Cookie Policy
Version 2.1 · In effect from · Last updated
This policy explains what My FPL Mini-League stores on your device, why, and how you control it. It supplements the Privacy Policy.
The Platform is operated by Common Room Ventures Private Limited (CIN U32409KA2026PTC222161), Bengaluru, India.
Nothing optional is stored until you agree to it. If you have not yet made a choice, we treat that as a refusal, not as permission.
1. What these technologies are
Cookies are small text files a website places on your device, which it can read back on your next visit.
Local storage holds data on your device until you or the site clears it. Session storage works the same way but is erased when you close the tab.
We use all three. They are covered by this policy equally. What matters is what is stored and why, not the technical mechanism.
2. The two categories
| Category | Needs consent? | What happens if you decline |
|---|---|---|
| Essential | No | Cannot be declined. Without these the Platform cannot log you in or remember your cookie choice. |
| Analytics | Yes | Nothing is set, and no usage data is collected. The Platform works normally. |
We do not use advertising cookies, marketing cookies, or any cross-site tracking. We do not sell data to anyone, and we do not allow third parties to place advertising technology on the Platform.
2.1 Our legal basis
Essential storage is used because it is strictly necessary to provide a service you have asked for.
Analytics storage is used only with your consent. You give it through the cookie banner, and you can withdraw it at any time (§5). Withdrawal is as easy as giving it.
This is a change from version 1.0 of this policy, which relied on legitimate interests for analytics and did not ask for consent. It now asks.
3. Essential: always active
3.1 Cookies
| Name | What it does | Duration |
|---|---|---|
sb-…-auth-token | Keeps you signed in. Set by our authentication provider, encrypted, sent only over secure connections, unreadable by other sites. | Up to 400 days, but deleted the moment you sign out. The sign-in inside it expires far sooner: one hour, refreshed for up to 30 days. |
sb-…-auth-token.0, .1, … | The same sign-in cookie, split into numbered parts when it is larger than a browser will store in one. Most signed-in visitors will see these rather than a single cookie. | As above |
sb-…-auth-token-code-verifier | Secures the sign-in exchange when you use a magic link or Google. Part of the standard PKCE security protocol. | Cleared once sign-in completes |
onboarding_complete | Records that you have finished setting up your account, so you are not sent back through setup on every page | 7 days, and deleted as soon as you sign out |
preview_access | Only used before launch: remembers that you arrived through a preview link, so you can see the real site behind the holding page | 24 hours |
3.2 Local and session storage
| Key | Type | What it does | Duration |
|---|---|---|---|
fml_cookie_consent | Local storage | Records the cookie choice you made, so we do not ask again on every page | 1 year, then we ask again |
fml_cookie_consent_ts | Local storage | Records when you made that choice, so we know when it expires | 1 year |
__ph_opt_in_out_… | Local storage | Records whether analytics is on or off for this browser. Written as "off" before you answer the banner, and changed only if you accept. | Until you clear browser data |
fml-cache-cleanup-v1 | Local storage | A one-off marker. On your first visit we clear an old offline cache left by a previous version of the site, and this stops us repeating it every visit. | Until you clear browser data |
myfml.avatarHintSeen | Local storage | Remembers that you have already seen the prompt about setting a profile picture, so it is not shown again | Until you clear browser data |
pending_otp_email | Local storage | Holds the email address you typed while you go to your inbox and click the sign-in link, so the code that comes back can be matched to the right address. Deleted as soon as sign-in completes. | Until sign-in completes |
pending_fpl_team_id, pending_fpl_team_id_meta | Local storage | Remembers the Fantasy Premier League team you picked before signing in, so you do not have to find it again afterwards. Deleted once it has been attached to your account. | Until sign-in completes |
Note that your cookie choice is itself stored on your device, and so is the record that you refused analytics. This is unavoidable: it is the only way to remember that you declined.
Between this table and §4.4, that is the complete list. Anything the Platform stores on your device appears in one of the two, and which one it is in tells you whether it waits for your consent. If you find a key in neither, that is a mistake and we want to hear about it at [email protected].
4. Analytics: only with your consent
We use two analytics services, PostHog and Google Analytics, to understand how the Platform is used: which pages people reach, where journeys break, and which features get used. They tell us that a step is being abandoned. Neither is used for advertising, and we do not sell what they collect.
Until you accept, neither one loads or sends anything. The Google Analytics script is not added to the page at all. PostHog starts switched off, keeps what little it holds in memory rather than on your device, and sends no events. The one thing written before you answer is the record of that "off" state itself, listed in §3.2, because we have to remember it somewhere.
4.1 PostHog
| Name | Type | What it does | Duration |
|---|---|---|---|
ph_…_posthog | Cookie and local storage | A random identifier distinguishing one browser from another, plus session state, so that page views can be joined into a journey | 1 year |
ph_…_window_id, ph_…_primary_window_exists | Session storage | Tells one browser tab apart from another during a single visit | Cleared when you close the tab |
PostHog Inc. processes this on our instructions as our processor. Details of international transfers are in the Privacy Policy.
4.2 Google Analytics
| Name | What it does | Duration |
|---|---|---|
_ga | Distinguishes one browser from another so visits can be counted | 2 years |
_ga_… | Keeps track of your current visit for this specific measurement property | 2 years |
The Google Analytics script is only loaded once you have accepted analytics. If you withdraw, we switch it off and delete both cookies (§5).
4.3 Session recording
PostHog records how a page is used, meaning pointer movement, clicks and scrolling, to show where an interface is confusing.
All text is masked before it leaves your browser — both what you type into form fields and the text already on the page, including names, team names and standings. A recording shows the shape of the page and what you did on it, not what it said or who you are. Recording is switched off entirely on our marketing pages, including the home page and the creators page.
4.4 Product usage signals
These are written only once you have accepted analytics.
| Key | Type | What it does | Duration |
|---|---|---|---|
first_touch_attribution | Local storage | Records how you first arrived: the campaign tags in the link you clicked, the site that referred you, and the first page you landed on. Held in memory until you accept, then written once and never changed. | Until you clear browser data |
hasVisited | Local storage | Notes whether you have been to the home page before, so we can tell a first visit from a return | Until you clear browser data |
hasSignedInBefore | Local storage | Notes that you have signed in on this device before, so we can tell a first sign-up from a return. It records that you did, not who you are. | Until you clear browser data |
loginMethod, loginStartTime, loginIsNewUser | Local storage | Written when you start signing in, so we can measure how long the round-trip took and whether it succeeded | Deleted once you land back in the app |
navSequenceNumber | Session storage | Counts navigations within one visit, to understand movement through the Platform | Cleared when you close the tab |
If you have not accepted analytics, none of these is written, and the Platform works exactly the same. The only difference is that every visit looks like a first visit to us.
5. Changing or withdrawing your choice
In the Platform. Open Cookie Preferences, available in the footer of every page and at the top of this policy. Change your selection and save. It takes effect immediately, with no reload.
If you withdraw, collection stops at once. PostHog stops sending and stops persisting. Google Analytics is switched off using Google's own opt-out mechanism, and the _ga cookies are deleted rather than left to expire on their own two-year clock.
In your browser. Every major browser lets you block or delete cookies and clear local storage. Blocking essential cookies will stop you being able to sign in.
Do Not Track. If your browser sends a Do Not Track signal, PostHog will not collect anything, even if you accepted analytics. That is more restrictive than your banner choice, and deliberately so: where the two disagree, the more private one wins.
Withdrawing consent does not affect anything collected while consent was in place, though you can ask us to delete that too (see the Privacy Policy).
6. Third parties
Beyond the analytics provider in §4, some resources are loaded from third parties who will see your IP address as a technical necessity of delivering them:
| Provider | Purpose |
|---|---|
| Cloudflare | Serves the Platform and public league pages, and protects against attacks |
| Google Fonts | Typefaces |
| jsDelivr | Emoji graphics |
These do not set cookies for us and are not used to track you across sites. The full list of everyone who processes your data is in the Privacy Policy.
7. Public league pages
Public league pages are served from our content delivery network without any account or sign-in. Viewing one does not require you to accept cookies, and no analytics is loaded there without consent.
8. Contact
| Purpose | Contact |
|---|---|
| Anything about this policy or your cookie choice | [email protected] |
| Formal complaints and grievances | Shashwat Nandan, Grievance Officer, [email protected] |
9. Changes
We may update this policy, for example if we change analytics provider. Material changes will be notified in the Platform, and where a change adds a new category of storage we will ask for your consent again. The version and effective date are shown at the foot of this page.