Legal
Privacy policy
Last updated 23 September 2026
This policy explains what personal data Co-Gaffer collects through this website and the Co-Gaffer app, why we collect it, and the choices you have. We’ve tried to keep it short and plain.
Who we are
Co-Gaffer is run by Eberything Limited, a company in the Hong Kong Special Administrative Region. We are the data user for the personal data described here, under the Personal Data (Privacy) Ordinance (Cap. 486). Contact us about anything in this policy at hello@co-gaffer.com.
What we collect
If you join the waitlist
- Your email address.
- Whether you use iPhone or Android.
If you use the app
- Account details from Sign in with Apple or Google: your email address (Apple may give us a private relay address instead) and an account ID.
- Your FPL team ID and the private league you pin. This ID is public on Fantasy Premier League; we never ask for, and never receive, your FPL password.
- Things you save in the app: unpublished transfer plans, pinned rivals, strategy and alert preferences.
- A push notification token and your phone’s platform, if you allow notifications.
Public FPL data
To show your team and mini-league, we fetch data that Fantasy Premier League publishes openly, including team names, manager names and squads of other managers in your leagues. We only use it to power the features you see in the app.
Technical data
Our servers receive your IP address and basic request details when the website or app talks to our API. We use this to keep the service running and to stop abuse, such as automated scraping. Rate-limiting data is held in memory for a few minutes; server logs are kept for a limited period.
Website analytics
Only if you accept analytics cookies, we use Google Analytics 4 to understand how visitors use this website — for example which pages lead people to join the waitlist. See cookies below. The app does not use Google Analytics.
Why we use it
We follow the data protection principles in the Personal Data (Privacy) Ordinance (Cap. 486). We collect personal data only for the purposes below, and only as much as those purposes need.
| Purpose | Why |
|---|---|
| Sending your TestFlight invite and launch news | You asked us to email you. You can unsubscribe any time |
| Running your account and the app’s features | Needed to provide the service you use |
| Website analytics | Only if you accept analytics cookies |
| Security, preventing abuse and fixing problems | To keep Co-Gaffer safe and working |
We don’t sell your personal data, and we don’t use it for direct marketing.
Who we share it with
We use a small number of service providers who process data on our behalf:
- Supabase — sign-in and our database.
- Fly.io — hosts our API servers in London.
- Google — Google Analytics (website, with consent) and Sign in with Google.
- Apple — Sign in with Apple and TestFlight.
- Expo — delivers push notifications, if you turn them on.
- Our website hosting provider, which serves these pages.
We may also disclose data if the law requires it, or to protect our users or the service.
International transfers
Some providers process data outside Hong Kong, including in the United Kingdom, the United States and the European Union. We require them to protect that data and to use it only to provide their service to us.
How long we keep it
- Waitlist: until you unsubscribe, or 12 months after the app’s public launch — whichever comes first.
- Account data: for as long as you have an account. We delete it within 30 days of you asking us to.
- Unpublished transfer plans: replaced or removed as each gameweek passes.
- Analytics: no longer than 14 months.
Your rights
Under the Personal Data (Privacy) Ordinance you can ask for a copy of the personal data we hold about you, and ask us to correct it if it is inaccurate. You can also ask us to delete your account, and you can withdraw consent at any time — for analytics, use “Cookie settings” at the bottom of any page; for the waitlist, unsubscribe from the email. To make a request, email hello@co-gaffer.com from the address linked to your account. We may need to confirm it’s you before we act.
If you’re unhappy with how we handle your data, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, at pcpd.org.hk. We’d appreciate the chance to sort it out first.
Cookies and similar technologies
Analytics cookies are only set after you click Accept in the cookie banner. You can change your mind at any time with “Cookie settings” in the footer; rejecting removes the analytics cookies.
| Name | Provider | Purpose | Lasts |
|---|---|---|---|
| cg-consent | Co-Gaffer (browser storage) | Remembers your cookie choice | Until you clear it |
| _ga | Google Analytics | Tells visits apart | 2 years |
| _ga_* | Google Analytics | Keeps track of the current visit | 2 years |
The app stores your sign-in session and preferences on your phone so you stay signed in. These aren’t used for tracking.
Children
Co-Gaffer isn’t meant for children under 13, and we don’t knowingly collect their data. If you think a child has given us data, contact us and we’ll delete it.
Changes to this policy
If we make significant changes, we’ll update the date at the top and, where appropriate, tell you in the app or by email.