Who we are

Fantasy Fight League (“we”, “us”) operates Fantasy Fight League, a free fantasy boxing prediction game. For the purposes of the UK GDPR and the Data Protection Act 2018 we are the data controller for the personal data described here. You can reach us at support@fflboxing.com.

What we collect

Information you give us

Account details — your email address, the username you choose, and a password. Passwords are handled by Firebase Authentication and are never stored by us in readable form.
Profile content — a profile picture if you upload one, and the cosmetic title and avatar frame you equip.
Gameplay data — the predictions you make on each bout, the leagues you join or create, and any messages you post in league chat.
Correspondence — anything you send us by email, and any content report you submit about another player.

Information created by using the service

Scores and progression — points, XP, rank, login streak, $KO balance, mission and achievement progress, all derived from how you play.
Device and diagnostic data — if you sign in on the mobile app we store a push notification token so we can alert you when picks are about to lock.
Referral data — your referral code and the count of people who signed up with it.

Information from third parties

If you sign in with Google or with Apple, we receive your email address and, where you allow it, your display name and profile photo. We do not receive your password.

Why we use it, and our legal basis

Under the UK GDPR we must have a lawful basis for each use. Ours are:

To provide the game — creating your account, saving your picks, scoring them, and ranking you on leaderboards. Basis: performance of a contract.
To show public leaderboards and league tables, which display your username, avatar, level and score to other players. Basis: performance of a contract.
To send service notifications such as picks-closing reminders and results. Basis: legitimate interests, and consent on mobile where the operating system requires it.
To keep the service safe — investigating content reports, blocking abuse, and preventing cheating. Basis: legitimate interests.
To operate FFL Pro subscriptions. Basis: performance of a contract.

What other players can see

Fantasy Fight League is a social game, so some data is deliberately public. Other players can see your username, profile picture, avatar frame, equipped title, level, rank and score on global and league leaderboards. Anyone in a league you join can see messages you post in that league's chat.

Your email address, your $KO balance and your individual picks on unsettled bouts are not shown to other players.

Who we share data with

We do not sell your personal data. We share it only with the processors that run the service:

Google (Firebase) — authentication, database, file storage, cloud functions and push notifications. Data may be processed outside the UK under Google's standard contractual clauses.
Apple — where you subscribe to FFL Pro through the App Store, or sign in with Apple.
Google AdSense — we display advertising on this website and in the mobile app. Google may set cookies or use similar identifiers to serve and measure ads. Where the law requires it we ask for your consent before any non-essential advertising cookie is set, and you can change or withdraw that choice at any time. You can also control ad personalisation in your Google Ad Settings.
Vercel — hosts the website and provides aggregate traffic analytics. Vercel Analytics does not use cookies and does not identify individual visitors.

We may also disclose data where the law requires it, or to establish or defend legal claims.

How long we keep it

We keep your account data for as long as your account is open. If you ask us to delete your account we remove your profile, picks and messages within 30 days, except where we must retain something to comply with a legal obligation or to resolve a dispute. Aggregate, non-identifying statistics may be retained.

Your rights

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time.

To exercise any of these, email support@fflboxing.com. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office.

Security

Authentication and storage are handled by Firebase, and access to player data is restricted by server-side security rules. Traffic is encrypted in transit. No system is perfectly secure, so please use a strong, unique password.

Children

Fantasy Fight League is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

Cookies and similar technologies

We use three kinds, and they are not equivalent:

Strictly necessary — browser storage that keeps you signed in between visits. The service cannot work without it, so it is set without consent.
Advertising — Google AdSense may set cookies or use similar identifiers to serve and measure ads on this website and in the mobile app. These are not necessary for the service to work, and where the law requires it we ask for your consent before setting them.
Analytics — we use Vercel Analytics to understand aggregate traffic. It is cookieless and does not identify you individually.

You can clear or block cookies in your browser settings, though blocking the strictly necessary ones will sign you out. On mobile you can reset or limit your advertising identifier in your device settings.

Changes

We may update this policy. Where a change is material we will tell you in the app or by email before it takes effect. The date at the top of this page always reflects the most recent revision.