retried without sending twice.

Security records. When you log in, fail to log in, reset a password or change your account, that is recorded along with your IP address. Successful events are kept 60 to 90 days depending on type; failed ones for a year, because a failed login from six months ago is evidence and a successful one is noise. League and admin actions are kept longer — a year and two years — and nothing is kept beyond three seasons.

Anonymous counts. How many people opened an invite, signed up, joined a league or made a first prediction. These records have no user column at all — not an empty one, the column does not exist, so no future query can start using it. Journeys are stitched together with a random token that is erased after 30 days, leaving the counts behind.

What it's used for

Running the game and the league tables. Sending you reminders and results, if you asked for them. Keeping accounts secure. Understanding whether invite links work.

That's the complete list. Nothing is sold, nothing is shared for advertising, and there is no third-party analytics or tracking of you across other websites.

Who else sees it

Other players in your leagues see your display name, your profile picture if you have one, your predictions once a fixture has locked, your points, and whether you've been marked as paid. If you have chosen to appear on the global leaderboard, every logged-in player sees your name and picture there.

Resend delivers the emails, so they handle your address and the message.

Google or Microsoft, only if you choose to sign in that way, and only to confirm it's you.

The server host stores the database, as any host does.

Match data comes from ESPN and the Fantasy Premier League API. Nothing about you is sent to either.

Cookies

One cookie, which keeps you logged in. There are no tracking or advertising cookies, which is why there's no cookie banner.

Your choices

You can change your details, turn notifications off, or delete your account from your account settings. Deleting removes your account and your predictions.

You can also ask for a copy of what's held about you, ask for it to be corrected, or ask for it to be deleted, by writing to privacy@crinkleit.com.

Changes

If this page changes in a way that matters, you'll be told in the app rather than left to notice.

Last updated 1 October 2026.