Gaffer — Privacy Policy

Last updated: 11 September 2026

Gaffer is a Chrome extension for running a football draft with friends on EA's public player ratings page. This policy describes exactly what it stores, what leaves your computer, and who can see it.

What stays on your computer

Everything below is held in the browser's own extension storage on your machine and is not sent anywhere unless a section further down says it is:

• Your squads: friends, players signed, bid amounts, budgets and formations
• Your settings: price rules, default budget and squad size
• Tournaments and fixtures you create
• Saved drafts (the history of past bidding sessions)
• Your profile: the display name and colour you choose, and your Gaffer id
• Your AI provider API key, if you choose to add one

Removing the extension removes all of it.

What leaves your computer

1. When you host or join a shared draft. A shared draft is optional. Nothing is shared until you press Host or join with a friend's id. From that point, this is sent to a Google Firebase Realtime Database operated by Gaffer's developer:

• your display name, colour and Gaffer id
• your squad: which players you have signed and for how much
• your bids and auction activity, and the activity log of the draft

Everyone in that draft can see it. That is the point of a shared draft. Nobody outside it can: the database's rules restrict every read and write to the people the host has admitted.

2. Anonymous sign-in. To talk to that database, the extension signs in anonymously with Firebase Authentication. This creates a random account identifier. No email address, no Google account and no name is involved, and Google receives no profile information from the extension.

3. When you use the AI coach. The coach is optional and off until you add your own API key. When you ask it for advice, your browser sends the prompt — squad names, player names, budgets and the question — together with your API key directly to the provider you selected (OpenRouter, OpenAI, Anthropic, Google, Groq, Mistral, DeepSeek, Cerebras, Together or NVIDIA). It goes from your browser to them. It does not pass through any Gaffer server, and your API key is never sent anywhere else. That provider's own privacy policy governs what they do with it.

4. The ratings page itself. The extension reads the EA ratings page you have open in order to show budgets and signing controls next to the players. It reads that page only, it does not send its contents anywhere, and it does not read any other page or your browsing history.

What Gaffer never does

• No analytics, telemetry, crash reporting or usage tracking of any kind
• No advertising, and no data sold, rented or shared with data brokers
• No access to your browsing history, bookmarks, passwords, cookies or other tabs
• No collection of your email address, real name, location or payment details
• No use of your data to train any model

How long shared-draft data is kept

Leaving a draft deletes your membership row from it. Closing a draft stops it, but the record of that draft remains in the database so the people in it can still look back at what was signed. To have a draft's data removed entirely, contact the developer at the address below with your Gaffer id and it will be deleted.

Children

Gaffer is not directed at children under 13 and does not knowingly collect information from them.

Third parties

• Google Firebase (Realtime Database and Authentication) stores shared-draft data and issues the anonymous sign-in.
• AI providers receive only what section 3 describes, and only if you set one up.

No other third party receives anything.

Changes

If this policy changes, the date at the top changes with it and the updated version is published at this same address.

Contact

Questions, or a request to delete data: shahidhakim0@gmail.com