Privacy policy

What we never collect

• Your EA account password, EA session or login token, or EA account details. The desktop app opens the EA web app on your own computer and talks to EA directly; none of that passes through our servers.
• Payment card details.
• Advertising or analytics trackers. The website and the app don’t use them.

What we collect

• Account: your nick, email address, your password as a one-way hash (scrypt; we can’t read it), your platform (PC or console), when you verified your email and when you signed up.
• Subscription: whether you are an admin, when your subscription ends, and which subscription key you used and when.
• Invites: if you signed up with someone’s invite link, whose link it was, and the free days you and they got for it. The person who invited you gets their days once you’ve made 200 searches in the app; we use your search count only for this. The person who invited you sees only how many people joined with their link, not who.
• Logins: for each device you’re logged in on, a hash of the login token (not the token itself), whether it’s the website or the app, the browser or app name your device reports, and when it was created and last used.
• Trading records from the panel: each session you start (mode, card or filter name, max buy and sell price, what happens after a buy, start and end time, why it stopped, counts and expected profit) and its events: searches (price filters and how many listings were found), buys, missed buys and sales, with times and prices.
• Trial and EA account: if you’re on the free trial, the app links your account to the EA account you use in the web app, so the trial can be used once per EA account. We never receive your EA account id itself, only a one-way hash of it, which we hash again with a secret key before storing it.
• Payments: if you subscribe, your plan, its status and renewal or end date, and Lemon Squeezy’s id for your subscription. Your card and billing details go to Lemon Squeezy, not to us.
• Match predictor and tokens: the scores you predict and when, the tokens you get and spend, and what you buy in the store.
• Card images: when the app draws a card for the first time, it sends the image to us so cards can be shown on the website. We store the image with the card’s id and which account sent it.
• Email links: hashes of the verification and password reset links we send you.
• Technical: our server logs record the request method, path and response code. They don’t record passwords, tokens, cookies or request bodies. Your IP address is used briefly in memory to limit repeated attempts (for example, too many logins) and isn’t stored in our database.

Why we use it

• To run your account and the service you asked for: logging in, checking your subscription, showing your Dashboard and the Stats Zone leaderboard, running the match predictor and store, and warning you before you search too much.
• To keep the service safe: limiting repeated attempts, detecting abuse of subscription keys and keeping logs short and free of secrets.
• To send you the emails you need: email verification and password reset. We don’t send marketing email.

Who can see it

• Other users: the Stats Zone leaderboard shows logged-in users the nicks, profits and best snipes of top accounts, including yours if you’re among them.
• Our admins: your nick and subscription status, to manage subscription keys.
• Service providers that run the service for us: Fly.io (our API and database, in Frankfurt, Germany), Vercel (hosts the website and may log visitors’ IP addresses), Resend (delivers our emails), Lemon Squeezy (sells our subscriptions as merchant of record; when you subscribe we send them your email and an id that links the payment to your account), GitHub (hosts the app downloads; the download page and the app ask GitHub for the latest version, so GitHub sees your IP address then), API-Sports (match data for the match predictor; team logos on the website load from their server, so they see your IP address then) and Google Analytics (counts website visits; see Cookies below). The desktop app and the panel don’t use Google Analytics.
• Discord and X only if you open our links there; their own policies apply.
• We don’t sell or rent your data, and we don’t share it with anyone else unless the law requires it.

Cookies and storage on your device

• Website: one cookie, esf_session, keeps you logged in. It can’t be read by scripts and expires after 30 days without use. The site remembers your language and cookie choices in your browser’s local storage. Analytics: if you accept in the cookie banner, Google Analytics sets its cookies (_ga, up to 2 years) to count visits: pages viewed, referrer, device and browser type and approximate location. If you decline, no analytics cookie is set and Google only receives cookieless counts. Your account details are never sent to Google, and links with one-time tokens are removed from the address before Google Analytics loads. You can change your choice any time under “Cookie preferences” at the bottom of the site.
• Desktop app: your login, language and panel settings are stored on your computer, encrypted with your operating system’s keychain where available. The EA web app inside the app keeps its own cookies, as in a normal browser.
• Chrome extension: the same panel runs inside the EA web app in your Chrome browser. Your login, language and panel settings are stored in Chrome’s extension storage on your computer. The extension only runs on the EA web app and talks only to EA and to our API; it loads no code from elsewhere.
• Sales ledger (desktop app and extension): the cards you sell, with their buy and sell prices and the time the sale was seen, are stored only on your computer and never sent to us. To keep several EA accounts apart, each sale is marked with a one-way hash of the EA account it was seen on, not the account itself.

How long we keep it

• Search records: 3 days, then deleted automatically. Your session totals (including the number of searches) stay.
• Logins: until you log out, or 30 days after last use.
• Email verification links: 24 hours. Password reset links: 1 hour.
• Account, subscription, trading records (sessions, buys, missed buys, sales), predictions and tokens: as long as your account exists.
• Backups of the database are kept for up to 5 days.

Security

Passwords are hashed with scrypt, login and email link tokens are stored only as SHA-256 hashes, the database runs on an encrypted volume that isn’t reachable from the internet, and all traffic uses HTTPS. No system is perfectly secure; if a breach affects your data, we’ll tell you.

Your rights

Under Turkey’s Personal Data Protection Law (KVKK, Law No. 6698) and, where it applies, the EU GDPR, you can ask what data we hold about you, have it corrected, have it deleted, object to how we use it and get a copy. You can change your platform yourself under Settings. To use any other right, including deleting your account and all its trading records, contact us as described below; we’ll answer within 30 days.

Age

EasySnipeFut is meant for people aged 18 or over. We don’t knowingly hold data about anyone younger.

Changes

If we change what we collect or how we use it, we’ll update this page and the date at the top. For important changes we’ll also announce them on our Discord server.

Contact

For privacy questions and requests, email help@easysnipefut.com from the email address on your account, or message the EasySnipeFut team on our Discord server (links below).

Email usOpen Discord