Privacy & Cookie Policy

11. Messaging

On the website and in our iOS and Android apps you can send direct messages to other players, and every club has an automatic team chat for its owner, manager, co-managers and rostered players. Messaging works the same way in both places. This section explains what we collect, how messages are protected, who can ever see them, and how long they are kept. A shorter, plain-language version is in the Help Center.

A. What we collect

• The text of each message you send, who sent it, which conversation (and therefore which people) it was sent to, and when
• How far you have read in each conversation (in direct messages this powers the “Seen” indicator; team chats never show it)
• Your messaging settings: who may send you message requests, muted chats, chats you have left, and hidden users
• Reports you file about messages, including the reason and any details you add
• When a message was deleted and whether the sender, a club owner or manager, or VirtuaLeagues staff deleted it
• A short technical identifier attached to each send so a message is never delivered twice, and a running count of how many of your messages the automated filter blocked in the last 10 minutes

We do not store your IP address, device or browser details with your messages.

B. How messages are protected

Messages are encrypted in transit: everything between your browser or the app and our servers travels over HTTPS (TLS). They are also encrypted in storage: our database provider keeps stored data encrypted at rest (AES-256).

Messages are not end-to-end encrypted. End-to-end encryption would mean that only the people in a conversation could ever read it and that we could not. That is not how VirtuaLeagues messaging works: our systems can technically access message content, because that is what lets us deliver messages, run the automated filter described below, and review a message when someone reports it. In practice, nobody at VirtuaLeagues reads your messages unless a message is reported, and only in the limited way described in Section 11.D.

Messages are visible to everyone in the conversation. Please don’t send anything you would not want the people in the conversation, or a head admin reviewing a report, to see.

C. Automated filtering

When you send a message, an automated filter checks it against our list of banned words and phrases. If it matches, the message is blocked before it is delivered and you see a notice. This check is fully automated: no person is involved and no human reads messages to filter them. The blocked text is not kept; we only count how often your messages were blocked (for 10 minutes) so that repeated attempts pause sending for a short while.

We do not proactively monitor, read or scan conversations for any other purpose, and there is no tool that lets staff browse or search them. No advertising scripts run on messaging pages.

D. Reports and staff review

• You can report any message you can see, including message requests and team-chat messages. Reporting is the only way a message reaches staff.
• Only VirtuaLeagues head admins can review a report. A review shows the reported message, the reporter’s optional details, and a limited set of nearby messages — up to 10 before and 5 after — frozen at the moment the report was filed and limited to what the reporter could see at that time. Nothing else in the conversation is shown, and the set never widens later.
• Every review is logged: which head admin viewed the report, when, and which messages were shown. The log cannot be edited and is kept for 2 years.
• A head admin who is part of the conversation does not review it while another head admin is available.
• Possible actions are removing the message, warning the sender, or suspending the sender’s ability to send messages (24 hours, 7 days, 30 days, or permanently). Serious or repeated abuse can also lead to an account ban under our Terms of Service. The reporter is not told the outcome.
• League, cup, tournament, draft and organization admins, other staff roles, and club owners or managers can never read direct messages or reports.

E. Club moderation in team chats

Team-chat membership follows the club: you join when you are rostered for an active season (or are the club’s owner, manager or a co-manager) and leave when that ends, with a 14-day grace period after a season completes. You only see messages sent after you joined. The club’s owner and designated manager can delete any message in their team chat, stop a member from posting, and archive the chat. Everyone can delete their own messages. Club owners and managers cannot see direct messages or reports.

F. Your controls

• Choose who can send you message requests (everyone, clubmates only, or nobody). People you have shared a team chat with for at least 3 days can message you directly; everyone else starts as a request that you can accept, decline, or block.
• Hide (block) a user: hidden users can’t message you, their team-chat messages are collapsed for you, and their feed posts are hidden. Manage the list in Settings.
• Mute a conversation, leave a team chat (and rejoin from the team page), and report any message you can see.
• Delete your own messages at any time, including in chats you have left.

G. How long messaging data is kept

H. Account deletion

When you delete your account, the messages you sent are deleted, except any that are part of an open or recent report: those stay hidden from everyone until that report expires, after which their text is removed. Your conversation memberships and messaging notifications are removed. Reports you filed are kept without your name (they show “Deleted Player”). Messages other people sent you stay in their copy of the conversation, and the review log is kept for its normal period. See the Account Deletion page.

I. Legal requests

We may disclose message content and related records when we are legally required to do so (for example in response to a valid court order, subpoena, or other legal process), or when we believe in good faith that disclosure is necessary to prevent imminent harm to someone’s safety. We review such requests and disclose only what is required.

J. Minors

The Service, including messaging, is not intended for anyone under 13 (see Section 14). If we learn that an account belongs to a child under 13, we remove the account and its data, including its messages.

12. Gideon (Windows Companion App)

Gideon is an optional Windows app for VirtuaLeagues players. You connect it before launching EA SPORTS FC, and it can launch the game for you. While a session runs, it records which programs, services and drivers are running on that computer and reports this to us. We use it to help keep VirtuaLeagues competitions fair. Neither Gideon nor our fair-play checks make automatic decisions about you or your account.

A session starts when you press Connect (you are then "Connected") and lasts until you end it or quit Gideon. The game session is the part of it from when Gideon detects the game until the game closes. While you are connected, Gideon keeps running in the Windows system tray (notification area), even if you close its window.

Gideon collects nothing until you install it, link it to your VirtuaLeagues account on our website and agree to this section in the app. If you don't use Gideon, this section applies to you in one way only: for league matches you play, league and organization administrators see that you played without Gideon, or that you play on console (see "Who can see it").

A. What Gideon collects

• Your linked computer: the device name shown when you link it, the Windows version, the Gideon version, whether it is the Microsoft Store version or a developer build, a SHA-256 fingerprint of the Gideon program, whether Gideon ran with administrator rights and, if your copy of Gideon creates one, a public key it uses to sign what it sends (a random key made on your computer, not linked to your identity).
• Which computer you use: when you link Gideon and each time a session starts, Gideon sends a one-way code (a SHA-256 hash) made from your Windows installation ID and one made from your motherboard's ID, never the IDs themselves, and we also keep a one-way code made from your IP address, never the address itself. Only our head administrators see these, to spot one computer used with more than one account; nothing happens to your account automatically. This history is kept while your account exists.
• A snapshot when a session starts: the programs running on the computer (name, process ID, parent program, file location, a SHA-256 fingerprint of the program file, the publisher named in its digital signature, signature status and start time), the Windows services (name, display name, state, file location and signature details) and the loaded drivers (name, file location and signature details).
• Changes during the session: programs that start or stop, services that change, when you press Gideon's launch button (which game, and whether it opened the EA app or Steam), when the game is detected (and whether it was started with the launch button or found another way) or closes, any period Gideon could not monitor, and regular check-ins (heartbeats) saying whether the game is running.
• Session details: the game, when the session started and ended, how it ended, when our servers received each part of the data, notes our servers add automatically (for example missed check-ins, data that did not arrive live, an outdated Gideon version, or a game started without Gideon's launch button), and which scheduled VirtuaLeagues matches of your teams took place during the session.
• What our servers work out from it: the game session (when the game was detected, how it was started and how long it ran) and the results of the fair-play checks described below. Nothing extra is collected from your computer for this.
• Linking: a short code you approve on our website and a sign-in token for the app. We store the token only in hashed form, and we record when each linked computer was last seen.
• If Gideon can't open, it sends a short technical report (app version, Windows version, graphics card and driver, how far start-up got). No files, programs or personal data.

B. What Gideon never collects

Gideon does not collect:

• The contents of your files, documents, photos or other personal files
• Screenshots, screen recordings, or audio or video from a microphone or camera
• Keystrokes, passwords or anything you type
• Your browsing history or the content of your messages, chats or emails
• Anything from your computer while no Gideon session is running, except the one-way computer codes sent when you link Gideon (see “Which computer you use”)

C. Why we collect it

• To check sessions against our fair-play rules, and to develop and test tools that help detect cheating software and keep competitions fair
• To show the administrators of the leagues you play in whether you were covered by Gideon during your league matches (see "Who can see it")
• To learn how common each program is across sessions, so ordinary software can be told apart from rare or unknown software
• To find and fix problems with Gideon itself
• To protect the service: we limit how much data a computer can send, and a computer that keeps sending invalid data is locked until a head administrator reviews it

We process this information with your consent, which you give in the app. Showing league and organization administrators whether the players of their league matches were covered by Gideon (including that a player played without it) is based on our legitimate interest in fair league competition. No ban, penalty or other action is ever taken automatically from Gideon data.

D. Fair-play checks

• Head administrators keep fair-play detection rules on our servers (for example the names, file fingerprints or publishers of known cheat programs). Our website checks the records Gideon has already sent against these rules. The checks never run on your computer and collect nothing extra.
• A match only flags a session: either as a known cheat, or as possible cheating awaiting a head administrator's review, which a head administrator can then mark as cleared or confirmed. A flag is evidence for a person to review and never leads to an automatic ban or penalty.
• When the rules change, sessions whose detailed records we still hold are checked again. The results (which rule matched and when, and the matched program's name, file location with your Windows user name removed, fingerprint and publisher) and any decision on them are kept with the session summary.

E. Who can see it

• You can see a list of your own sessions (date, game, duration and status) under Account › Gideon on our website.
• Only VirtuaLeagues head administrators can see the detailed records and the details of fair-play check results (which rule matched, on which program). They may label a session (for example "clean" or "suspicious") with a note, mark a possible fair-play match as cleared or confirmed, and export session records to build and test fair-play checks.
• League and organization administrators of the leagues you play in can see, for each league match of your teams, whether you were covered by Gideon during the hour from kickoff: your name, team, platform (PC or console), the minutes Gideon logged, a status (for example "Logged", "Partial" or "Played without Gideon") and, if a fair-play check flagged a Gideon session of yours that overlaps that hour, a warning label ("Known cheat detected", "Possible cheating, awaiting head admin review", "Cleared" or "Confirmed"). They never see which programs ran, your hardware, file locations, rule names or any other detail of your records.
• Cup, tournament and draft administrators and other players cannot see any of your Gideon data.
• We do not sell Gideon data or share it with advertisers. It is stored with our hosting and database providers.
• Program fingerprints, program names, file locations (with your Windows user name removed), publishers and the number of sessions a program appeared in form a program catalog that is not linked to you.

F. How long we keep it

• Detailed records (the snapshot taken when a session starts, the changes during the session and the times our servers received them) are deleted automatically after 90 days.
• Session summaries (date, game, duration, status, how the game was started and how long it ran, server notes, fair-play check results and the decisions on them, and any labels and notes added by head administrators) are kept while your account exists, unless you ask us to delete them sooner.
• The program catalog described above is kept without any link to you.
• Unused linking codes expire after 10 minutes and are deleted within a day.

G. Unlinking and deleting your Gideon data

• Unlink a computer at any time under Account › Settings › Gideon devices on our website. Its token stops working immediately, so Gideon on that computer can no longer send anything.
• End a session whenever you like by pressing End Session or quitting Gideon (closing its window alone doesn't end it while you are connected). Stop using Gideon or uninstall it at any time. Nothing is collected without a running session.
• Ask us to delete your Gideon data by contacting support@virtualeagues.com. We delete your sessions, their records and your linked computers.
• Deleting your VirtuaLeagues account deletes all of your Gideon data.
• To withdraw your consent, unlink your computers and ask us to delete your Gideon data.

Gideon is offered only to people who meet the minimum age for the Service.