This is the current version of the Privacy & Cookie Policy, effective October 1, 2026. All versions

Privacy & Cookie Policy

Last Updated: October 1, 2026 · Effective: October 1, 2026 · Previous versions

Your privacy is important to Virtualeagues (“we,” “us,” or “our”). This Privacy & Cookie Policy explains how we collect, use, process, store, and share information when you use our platform, website, and mobile apps for iOS and Android (collectively, the “Service”).

By using Virtualeagues, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

The information we collect depends on how you use the Service.

A. Information You Provide Directly

We collect information you provide when you:

Create an account
Participate in leagues or competitions
Make purchases
Contact support

This may include:

Email address
Gamertag and display name
Optional profile information: bio, playing positions, nationality, social media links
Profile and player-card images you upload
User-generated content such as team names and logos, match results and statistics, feed posts, and media uploads (photos and clips)
Messages you send and receive on the website, and reports you file about messages (see Section 11)
Your acceptance of the Terms of Service and this Privacy Policy (which version, and when)

B. Payment Information (Stripe)

When you purchase premium features, payments are processed through third-party providers such as Stripe. We do not store your full payment details. Payment providers may collect:

Name
Billing details
Payment method information

This data is processed according to Stripe’s privacy policy.

C. Information Collected Automatically

When you use the Service, we may automatically collect:

IP address
Device type and identifiers
Browser type and settings
Pages visited and interactions
Date and time of access
Referring URLs

When you log in or register, we record the IP address (stored only in a hashed, pseudonymized form) and the browser/device description your browser sends, associated with that account. We use this solely to detect and prevent fraud, abuse, ban evasion, and unauthorized access. These login records are automatically deleted after 90 days.

When you accept our Terms of Service and this Privacy Policy (at registration, or when we publish a material update), we record which version you accepted, when, whether it was at sign-up or on the website, the same hashed IP address, and the browser description — so that we can show which version you agreed to. See Section 16.

If you enable push notifications in the mobile app, we store the device token needed to deliver them. We also keep basic technical logs (such as request errors) needed to operate and secure the Service.

D. Information from Third Parties

We may receive information from third-party services when you:

Link your Discord account (optional) — we receive your Discord user ID and username
Interact with third-party integrations you choose to connect

E. Automated Match Statistics (EA Sports FC Pro Clubs)

Virtualeagues offers an optional automatic-stats feature that retrieves match results and player performance data from Electronic Arts’ EA Sports FC Pro Clubs service through its publicly available Pro Clubs API (proclubs.ea.com). When a club takes part in a competition that uses this feature, we periodically query EA for that club’s recent matches. Specifically:

What we send to EA— only the in-game club name or club identifier and the platform (PlayStation, Xbox, or PC) needed to look up that club. We do not send your email, password, or other account or contact details to EA.
What we receive from EA— publicly available Pro Clubs data, including match scores and per-player statistics such as goals, assists, saves, and match ratings, tied to the in-game player personas (gamertags) that appeared in each match.
How we use it— we match the returned gamertags to player profiles on Virtualeagues so match results and statistics can be populated automatically, without members entering them by hand. Automatically imported results remain subject to review and correction by league administrators.

To reach EA’s endpoints reliably, these requests may be routed through a third-party networking (proxy) provider that forwards the request on our behalf; only the club-lookup information described above passes through it. EA Sports FC and Pro Clubs are trademarks of Electronic Arts Inc. Virtualeagues is not affiliated with, endorsed, or sponsored by Electronic Arts, and any data obtained from EA’s services is also subject to EA’s own terms and privacy policy.

2. How We Use Your Information

We use your information to operate, improve, and secure the Service. This includes:

Creating and managing accounts
Providing platform functionality (leagues, stats, competitions)
Displaying user-generated content (teams, stats, leaderboards)
Processing purchases and premium features
Communicating updates and support responses
Detecting fraud, abuse, or unauthorized activity
Improving performance and user experience
Delivering push notifications you have enabled
Delivering messages on the website and handling message reports (see Section 11)
Serving and measuring advertisements (see Section 5)

We may also use aggregated or anonymized data for analytics and business purposes.

3. Cookies and Tracking Technologies

We and our partners use cookies and similar technologies to deliver and improve the Service. Cookies are small text files stored on your device.

We use cookies and local storage to:

Keep you logged in
Remember preferences such as language
Protect sign-in and registration forms (Google reCAPTCHA)
Deliver and measure advertisements on the website (Google AdSense)

Our mobile apps do not use cookies for advertising. Advertising in the apps is described in Section 5.

4. Analytics Technologies

We use aggregated usage analytics on the website (Vercel Analytics) to understand which pages are used and how the Service performs. This analytics collects:

Pages visited and referring URLs
Device type, browser, and coarse location derived from IP address
Performance data

It does not use cookies, does not build a profile of you, and is not used to track you across other websites or apps.

5. Advertising

A. Mobile apps (Google AdMob)

Our iOS and Android apps display ads through Google AdMob.

On iOS, all ads are non-personalized only. This is enforced in the app for every ad request. The iOS app does not use the Identifier for Advertisers (IDFA) and does not ask for tracking permission, because it does not track you.
On Android, ad personalization follows the consent choices you make in the in-app consent form. You can change them at any time from the app’s settings.
AdMob may collect limited device data (such as IP address, device type, operating system version, and app identifier) to deliver ads, cap how often you see them, and prevent fraud. Google describes this in its privacy policy: https://policies.google.com/privacy

B. Website (Google AdSense)

The website displays ads through Google AdSense, which may use cookies and device identifiers to deliver personalized or non-personalized ads and to measure ad performance, subject to your consent choices where required.

Manage your Google ad preferences: https://www.google.com/settings/ads

Opt out of interest-based advertising: https://www.aboutads.info/choices

Note: Opting out does not remove ads, but may make them less relevant.

6. Tracking

We do not track you across apps or websites owned by other companies. We do not use the IDFA or any other advertising identifier to track you. We do not share your personal data with data brokers, and we do not share it with third parties for their own advertising purposes. We never sell your personal data.

7. How We Share Information

We do not sell your personal data.

We may share information with:

A. Service Providers

Vendors who process data on our behalf, only as needed to operate the Service:

Stripe — payment processing for premium features (website only)
Firebase Cloud Messaging (Google) — delivering push notifications you have enabled in the mobile app
Cloudflare R2 and Bunny — storing and delivering uploaded images, videos, and clips
Resend — sending transactional email (verification, password reset, notifications)
Google reCAPTCHA — protecting sign-in and registration forms from abuse
Discord — optional account linking and league/draft notifications in Discord servers you join
Vercel — hosting and the website analytics described in Section 4
EA Sports FC Pro Clubs API (Electronic Arts) — queried for match results and player statistics using only a club’s in-game name/identifier and platform, for the automatic-stats feature described in Section 1.E; no account or contact details are sent
Networking (proxy) provider — forwards our Pro Clubs API requests so they reach EA reliably, carrying only the club-lookup information, not your account data

B. Payment Processors

Stripe handles transactions on the website. We do not store your full payment details.

C. Advertising Partners

Google (AdMob in the mobile apps, AdSense on the website) for ad delivery and measurement, as described in Section 5. We do not share your account data with advertising partners.

D. Legal Requirements

When required to comply with law, legal processes, or government requests.

E. Protection of Rights

To enforce our terms, prevent fraud, or protect users and the platform. This includes a VirtuaLeagues head admin reviewing a reported message and a limited set of nearby messages, as described in Section 11.

F. Business Transfers

In connection with mergers, acquisitions, or asset sales.

8. Data Retention

We retain information:

As long as your account is active
As necessary to provide the Service
To comply with legal obligations
To resolve disputes and enforce agreements
Account login IP records (stored hashed) are retained for up to 90 days for fraud and abuse prevention, then automatically purged
Push notification device tokens are removed when you disable notifications or delete your account
Messages, message reports and the message-review log are kept for the periods listed in Section 11
Records of your acceptance of the Terms and this policy are kept while your account exists and, after deletion, as a compliance record linked only to the anonymized account

We may anonymize or delete data when it is no longer required. When you delete your account, your personal data is removed and your match statistics are anonymized as described in Section 12.

9. Data Security

We implement technical and organizational measures to protect your information. Data travels between your device and our servers over HTTPS (TLS), our database provider encrypts stored data at rest, and passwords are stored only as salted hashes. However, no system is completely secure. You use the Service at your own risk.

10. User Content and Public Information

Certain information you provide may be visible to others, including:

Team names and branding
Match results and statistics
Leaderboards and rankings

You should be aware that publicly shared content may be viewed and used by others.

Messages are not public: they are visible to the people in the conversation, and a reported message can be reviewed by VirtuaLeagues staff as described in Section 11. They are encrypted in transit and in storage but not end-to-end encrypted, so they are not hidden from our systems (see Section 11).

11. Messaging (Website)

On the website you can send direct messages to other players, and every club has an automatic team chat for its owner, manager, co-managers and rostered players. Messaging is a website feature only — our iOS and Android apps do not offer it. This section explains what we collect, how messages are protected, who can ever see them, and how long they are kept. A shorter, plain-language version is in the Help Center.

A. What we collect

The text of each message you send, who sent it, which conversation (and therefore which people) it was sent to, and when
How far you have read in each conversation (in direct messages this powers the “Seen” indicator; team chats never show it)
Your messaging settings: who may send you message requests, muted chats, chats you have left, and hidden users
Reports you file about messages, including the reason and any details you add
When a message was deleted and whether the sender, a club owner or manager, or VirtuaLeagues staff deleted it
A short technical identifier attached to each send so a message is never delivered twice, and a running count of how many of your messages the automated filter blocked in the last 10 minutes

We do not store your IP address, device or browser details with your messages.

B. How messages are protected

Messages are encrypted in transit: everything between your browser and our servers travels over HTTPS (TLS). They are also encrypted in storage: our database provider keeps stored data encrypted at rest (AES-256).

Messages are not end-to-end encrypted. End-to-end encryption would mean that only the people in a conversation could ever read it and that we could not. That is not how VirtuaLeagues messaging works: our systems can technically access message content, because that is what lets us deliver messages, run the automated filter described below, and review a message when someone reports it. In practice, nobody at VirtuaLeagues reads your messages unless a message is reported, and only in the limited way described in Section 11.D.

Messages are visible to everyone in the conversation. Please don’t send anything you would not want the people in the conversation, or a head admin reviewing a report, to see.

C. Automated filtering

When you send a message, an automated filter checks it against our list of banned words and phrases. If it matches, the message is blocked before it is delivered and you see a notice. This check is fully automated: no person is involved and no human reads messages to filter them. The blocked text is not kept; we only count how often your messages were blocked (for 10 minutes) so that repeated attempts pause sending for a short while.

We do not proactively monitor, read or scan conversations for any other purpose, and there is no tool that lets staff browse or search them. No advertising scripts run on messaging pages.

D. Reports and staff review

You can report any message you can see, including message requests and team-chat messages. Reporting is the only way a message reaches staff.
Only VirtuaLeagues head adminscan review a report. A review shows the reported message, the reporter’s optional details, and a limited set of nearby messages — up to 10 before and 5 after — frozen at the moment the report was filed and limited to what the reporter could see at that time. Nothing else in the conversation is shown, and the set never widens later.
Every review is logged: which head admin viewed the report, when, and which messages were shown. The log cannot be edited and is kept for 2 years.
A head admin who is part of the conversation does not review it while another head admin is available.
Possible actions are removing the message, warning the sender, or suspending the sender’s ability to send messages (24 hours, 7 days, 30 days, or permanently). Serious or repeated abuse can also lead to an account ban under our Terms of Service. The reporter is not told the outcome.
League, cup, tournament, draft and organization admins, other staff roles, and club owners or managers can never read direct messages or reports.

E. Club moderation in team chats

Team-chat membership follows the club: you join when you are rostered for an active season (or are the club’s owner, manager or a co-manager) and leave when that ends, with a 14-day grace period after a season completes. You only see messages sent after you joined. The club’s owner and designated manager can delete any message in their team chat, stop a member from posting, and archive the chat. Everyone can delete their own messages. Club owners and managers cannot see direct messages or reports.

F. Your controls

Choose who can send you message requests (everyone, clubmates only, or nobody). People you have shared a team chat with for at least 3 days can message you directly; everyone else starts as a request that you can accept, decline, or block.
Hide (block) a user: hidden users can’t message you, their team-chat messages are collapsed for you, and their feed posts are hidden. Manage the list in Settings.
Mute a conversation, leave a team chat (and rejoin from the team page), and report any message you can see.
Delete your own messages at any time, including in chats you have left.

G. How long messaging data is kept

Data	Kept for
Messages	Until the sender deletes them, a club owner or manager or VirtuaLeagues staff removes them, or the sender’s account is deleted.
Deleted messages	Hidden from everyone immediately. The text is permanently removed after 7 days, unless the message is part of a report, in which case it stays hidden until the report expires. A content-free record (that a message existed, when, and that it was deleted) may remain.
Declined message requests	The message text is removed after 30 days. A record that the request was declined is kept so it cannot be sent again.
Archived team chats	Readable (and reportable) by members for 30 days, then their messages are removed, except messages that are part of a report.
Reports, and the messages they cover	1 year after the report is closed.
Head-admin review log	2 years. It cannot be edited.
Blocked-message counter	10 minutes.

H. Account deletion

When you delete your account, the messages you sent are deleted, except any that are part of an open or recent report: those stay hidden from everyone until that report expires, after which their text is removed. Your conversation memberships and messaging notifications are removed. Reports you filed are kept without your name (they show “Deleted Player”). Messages other people sent you stay in their copy of the conversation, and the review log is kept for its normal period. See the Account Deletion page.

I. Legal requests

We may disclose message content and related records when we are legally required to do so (for example in response to a valid court order, subpoena, or other legal process), or when we believe in good faith that disclosure is necessary to prevent imminent harm to someone’s safety. We review such requests and disclose only what is required.

J. Minors

The Service, including messaging, is not intended for anyone under 13 (see Section 13). If we learn that an account belongs to a child under 13, we remove the account and its data, including its messages.

12. Your Choices and Controls

You may:

Update your account information
Remove optional profile data
Control cookies through your browser
Enable or disable push notifications in the app or your device settings
Opt out of personalized advertising on the website and on Android (iOS ads are always non-personalized)
Manage messaging on the website: who can send you requests, hidden users, muted and left chats (see Section 11)

You may request:

Access to your data
Deletion of your account

Account deletion

You can delete your account yourself from Settings → Delete account in the app or on the website, without contacting anyone. Deletion completes after a 14-day grace period, during which you can cancel by signing back in. After that, your personal data (email, gamertag, profile, images, linked accounts, device tokens) is permanently removed, and your match statistics are retained anonymously under the name “Deleted Player” so league and season records stay accurate for other competitors. Full details are on our Account Deletion page.

Contact: support@virtualeagues.com

13. Children

The Service is not intended for users under 13. We do not knowingly collect data from children under 13. If identified, such data will be removed.

14. International Use

By using the Service, you understand that your data may be processed in the United States and other locations where we or our service providers operate.

15. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices.

16. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time. Every version has an effective date shown at the top of this page, and previous versions stay available so you can see what you agreed to before.

When we make a materialchange — one that changes what we collect, how we use or share it, or your rights — we publish the new version with a summary of what changed and ask you to review and accept it the next time you use your account on the website. Until you accept, you can still read our policies and the Help Center, contact support, log out, or delete your account. Minor clarifications that do not change the meaning of this policy may be posted without asking you to accept again.

17. Contact

For questions or requests regarding this policy:

Email: support@virtualeagues.com

Related policies:

Search