Privacy Policy
Bhailog Fantasy League (BFL) · Last updated 3 September 2026
BFL has no servers, no accounts and no database. Nothing you do in this app is sent to us, because there is nothing to send it to. Everything below is detail on that one fact.
What we collect
Nothing. We operate no backend, no analytics service and no crash reporter. We cannot see who uses BFL, how often, or what they do in it.
What the app stores on your device
| What | Where | Why |
|---|---|---|
| Premier League session token | The device's own secure credential store — the Keychain on iOS, the Android Keystore on Android — marked so it stays on that one device and is excluded from iCloud and Google backups | Keeps you signed in so you can save lineups and transfers |
| Your Premier League email, and your password if you tick Remember me | The same secure credential store, with the same device-only and no-backup markings | So signing back in after a session expires does not mean retyping a password on a phone |
| Your team id | App storage on the device | Identifies the team the app shows |
| Your settings | App storage on the device | Theme, reminders, haptics and similar preferences |
| Cached Fantasy Premier League data | App storage on the device | Players, fixtures and scores, so the app is fast and uses less data |
All of it is removed when you delete the app. Signing out from Settings → Your team → Sign out removes the session token immediately. A password saved with Remember me is deliberately kept, so that signing back in is one tap; sign in again with Remember me unticked to erase it.
Your Premier League password
There are two ways to sign in, and they handle your password differently. Read this section rather than assuming, because an earlier version of this policy said BFL had no password field, and that is no longer true.
Premier League's own page. Choosing Continue to Premier League,
or one of the Google, Apple, Facebook or X buttons, opens Premier League's sign-in page
at account.premierleague.com with the address shown on screen. You type your
password there and BFL never sees it. This is the only route that works for an FPL
account opened through one of those providers, and the only acceptable one for those,
because the password being typed belongs to Google or Apple rather than to FPL.
BFL's own form. The email and password fields on the sign-in screen are BFL's. What happens to what you type is that the app loads Premier League's authorisation page in a hidden browser view on your device, submits your details to it, and reads back the resulting authorisation code. So the password does pass through the app. It does not pass through us: BFL operates no server, so there is no address it could be sent to and no log it could appear in.
If you tick Remember me, your password is written to your device's own secure credential store — the iOS Keychain or the Android Keystore — encrypted by the operating system, readable only while the device is unlocked, and excluded from iCloud and Google backups so it cannot travel to another device. It is kept when you sign out, on purpose, so that coming back is one tap. Signing in again with Remember me unticked erases it. Leaving it unticked stores your email address only.
Storing a password is a real trade rather than an oversight, so it is worth being plain about the risk: unlike a session token, a password is not scoped or revocable, and people reuse passwords. If you would rather BFL never held yours, use Premier League's own page instead, or leave Remember me unticked.
Where your data goes
The app talks to two places, both operated by the Premier League:
fantasy.premierleague.com— to read your team, players, fixtures, leagues and scores, and to save lineup or transfer changes you makeaccount.premierleague.com— to sign you in and to renew your session
Requests go straight from your device. They are not proxied through us, and we operate nothing in between. Your use of those services is governed by the Premier League's own privacy policy and terms.
Tracking and advertising
BFL does not track you. There is no advertising SDK in the app, no advertising identifier is read, and no data is shared with anyone for advertising or any other purpose. If advertising is ever added, this policy will be updated before that version ships, and any tracking would require your explicit permission — through iOS's App Tracking Transparency prompt, or an equivalent consent screen on Android.
Notifications
Deadline reminders are scheduled entirely on your device from the fixture list the app has already downloaded. There is no push server and no push token. The reminders are off until you turn them on.
Face, fingerprint and device unlock
If you enable the app lock, the check is performed by your device's operating system, not by BFL. Biometric data never leaves the secure hardware that holds it — Apple's Secure Enclave on iOS, the Trusted Execution Environment or secure element on Android — and BFL only learns whether the check succeeded.
Children
BFL is not directed at children under 13 and collects no information from anyone.
Your rights
Because we hold no data about you, there is nothing for us to export, correct or delete. To remove everything the app holds, delete the app. To revoke BFL's access to your Fantasy Premier League account, sign out in the app, or manage it from your Premier League account.
Changes
If this policy changes, the date at the top changes with it, and material changes will be noted in the app's release notes.
Contact
Questions about this policy: hello@sandmatter.com