Last updated: 12 August 2026
This policy explains what fplwire stores about you, why, and how to get rid of it. It covers the articles on this site and the fplwire app at app.fplwire.com.
Who is responsible
fplwire is run by Ehsan Fazlhashemi, trading as fplwire, a sole trader based in Sweden, who is the data controller for everything described in this policy. That means one named person is responsible for your data, and is the person to ask about it. Because the controller is based in Sweden, this site falls under the EU General Data Protection Regulation (GDPR). For any question about your data, or to have it deleted, contact privacy@fplwire.com.
fplwire is not affiliated with the Premier League or with Fantasy Premier League.
The terms of service cover the rest of the relationship: what fplwire offers, what is asked of you, and what happens if a paid tier launches.
Reading articles
You do not need an account to read anything on this site, and creating one is not required to use the app. Reading articles involves no login and no personal data.
If you create an account
Accounts use a magic link. You enter your email address, we send you a one time link, and clicking it signs you in. There is no password, so there is no password of yours for us to store or to lose.
What gets stored:
- Your email address. It is the account identifier and the only way to send you a login link.
- Your Fantasy Premier League team ID, if you provide one. This is what lets the app show your squad. It is a public FPL identifier, not a credential, and it gives no access to your FPL account.
- A display name, if you set one.
- Account timestamps: when the account was created and when it last signed in.
- Login and session records. These are stored only as SHA-256 hashes, never as the original values, so reading the database does not let anyone sign in as you.
- Any plans you save. Transfer plans you build in the app are stored against your account so they are available on your other devices. They contain only gameweek numbers and player selections. Deleting your account deletes them.
The lawful basis is performance of a contract: this is the information needed to give you an account that works across devices. We do not sell it, share it for advertising, or use it to build a profile of you.
How long it is kept
- Login links expire after 15 minutes and can only be used once.
- Sessions last 90 days, then expire. Signing out ends the session immediately.
- Account data is kept until you delete the account. There is no automatic expiry, because an account that quietly deletes itself is not much of an account.
Deleting your account
You can delete your account from the settings screen in the app at any time. This removes your email address, your team ID, your display name, any plans you have saved, and every session and login record associated with you. It is immediate and it is not recoverable, so treat it as final. If you would rather it were done for you, email the address above.
Cookies
The app sets one cookie, fplwire_session, after you sign in. It holds a random session token and nothing else. It is marked HttpOnly, so scripts on the page cannot read it, and SameSite=Lax, so it is not sent from other sites. It exists to keep you signed in and for no other purpose.
There are no advertising cookies and no third party analytics or tracking scripts on this site.
Who else touches your data
- Resend delivers the login emails. Your email address passes through it for that purpose.
- Hetzner hosts the server. The data sits on infrastructure in the EU.
- Cloudflare sits in front of the site and handles DNS and HTTPS. It also forwards email sent to the contact address above to the operator’s inbox.
Nobody else receives your data. Squad information shown in the app comes from the public Fantasy Premier League API using your team ID, and no data of yours is sent to it.
Server logs
The server keeps ordinary technical logs, including IP addresses, for security and for diagnosing faults. This follows from running a server at all, and the lawful basis is legitimate interest in keeping the site secure and working.
Your rights
Under the GDPR you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, or object to how it is used. Email the address above and you will get an answer. If you are not satisfied, you can complain to your national data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
Changes
If this policy changes in a way that affects what is stored or who it goes to, the date at the top will change and account holders will be told by email.