You are reading a previous version of the Privacy & Cookie Policy, effective October 2, 2026. It has been replaced by the version effective November 1, 2026 — read the current version. All versions

Privacy & Cookie Policy

Last Updated: October 2, 2026 · Effective: October 2, 2026 · Previous versions

Your privacy is important to Virtualeagues (“we,” “us,” or “our”). This Privacy & Cookie Policy explains how we collect, use, process, store, and share information when you use our platform, website, and mobile apps for iOS and Android (collectively, the “Service”).

By using Virtualeagues, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

The information we collect depends on how you use the Service.

A. Information You Provide Directly

We collect information you provide when you:

Create an account
Participate in leagues or competitions
Make purchases
Contact support

This may include:

Email address
Gamertag and display name
Optional profile information: bio, playing positions, nationality, social media links
Profile and player-card images you upload
User-generated content such as team names and logos, match results and statistics, feed posts, and media uploads (photos and clips)
Messages you send and receive on the website, and reports you file about messages (see Section 11)
Your acceptance of the Terms of Service and this Privacy Policy (which version, and when)

B. Payment Information (Stripe)

When you purchase premium features, payments are processed through third-party providers such as Stripe. We do not store your full payment details. Payment providers may collect:

Name
Billing details
Payment method information

This data is processed according to Stripe’s privacy policy.

C. Information Collected Automatically

When you use the Service, we may automatically collect:

IP address
Device type and identifiers
Browser type and settings
Pages visited and interactions
Date and time of access
Referring URLs

When you log in or register, we record the IP address (stored only in a hashed, pseudonymized form) and the browser/device description your browser sends, associated with that account. We use this solely to detect and prevent fraud, abuse, ban evasion, and unauthorized access. These login records are automatically deleted after 90 days.

When you accept our Terms of Service and this Privacy Policy (at registration, or when we publish a material update), we record which version you accepted, when, whether it was at sign-up or on the website, the same hashed IP address, and the browser description — so that we can show which version you agreed to. See Section 17.

If you enable push notifications in the mobile app, we store the device token needed to deliver them. We also keep basic technical logs (such as request errors) needed to operate and secure the Service.

D. Information from Third Parties

We may receive information from third-party services when you:

Link your Discord account (optional) — we receive your Discord user ID and username
Interact with third-party integrations you choose to connect

E. Automated Match Statistics (EA Sports FC Pro Clubs)

Virtualeagues offers an optional automatic-stats feature that retrieves match results and player performance data from Electronic Arts’ EA Sports FC Pro Clubs service through its publicly available Pro Clubs API (proclubs.ea.com). When a club takes part in a competition that uses this feature, we periodically query EA for that club’s recent matches. Specifically:

What we send to EA — only the in-game club name or club identifier and the platform (PlayStation, Xbox, or PC) needed to look up that club. We do not send your email, password, or other account or contact details to EA.
What we receive from EA — publicly available Pro Clubs data, including match scores and per-player statistics such as goals, assists, saves, and match ratings, tied to the in-game player personas (gamertags) that appeared in each match.
How we use it — we match the returned gamertags to player profiles on Virtualeagues so match results and statistics can be populated automatically, without members entering them by hand. Automatically imported results remain subject to review and correction by league administrators.

To reach EA’s endpoints reliably, these requests may be routed through a third-party networking (proxy) provider that forwards the request on our behalf; only the club-lookup information described above passes through it. EA Sports FC and Pro Clubs are trademarks of Electronic Arts Inc. Virtualeagues is not affiliated with, endorsed, or sponsored by Electronic Arts, and any data obtained from EA’s services is also subject to EA’s own terms and privacy policy.

2. How We Use Your Information

We use your information to operate, improve, and secure the Service. This includes:

Creating and managing accounts
Providing platform functionality (leagues, stats, competitions)
Displaying user-generated content (teams, stats, leaderboards)
Processing purchases and premium features
Communicating updates and support responses
Detecting fraud, abuse, or unauthorized activity
Improving performance and user experience
Delivering push notifications you have enabled
Delivering messages on the website and handling message reports (see Section 11)
Serving and measuring advertisements (see Section 5)
If you use Gideon, our Windows companion app for invited testers: studying how to keep competitions fair (see Section 12)

We may also use aggregated or anonymized data for analytics and business purposes.

3. Cookies and Tracking Technologies

We and our partners use cookies and similar technologies to deliver and improve the Service. Cookies are small text files stored on your device.

We use cookies and local storage to:

Keep you logged in
Remember preferences such as language
Protect sign-in and registration forms (Google reCAPTCHA)
Deliver and measure advertisements on the website (Google AdSense)

Our mobile apps do not use cookies for advertising. Advertising in the apps is described in Section 5.

4. Analytics Technologies

We use aggregated usage analytics on the website (Vercel Analytics) to understand which pages are used and how the Service performs. This analytics collects:

Pages visited and referring URLs
Device type, browser, and coarse location derived from IP address
Performance data

It does not use cookies, does not build a profile of you, and is not used to track you across other websites or apps.

5. Advertising

A. Mobile apps (Google AdMob)

Our iOS and Android apps display ads through Google AdMob.

On iOS, all ads are non-personalized only. This is enforced in the app for every ad request. The iOS app does not use the Identifier for Advertisers (IDFA) and does not ask for tracking permission, because it does not track you.
On Android, ad personalization follows the consent choices you make in the in-app consent form. You can change them at any time from the app’s settings.
AdMob may collect limited device data (such as IP address, device type, operating system version, and app identifier) to deliver ads, cap how often you see them, and prevent fraud. Google describes this in its privacy policy: https://policies.google.com/privacy

B. Website (Google AdSense)

The website displays ads through Google AdSense, which may use cookies and device identifiers to deliver personalized or non-personalized ads and to measure ad performance, subject to your consent choices where required.

Manage your Google ad preferences: https://www.google.com/settings/ads

Opt out of interest-based advertising: https://www.aboutads.info/choices

Note: Opting out does not remove ads, but may make them less relevant.

6. Tracking

We do not track you across apps or websites owned by other companies. We do not use the IDFA or any other advertising identifier to track you. We do not share your personal data with data brokers, and we do not share it with third parties for their own advertising purposes. We never sell your personal data.

7. How We Share Information

We do not sell your personal data.

We may share information with:

A. Service Providers

Vendors who process data on our behalf, only as needed to operate the Service:

Stripe — payment processing for premium features (website only)
Firebase Cloud Messaging (Google) — delivering push notifications you have enabled in the mobile app
Cloudflare R2 and Bunny — storing and delivering uploaded images, videos, and clips
Resend — sending transactional email (verification, password reset, notifications)
Google reCAPTCHA — protecting sign-in and registration forms from abuse
Discord — optional account linking and league/draft notifications in Discord servers you join
Vercel — hosting and the website analytics described in Section 4
EA Sports FC Pro Clubs API (Electronic Arts) — queried for match results and player statistics using only a club’s in-game name/identifier and platform, for the automatic-stats feature described in Section 1.E; no account or contact details are sent
Networking (proxy) provider — forwards our Pro Clubs API requests so they reach EA reliably, carrying only the club-lookup information, not your account data

B. Payment Processors

Stripe handles transactions on the website. We do not store your full payment details.

C. Advertising Partners

Google (AdMob in the mobile apps, AdSense on the website) for ad delivery and measurement, as described in Section 5. We do not share your account data with advertising partners.

D. Legal Requirements

When required to comply with law, legal processes, or government requests.

E. Protection of Rights

To enforce our terms, prevent fraud, or protect users and the platform. This includes a VirtuaLeagues head admin reviewing a reported message and a limited set of nearby messages, as described in Section 11.

F. Business Transfers

In connection with mergers, acquisitions, or asset sales.

8. Data Retention

We retain information:

As long as your account is active
As necessary to provide the Service
To comply with legal obligations
To resolve disputes and enforce agreements
Account login IP records (stored hashed) are retained for up to 90 days for fraud and abuse prevention, then automatically purged
Push notification device tokens are removed when you disable notifications or delete your account
Messages, message reports and the message-review log are kept for the periods listed in Section 11
Gideon session records: detailed records are deleted after 90 days; see Section 12 for what is kept longer
Records of your acceptance of the Terms and this policy are kept while your account exists and, after deletion, as a compliance record linked only to the anonymized account

We may anonymize or delete data when it is no longer required. When you delete your account, your personal data is removed and your match statistics are anonymized as described in Section 13.

9. Data Security

We implement technical and organizational measures to protect your information. Data travels between your device and our servers over HTTPS (TLS), our database provider encrypts stored data at rest, and passwords are stored only as salted hashes. However, no system is completely secure. You use the Service at your own risk.

10. User Content and Public Information

Certain information you provide may be visible to others, including:

Team names and branding
Match results and statistics
Leaderboards and rankings

You should be aware that publicly shared content may be viewed and used by others.

Messages are not public: they are visible to the people in the conversation, and a reported message can be reviewed by VirtuaLeagues staff as described in Section 11. They are encrypted in transit and in storage but not end-to-end encrypted, so they are not hidden from our systems (see Section 11).

11. Messaging (Website)

On the website you can send direct messages to other players, and every club has an automatic team chat for its owner, manager, co-managers and rostered players. Messaging is a website feature only — our iOS and Android apps do not offer it. This section explains what we collect, how messages are protected, who can ever see them, and how long they are kept. A shorter, plain-language version is in the Help Center.

A. What we collect

The text of each message you send, who sent it, which conversation (and therefore which people) it was sent to, and when
How far you have read in each conversation (in direct messages this powers the “Seen” indicator; team chats never show it)
Your messaging settings: who may send you message requests, muted chats, chats you have left, and hidden users
Reports you file about messages, including the reason and any details you add
When a message was deleted and whether the sender, a club owner or manager, or VirtuaLeagues staff deleted it
A short technical identifier attached to each send so a message is never delivered twice, and a running count of how many of your messages the automated filter blocked in the last 10 minutes

We do not store your IP address, device or browser details with your messages.

B. How messages are protected

Messages are encrypted in transit: everything between your browser and our servers travels over HTTPS (TLS). They are also encrypted in storage: our database provider keeps stored data encrypted at rest (AES-256).

Messages are not end-to-end encrypted. End-to-end encryption would mean that only the people in a conversation could ever read it and that we could not. That is not how VirtuaLeagues messaging works: our systems can technically access message content, because that is what lets us deliver messages, run the automated filter described below, and review a message when someone reports it. In practice, nobody at VirtuaLeagues reads your messages unless a message is reported, and only in the limited way described in Section 11.D.

Messages are visible to everyone in the conversation. Please don’t send anything you would not want the people in the conversation, or a head admin reviewing a report, to see.

C. Automated filtering

When you send a message, an automated filter checks it against our list of banned words and phrases. If it matches, the message is blocked before it is delivered and you see a notice. This check is fully automated: no person is involved and no human reads messages to filter them. The blocked text is not kept; we only count how often your messages were blocked (for 10 minutes) so that repeated attempts pause sending for a short while.

We do not proactively monitor, read or scan conversations for any other purpose, and there is no tool that lets staff browse or search them. No advertising scripts run on messaging pages.

D. Reports and staff review

You can report any message you can see, including message requests and team-chat messages. Reporting is the only way a message reaches staff.
Only VirtuaLeagues head admins can review a report. A review shows the reported message, the reporter’s optional details, and a limited set of nearby messages — up to 10 before and 5 after — frozen at the moment the report was filed and limited to what the reporter could see at that time. Nothing else in the conversation is shown, and the set never widens later.
Every review is logged: which head admin viewed the report, when, and which messages were shown. The log cannot be edited and is kept for 2 years.
A head admin who is part of the conversation does not review it while another head admin is available.
Possible actions are removing the message, warning the sender, or suspending the sender’s ability to send messages (24 hours, 7 days, 30 days, or permanently). Serious or repeated abuse can also lead to an account ban under our Terms of Service. The reporter is not told the outcome.
League, cup, tournament, draft and organization admins, other staff roles, and club owners or managers can never read direct messages or reports.

E. Club moderation in team chats

Team-chat membership follows the club: you join when you are rostered for an active season (or are the club’s owner, manager or a co-manager) and leave when that ends, with a 14-day grace period after a season completes. You only see messages sent after you joined. The club’s owner and designated manager can delete any message in their team chat, stop a member from posting, and archive the chat. Everyone can delete their own messages. Club owners and managers cannot see direct messages or reports.

F. Your controls

Choose who can send you message requests (everyone, clubmates only, or nobody). People you have shared a team chat with for at least 3 days can message you directly; everyone else starts as a request that you can accept, decline, or block.
Hide (block) a user: hidden users can’t message you, their team-chat messages are collapsed for you, and their feed posts are hidden. Manage the list in Settings.
Mute a conversation, leave a team chat (and rejoin from the team page), and report any message you can see.
Delete your own messages at any time, including in chats you have left.

G. How long messaging data is kept

Data	Kept for
Messages	Until the sender deletes them, a club owner or manager or VirtuaLeagues staff removes them, or the sender’s account is deleted.
Deleted messages	Hidden from everyone immediately. The text is permanently removed after 7 days, unless the message is part of a report, in which case it stays hidden until the report expires. A content-free record (that a message existed, when, and that it was deleted) may remain.
Declined message requests	The message text is removed after 30 days. A record that the request was declined is kept so it cannot be sent again.
Archived team chats	Readable (and reportable) by members for 30 days, then their messages are removed, except messages that are part of a report.
Reports, and the messages they cover	1 year after the report is closed.
Head-admin review log	2 years. It cannot be edited.
Blocked-message counter	10 minutes.

H. Account deletion

When you delete your account, the messages you sent are deleted, except any that are part of an open or recent report: those stay hidden from everyone until that report expires, after which their text is removed. Your conversation memberships and messaging notifications are removed. Reports you filed are kept without your name (they show “Deleted Player”). Messages other people sent you stay in their copy of the conversation, and the review log is kept for its normal period. See the Account Deletion page.

I. Legal requests

We may disclose message content and related records when we are legally required to do so (for example in response to a valid court order, subpoena, or other legal process), or when we believe in good faith that disclosure is necessary to prevent imminent harm to someone’s safety. We review such requests and disclose only what is required.

J. Minors

The Service, including messaging, is not intended for anyone under 13 (see Section 14). If we learn that an account belongs to a child under 13, we remove the account and its data, including its messages.

12. Gideon (Windows Companion App)

Gideon is an optional Windows app that we offer to invited testers. You start it before launching EA SPORTS FC. While a session runs, it records which programs, services and drivers are running on that computer and reports this to us. We use it to study how to keep VirtuaLeagues competitions fair. During this testing phase, Gideon makes no automatic decisions about you or your account.

Gideon collects nothing until you install it, link it to your VirtuaLeagues account on our website and agree to this section in the app. If you don't use Gideon, this section doesn't apply to you.

A. What Gideon collects

Your linked computer: the device name shown when you link it, the Windows version, the Gideon version, a SHA-256 fingerprint of the Gideon program, and whether Gideon ran with administrator rights.
A snapshot when a session starts: the programs running on the computer (name, process ID, parent program, file location, a SHA-256 fingerprint of the program file, the publisher named in its digital signature, signature status and start time), the Windows services (name, display name, state, file location and signature details) and the loaded drivers (name, file location and signature details).
Changes during the session: programs that start or stop, services that change, when the game is detected or closes, any period Gideon could not monitor, and regular check-ins (heartbeats) saying whether the game is running.
Session details: the game, when the session started and ended, how it ended, and notes our servers add automatically (for example missed check-ins or an outdated Gideon version).
Linking: a short code you approve on our website and a sign-in token for the app. We store the token only in hashed form, and we record when each linked computer was last seen.

B. What Gideon never collects

Gideon does not collect:

The contents of your files, documents, photos or other personal files
Screenshots, screen recordings, or audio or video from a microphone or camera
Keystrokes, passwords or anything you type
Your browsing history or the content of your messages, chats or emails
Anything from your computer while no Gideon session is running

C. Why we collect it

To develop and test tools that help detect cheating software and keep competitions fair
To learn how common each program is across sessions, so ordinary software can be told apart from rare or unknown software
To find and fix problems with Gideon itself

We process this information with your consent, which you give in the app. Gideon is a testing program: no ban, penalty or other action is taken automatically from Gideon data.

D. Who can see it

You can see a list of your own sessions (date, game, duration and status) under Account › Gideon on our website.
Only VirtuaLeagues head administrators can see the detailed records. League, cup and tournament administrators and other players cannot.
We do not sell Gideon data or share it with advertisers. It is stored with our hosting and database providers.
Program fingerprints, program names, file locations (with your Windows user name removed), publishers and the number of sessions a program appeared in form a program catalog that is not linked to you.

E. How long we keep it

Detailed records (the snapshot taken when a session starts and the changes during the session) are deleted automatically after 90 days.
Session summaries (date, game, duration, status and server notes) are kept while your account exists, unless you ask us to delete them sooner.
The program catalog described above is kept without any link to you.
Unused linking codes expire after 10 minutes and are deleted within a day.

F. Unlinking and deleting your Gideon data

Unlink a computer at any time under Account › Settings › Gideon devices on our website. Its token stops working immediately, so Gideon on that computer can no longer send anything.
Stop using Gideon or uninstall it whenever you like. Nothing is collected without a running session.
Ask us to delete your Gideon data by contacting support@virtualeagues.com. We delete your sessions, their records and your linked computers.
Deleting your VirtuaLeagues account deletes all of your Gideon data.
To withdraw your consent, unlink your computers and ask us to delete your Gideon data.

Gideon is offered only to invited testers who meet the minimum age for the Service.

13. Your Choices and Controls

You may:

Update your account information
Remove optional profile data
Control cookies through your browser
Enable or disable push notifications in the app or your device settings
Opt out of personalized advertising on the website and on Android (iOS ads are always non-personalized)
Manage messaging on the website: who can send you requests, hidden users, muted and left chats (see Section 11)
Unlink a Gideon device or ask us to delete your Gideon data (see Section 12)

You may request:

Access to your data
Deletion of your account

Account deletion

You can delete your account yourself from Settings → Delete account in the app or on the website, without contacting anyone. Deletion completes after a 14-day grace period, during which you can cancel by signing back in. After that, your personal data (email, gamertag, profile, images, linked accounts, device tokens) is permanently removed, and your match statistics are retained anonymously under the name “Deleted Player” so league and season records stay accurate for other competitors. Full details are on our Account Deletion page.

Contact: support@virtualeagues.com

14. Children

The Service is not intended for users under 13. We do not knowingly collect data from children under 13. If identified, such data will be removed.

15. International Use

By using the Service, you understand that your data may be processed in the United States and other locations where we or our service providers operate.

16. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices.

17. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time. Every version has an effective date shown at the top of this page, and previous versions stay available so you can see what you agreed to before.

When we make a material change — one that changes what we collect, how we use or share it, or your rights — we publish the new version with a summary of what changed and ask you to review and accept it the next time you use your account on the website. Until you accept, you can still read our policies and the Help Center, contact support, log out, or delete your account. Minor clarifications that do not change the meaning of this policy may be posted without asking you to accept again.

18. Contact

For questions or requests regarding this policy:

Email: support@virtualeagues.com

Related policies: