Privacy Policy

Last updated: March 24, 2025 — Effective date: March 24, 2025

1. Introduction

This Privacy Policy explains how Tangerina Labs (“we,” “us,” or “our”), registered in Brazil under CNPJ 59.599.938/0001-12, collects, uses, and protects information when you use FutGuru (the “Extension” or “Service”), available at https://futguru.com.

We are committed to protecting your privacy in compliance with the Brazilian General Data Protection Law (LGPD – Lei nº 13.709/2018) and, where applicable, the General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Account Data (stored on our servers)

When you register, we store the following in our database:

FieldDescription
emailYour email address
password_hashbcrypt hash of your password — we never store your password in plain text
display_nameYour display name
avatar_urlProfile picture URL (Google OAuth only)
google_subGoogle account identifier (Google OAuth only)
ea_persona_idYour EA persona ID, used to sync your club
stripe_customer_idStripe identifier for billing management
created_atAccount creation timestamp

2.2 Subscription Data (stored on our servers)

FieldDescription
Stripe subscription IDTo manage your active subscription
Subscription statusActive, canceled, past due, etc.
Plan tier and priceWhich plan you are on
Billing period start/endCurrent billing cycle dates
Cancellation statusWhether cancellation is scheduled

2.3 Game Data (stored on our servers)

By using FutGuru, you authorize us to collect the following game-related data from the EA Web App:

  • Club roster (club_players): Player IDs, ratings, positions, rarities, and names — synced to enable SBC solve calculations.
  • SBC solve logs (solve_logs): SBC name, requirements, the squad solution (player IDs, ratings, positions, rarities, names, estimated cost), pool size, solve time in milliseconds, and submission status.
  • Player blocklist (player_blocklist): Players you manually protect from being used in solutions.
  • Solver feedback (solver_feedback): Optional ratings or comments you submit about generated solutions.

2.4 Data Stored Locally in Your Browser

The Extension uses chrome.storage.local to store the following exclusively on your device — this data is never transmitted to our servers:

  • JWT authentication tokens (fg_access_token, fg_refresh_token)
  • Cached user profile and subscription status (fg_user, fg_sub_status)
  • Extension settings (blockedLeagues, solverUrl)
  • UI state (onboarding progress, dismissed upsells, combo preferences)

2.5 Data We Do NOT Collect

  • We do not store your EA account password or EA login credentials.
  • We do not use cookies, localStorage, or sessionStorage — on the Extension or on the landing page.
  • We do not collect your IP address persistently. IP is used in-memory for rate limiting only (auto-purged every 5 minutes) and is never written to our database.
  • We do not collect your browser’s User-Agent string.
  • We do not use any analytics, tracking pixels, or telemetry tools (no Google Analytics, Mixpanel, Hotjar, PostHog, Segment, or similar).
  • We do not sell your data to any third party.

3. How We Use Your Data

PurposeData Used
Authenticate your account and maintain your sessionEmail, password hash, JWT tokens
Sync your EA club for SBC calculationsClub roster, EA persona ID
Calculate and store SBC solutionsSolve logs, player blocklist
Manage your subscriptionStripe customer ID, subscription data
Optional login via GoogleGoogle OAuth sub, display name, avatar
Respond to your feedbackSolver feedback
Comply with legal obligationsAny data required by law

We do not use your data for advertising, profiling, or any purpose beyond providing and improving the Service.

4. Data Storage and Security

DataLocationControlled By
Account, subscription, game dataNeon DB (PostgreSQL, cloud)Tangerina Labs
JWT tokens, settings, UI stateChrome local storageYou (your device)
Payment informationStripe serversStripe, Inc.

Our backend runs on FastAPI with JWT-based authentication. Passwords are hashed using bcrypt. All connections use HTTPS/TLS encryption.

No system is 100% secure. We cannot guarantee absolute security, but we follow industry best practices to protect your data.

5. Cookies and Tracking

FutGuru uses no cookies, no localStorage, and no tracking technologies — on either the Extension or the landing page (futguru.com).

The only storage mechanism used is chrome.storage.local within the Extension, exclusively for authentication tokens and settings, as described in Section 2.4.

6. Third-Party Services

ServicePurposePrivacy Policy
Google OAuthOptional account loginpolicies.google.com/privacy
StripePayment processingstripe.com/privacy
FUT.GGPlayer market price data (public API)fut.gg

We are not responsible for the privacy practices of these third parties.

7. Data Retention

DataRetention Period
Account dataRetained while account is active; deleted upon request or after 12 months of inactivity
Game data (club, solve logs, blocklist)Retained while account is active; deleted upon account deletion
Subscription/billing recordsRetained as required by Brazilian law (typically 5 years)
Chrome local storageRetained on your device until you clear it or uninstall the Extension
IP addresses (rate limiting)Never persisted — cleared from memory every 5 minutes

8. Your Rights

Under the LGPD (Art. 18), you have the right to:

  • Confirm whether we process your personal data.
  • Access a copy of the data we hold about you.
  • Correct incomplete, inaccurate, or outdated data.
  • Anonymize, block, or delete unnecessary data or data processed in violation of the LGPD.
  • Data portability in a structured, interoperable format.
  • Information about third parties with whom we share your data.
  • Revoke consent at any time.
  • Object to processing that violates the law.

For GDPR (EU/EEA users): You also have rights under Articles 15–22 of the GDPR, including the right to erasure (“right to be forgotten”) and the right to restrict processing.

To exercise any of these rights, contact us at felipe@tangerina.agency. We will respond within 30 days.

9. Children’s Privacy

FutGuru is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe we have done so inadvertently, please contact us immediately so we can delete the data.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via the Extension or by email. Continued use of the Service after changes constitutes acceptance of the updated Policy.

11. Data Controller / DPO Contact

Tangerina Labs — Data Controller
Email: felipe@tangerina.agency
Website: https://futguru.com
Address: Rua José Ramon Urtiza, 181, São Paulo - SP, Brazil