Privacy Policy

Last updated: 26 July 2026

lastseason.co.uk ("we", "us"), operated by Spires Digital, respects your privacy. This policy explains what data we collect and how we use it.

Data we collect

If you allow analytics, Google Analytics 4 receives usage information such as pages visited, interactions with fantasy tools, device category and approximate location. We also store a limited first-party event record in Cloudflare D1 so daily operational reports can count page views, fantasy-tool use, affiliate exits and Pro interest. These records contain a random analytics identifier, page path, event type, selected non-sensitive context and date; they do not contain your email address, IP address or the fantasy name text you entered or generated. Analytics is not loaded and the first-party identifier is not created before consent. If you submit a daily-game score, we store the nickname you choose, a randomly generated browser identifier, puzzle date, result, number of guesses and completion time so the community leaderboard can work.

Daily games and leaderboards

Game progress, streaks, achievements, followed clubs and followed leagues are stored in your browser. Community scores and fantasy team-name votes are stored in a Cloudflare D1 database. Random browser identifiers are used to limit each browser to one leaderboard entry per puzzle or one vote per name; they are not connected to an account, email address or advertising profile. Avoid using your full real name as a leaderboard nickname.

Fantasy assistant accounts

You can use most fantasy tools without an account. If you choose to sign in, we store your email address, account tier and expiry, saved fantasy plan and account timestamps in Cloudflare D1. Your plan can include squad drafts, saved names, player watchlists, chip ideas, transfer notes, preferences and checklist progress. This data stays in your browser while you are signed out and is synced to your account after you sign in.

Sign-in links and sessions use randomly generated secrets. We store one-way hashes rather than the original secrets, and sign-in links expire after 15 minutes and can only be used once. Sessions expire after 30 days. Resend delivers sign-in emails. If you buy a Pro season pass, Stripe processes the payment; we store the Stripe customer and payment-event identifiers, payment status, amount and currency needed to fulfil and support the pass, but Last Season does not receive or store your full card details.

Fantasy briefing and supporter interest

If you join the fantasy briefing or Pro season-pass update list, we store your email address, the updates you selected, signup source and consent timestamps in Cloudflare D1. We also send the address and your selected email topics to Resend, our email-delivery provider. Joining the list does not create an account, and we do not sell your address. Briefings sent through Resend include unsubscribe and preference-management controls. You can also request access or deletion at any time by emailing privacy@lastseason.co.uk.

Cookies

The site stores your analytics choice in local storage under lastseason-analytics-choice. After you allow analytics, it also creates a random identifier under lastseason-analytics-visitor for aggregated visitor counts; resetting or declining analytics removes this identifier from the browser. Saved leagues, followed clubs, recently viewed pages, game progress, fantasy plans, profile nickname and a random leaderboard identifier are also stored in your browser. Signed-in fantasy accounts use an essential, secure session cookie. Google Analytics may set cookies only after you choose “Allow analytics”. No advertising platform is currently loaded.

Third-party links

Some kit and fantasy pages link to third-party retailers for convenience. A retailer link may be an affiliate link only when this is disclosed beside it; in that case we may receive a commission at no extra cost to you. If you allow analytics, we record affiliate-link interactions with the partner, placement and page context so we can measure which recommendations are useful. Third-party sites have their own privacy policies.

Your rights

Under UK GDPR, you may have rights to access, correct, export, restrict or delete personal data we hold about you, and to object to or withdraw consent for certain uses. Contact privacy@lastseason.co.uk for a data request. You may also complain to your relevant data-protection authority.

Retention and security

We retain account and plan data while your account is active, and billing records where reasonably necessary for accounting, fraud prevention and legal obligations. First-party analytics events are routinely deleted after 120 days. Expired sign-in links and sessions may also be deleted routinely. We use access controls, encryption in transit and limited-purpose credentials, but no internet service can guarantee absolute security.