Loading OneFPL page
Last updated: 19 September 2026. This explains the cookies and browser storage OneFPL uses.
OneFPL uses your browser’s local storage to remember your FPL Team ID and preferences (such as your chosen mode). This is required for the app to work and contains no personal identifiers beyond your public FPL Team ID.
If you sign in to an optional OneFPL account, Supabase sets essential authentication cookies. They keep your session active and contain account identifiers and security tokens. They are not advertising cookies. Signing out clears the active OneFPL session.
We use Google Analytics (via Google Tag Manager) to understand which features are used and to improve the app. It is used only in aggregate - we never send it your FPL Team ID or anything that identifies you.
Google Analytics loads only if you allow it. We ask on your first visit, and no analytics cookie is set until you choose - if you decline, Google Analytics is never loaded at all, rather than loaded and told to ignore you. Declining is one click and changes nothing about how OneFPL works. To change your mind, clear this site’s data in your browser and we will ask again.
We use Microsoft Clarity to see how pages are actually used - where people click, how far they scroll, and where a layout goes wrong on a particular screen size. It replays sessions as anonymous recordings and aggregates them into heatmaps. It sets two cookies, “_clck” and “_clsk”, which tell one visit apart from the next. They hold an identifier for your browser, and Clarity also shares that identifier with Bing, which is part of the same company - so this is a cookie that recognises you across visits, not merely a counter.
Recordings are masked, and OneFPL enforces that in its own code rather than relying on a setting: every page asks Clarity to withhold the text it contains. Clarity records the structure of the page and what you did on it - where you clicked, how far you scrolled, where something broke - but not the words on it, so your FPL Team ID, your team name and anything you type are not captured.
Clarity is covered by the same choice as Google Analytics above: it is loaded by OneFPL only once you have agreed, so if you decline it is never loaded at all - not loaded and told to ignore you.
Cloudflare serves OneFPL, and its Web Analytics measures page views and loading speed. It is cookieless: it stores nothing on your device and creates no identifier for you, so there is no cookie to ask permission for and it is not part of the choice above. It records the page address, the site you arrived from, and timing figures.
It runs before OneFPL’s own code does, because Cloudflare adds it at the network edge rather than the app loading it - which is also why OneFPL cannot switch it off per visitor. If you would rather no third-party measurement ran at all, a tracker-blocking extension will stop it, and nothing about OneFPL will change.
OneFPL is set up to show light advertising through Google AdSense, which sets its own cookies. It is not switched on yet - the wiring exists so that turning it on is a single deliberate step, and until then no ad code loads for anyone.
When it is on, two limits apply and both are enforced in code rather than by policy:
Who asks depends on where you are. Google requires a certified consent message for visitors in the UK, the EEA and Switzerland, and that message is Google’s own - so if you see two boxes, they are asking different questions: ours covers analytics, Google’s covers advertising. We deliberately do not ask about ads twice, because two answers to one question can disagree.
Declining means the ad code is never loaded at all, not loaded and asked to behave. Core FPL tools carry no advertising either way.
We publish an ads.txt file, which is the public record of who is authorised to sell advertising on OneFPL. It names Google and nobody else.
You can clear cookies and local storage at any time in your browser settings. See our Privacy Policy for more.