Privacy
Last changed on 13 October 2026
This page says what we keep about you, why, for how long, and who else is involved. The short version: we keep as little as we can, we never sell anything, there are no ads or trackers, and your club stays in your own browser.
- Who is responsible
- What we keep and for how long
- Your account
- Buying and cancelling
- Email with us
- Cookies
- In your browser
- The add-on
- Visits and logs
- Pictures
- Who else is involved
- Your rights
- No automated decisions
- Age
- Changes
Who is responsible
Squad Butler is run by the owner of squadbutler.com, the Netherlands. That business is responsible for your data (the "controller").
KvK number (Dutch Chamber of Commerce): .
For any question, or anything you want us to do with your data, email support@squadbutler.com. There is no separate data protection officer: your email goes straight to the person who runs Squad Butler.
What we keep, why, and for how long
| What we keep, and why | Legal ground | How long |
|---|---|---|
| Your account, subscription, licence key and the computers it runs on, to run your account and your subscription | Contract | Until you delete your account |
| Records of signed-in browsers, to keep you signed in safely | Contract | 30 days unused, at most 182 days |
| Withdrawal and cancellation requests, and a note of which confirmation emails we sent, to handle them and show that we did | Legal obligation and legitimate interest | 2 years |
| Payment records our bookkeeping needs | Legal obligation (tax law) | 7 years |
| Notes of payments, renewals, cancellations, withdrawals, refunds, disputes, downloads, plan changes and emails that could not be sent, with your email address, to help when something goes wrong | Legitimate interest | 90 days |
| Email you send us, to answer you | Legitimate interest, or contract when it is about your subscription | At most 2 years after your last message |
| Visit counts, without IP addresses, to see how the site is used | Legitimate interest | 90 days |
| The server's own log, with at most your username, to find and fix faults | Legitimate interest | 30 days |
| Backups of the account database, so nothing is lost when something breaks | Legitimate interest | 7 days on the server, 30 days on our own computer |
| How often an IP address used the site, tried to sign in or checked a key, to stop abuse | Legitimate interest | In memory only, never written down; gone at the latest when the server restarts |
"Contract" means we need it to give you the service you asked for (article 6(1)(b) GDPR). "Legal obligation" means a law requires it (article 6(1)(c) GDPR). "Legitimate interest" means we need it to keep the site working, safe and helpful, and we have weighed that against your privacy (article 6(1)(f) GDPR). You can object to it, see Your rights. We do not ask for your consent for anything, so there is no consent to withdraw. We never use your data for advertising and never sell it.
Your account
To make an account you need an email address, a username and a password, or a Google account if Sign in with Google is offered. Without them we cannot make an account, and without an account you cannot buy a subscription. The free tools work without one.
For your account we keep:
- Your email address and username. Our logs show your username, not your email address.
- Your password, but only as a salted scrypt hash. Nobody can read it back, us included.
- Your subscription: which plan and until when, and your licence key. Every account also gets a random payment reference, which links a payment to your account. If you paid, we also keep Stripe's reference numbers for you, your subscription and your last payments, and when you first paid, so the account page can offer the 14 days to withdraw.
- The computers your key runs on: a one-way hash of the add-on's device id, a label like "Windows, Firefox" if an older version of the add-on sent one (otherwise just "a computer"), when the computer started using the key, and when the key was moved.
- A record of each signed-in browser: only a hash of the sign-in cookie's code, plus when it was made and last used.
- When you signed up.
If you use Sign in with Google, Google gives us your email address, your name (only used to suggest a username) and an account number, so we recognise you next time. We never see your Google password.
Deleting your account
Your account stays until you ask us to delete it. Email us from the address on the account. We then delete the account, its sign-in records and the notes that mention your email address. The server keeps 7 days of backups, and copies on our own computer are deleted once they are 30 days old, so deleted data is gone from every backup within 30 days.
Some things stay. Payment records our bookkeeping needs are kept for 7 years, because Dutch tax law requires it (article 52 of the Algemene wet inzake rijksbelastingen). Withdrawal and cancellation requests are kept for 2 years. Link and Stripe keep their own records of your payments; ask them to delete those. Asking Stripe to delete your data also cancels your subscription.
Buying, cancelling and withdrawing
- When you press a plan button, we send Stripe your account's email address and a random reference, so the checkout is filled in and the payment lands on your account. From there Link ("Sold through Link, LLC"), part of Stripe, sells you the subscription as the seller of record. What you enter at checkout, such as your payment details, is up to Link and Stripe under their own privacy policy.
- From Stripe we get your email address, the plan, whether the payment went through, and Stripe's reference numbers for you, your subscription and your payments, and later any renewal, cancellation, refund or dispute. Never your card or bank details.
- When you cancel on your account page, we keep the request: your account, your plan, the date your subscription ends, and the date and time. When you cancel at link.com, Stripe tells us and we keep the same record. For a yearly plan that has renewed, we also note how many months we pay back.
- When you withdraw on the page Withdraw from a purchase, or by email, we keep what you gave us: your name, the email address you paid with, the order reference if you gave one, the email address for the confirmation, and the date and time. Only the order reference is optional: we need the rest to find your purchase and confirm your withdrawal. If you are signed in, or the email address you paid with belongs to an account, we link the request to that account.
- Confirmation emails. When you buy, cancel or withdraw, we email you a confirmation from support@squadbutler.com, sent through Brevo. It contains your email address, your name if you gave it, and what you bought, cancelled or withdrew from. If somebody withdraws by typing the email address of your account while not signed in, and asks for the confirmation to go somewhere else, we also send a short notice to your account's own address. It says only that a withdrawal was asked for, nothing the other person typed.
We keep withdrawal and cancellation requests for 2 years, to show that we handled them as the law requires. Payment records our bookkeeping needs, such as the date, the amount, the plan and Stripe's reference, are kept for 7 years.
Email with us
Mail to support@squadbutler.com or hello@squadbutler.com is received by Cloudflare Email Routing, which passes it on to our mailbox at Google (Gmail). Our replies, and the confirmation emails above, are sent through Brevo (France), so they come from support@squadbutler.com. We keep an email conversation as long as we need it to help you, and delete it at the latest 2 years after your last message.
Cookies
The site only uses cookies it cannot work without, which is why there is no cookie banner.
- sb_session keeps you signed in. It holds a random code, not your details, and runs out after 30 days or when you sign out.
- sb_oauth_state and sb_oauth_verifier only exist during a Google sign-in, for at most 10 minutes, to check the answer really comes from Google.
- Cloudflare, which protects the site, can set a short-lived security cookie to tell visitors from bots.
No advertising cookies, no analytics scripts, no tracking pixels. Every cookie and every item in browser storage is listed on the Cookies page.
What stays in your browser
Some things are kept in your own browser's storage, never on our server: your choices on the site (platform, sorting, the SBC group you had open, the challenges you ticked off, Reduce motion), card details for up to a day, squads the site already built for you, and your club.
When the add-on hands your club to the SBC page, or you load it from a file, it is stored in your browser only. The squad builder runs in your browser too, so your club is never sent to us. A card from your own club only shows a player picture that was already loaded for a card from the market, so not even the picture requests tell our server who is in your club. Forget my club on the SBC page, or clearing this site's data in your browser, removes it. If the add-on is installed, the SBC page takes your club from the add-on again the next time you open it. The add-on's own copy goes when you remove the add-on.
The add-on
About twice a day the add-on asks squadbutler.com whether your licence key is active. With that question it sends:
- your licence key and
- a random id the add-on made for this computer (we only keep a one-way hash of it).
Versions of the add-on up to 3.2.19 also sent their version number and a label like "Windows, Firefox". Newer versions do not, and your account page then calls the computer "a computer".
That is how one key stays on one computer. When a check is refused or a new computer takes over a key, our server log notes your username and what happened (and the version number, from versions up to 3.2.19 that still send it), never the key. In Firefox the add-on also asks our server for updates; we only count which versions are asked for. The add-on also downloads a public list of club, league and nation names from squadbutler.com when it needs one. That request carries nothing about you, and our server does not log it.
Everything else happens on your own computer. The add-on works inside EA's web app with your own EA session: we never see your EA login, your club or your coins. What you do in the web app is between you and EA, under EA's own privacy policy. The add-on keeps its settings, your key, a log of what it did and what it bought in your own browser: in the storage of EA's web app page on www.ea.com and in your browser's storage for add-ons. None of that is sent to us.
To look up prices and the FUT Gallery, the add-on asks fut.gg and futbin.com straight from your browser, without cookies. Those sites therefore see your IP address, as with any site you visit. This only happens from the add-on inside the EA web app, never from the pages of this site.
Visits and server logs
- We count page views per day, which site sent a visitor (only the site's name) and how many different visitors there were. To count someone once a day, the IP address is run through a one-way hash with a secret that is thrown away every night. The IP address itself is never stored, and nothing is stored on your device for this. These counts are deleted after 90 days.
- When you pay, renew, cancel, get a refund or open a dispute, download the add-on, or your subscription or number of computers is changed, we note your email address with it, to help when something goes wrong. Those notes are deleted after 90 days.
- To stop abuse, the server counts how often an IP address uses the site and tries things such as signing in, making an account, withdrawing or checking a licence key. Each count covers an hour at most. The counts and the IP addresses are kept in memory only, never written down, and are gone at the latest when the server restarts.
- Our server's own log (licence checks, payments, errors) names at most your username, never your email address or IP address, and is deleted after 30 days.
- The web server does not keep a log of visits with IP addresses.
We keep these to keep the site working and safe, which is our legitimate interest.
Pictures
Every picture on this site comes from squadbutler.com itself. The site draws the cards; player pictures, club badges, flags and league logos are EA's public files, which our server fetches and passes on. So your browser does not contact EA, fut.gg or anyone else for pictures. The site's security settings (its Content-Security-Policy) only allow pictures, scripts, styles and fonts from squadbutler.com.
Other sites we link to, such as Stripe, Link and the Autoriteit Persoonsgegevens, have their own privacy rules.
Who else is involved
- Hetzner Online (Germany) hosts our server in a data centre in the EU. Your account data lives there.
- Cloudflare (USA) passes every visit on to our server and protects it against attacks, so it sees IP addresses and which pages are asked for. It also receives mail sent to our addresses and passes it on (Email Routing).
- Google (Ireland and USA) runs the Gmail mailbox where your emails to us arrive. Separately, if you choose Sign in with Google, Google is responsible for your Google account itself, under its own privacy policy. Google also runs the Chrome Web Store: if you use Chrome, you add the add-on there and Chrome fetches its updates from it, under Google's own privacy policy. From the store we only see totals, such as how many people use the add-on.
- Brevo (France) sends our emails: replies to you and confirmations.
- Link and Stripe (USA): Link ("Sold through Link, LLC"), part of Stripe, sells the subscription as the seller of record and handles payments, VAT, receipts and refunds. For what you enter at checkout it decides for itself what it keeps, under Stripe's and Link's own privacy policies.
- fut.gg and futbin.com only see your IP address when the add-on asks them for prices from your browser inside the EA web app (see The add-on). We send them nothing about you. Our server also fetches prices and SBC lists from fut.gg, and pictures from EA, on its own; nothing about you goes along.
Cloudflare, Google and Stripe are American companies. They take part in the EU-US Data Privacy Framework, which covers data that reaches them from the EU. We never sell your data or share it for advertising.
Your rights
You can ask us:
- to see the data we have about you (access);
- to correct it;
- to delete it;
- to limit what we do with it for a while, for example while we look into a complaint (restriction);
- to stop using it where we rely on our legitimate interest (objection);
- for a copy of the data you gave us, in a common file format you can take elsewhere (portability).
Email support@squadbutler.com from the address on your account, so we know it is you, and you will get an answer within a month. If you are not happy with the answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the one in your own country.
No automated decisions
We make no decisions about you by computer alone that have legal or similarly important effects, and we do no profiling. The licence check only applies the one-computer rule from the Terms. If it gets something wrong, email us and a person looks at it.
Age
Accounts are for people aged 16 and over.
Changes
When this page changes in a way that matters, the site will say so. The date at the top shows the last change.