Who is responsible
Last updated: 27 October 2026.
Yvhan MOUAFO YO EI (Farut), M2 c/o YEMELI, 12 impasse de la Vallée, 78800 Houilles, France is responsible for the processing described here. Contact: support@farut.app.
This website
farut.app uses the audience measurement described below, without advertising. Its host, Cloudflare, keeps technical access logs (IP address, date, requested page) to deliver and protect the site. Legal basis: our legitimate interest in delivering and protecting the site.
Your Farut account
Your account is managed by WorkOS, our authentication provider. We receive your WorkOS user identifier and the email address you sign in with. Sign-in codes are emailed by Resend, which receives your address and the code. If you choose Google or Discord, that service sends us the email address it has verified; we use only that address and keep no access to that account. If you choose Sign in with Apple in the iPhone app, Apple sends us the email address of your Apple Account or, if you choose to hide it, a private relay address created by Apple that forwards our emails to you; we use only that address. Apple also gives us a token that can revoke this sign-in: Farut keeps it encrypted (AES-256-GCM), only to revoke Sign in with Apple when you delete your account, and deletes it with the account. The account site app.farut.app uses a session cookie to keep you signed in and, only while you sign in, short-lived cookies (10 minutes at most) that protect that step. All of them are necessary.
We keep the account identifier, the date your trial started, usage counters and calculation timings to apply the trial and calculation limits. We do not store your squads, the contents of your club or your EA account. Legal basis: performance of the contract. This data is kept for as long as your account exists.
UT accounts
A UT account is the Ultimate Team club of the EA account you open in the Web App. When you use the extension on a UT account while signed in to Farut, the extension computes a pseudonymous identifier in your browser: a SHA-256 fingerprint of the selected club's identifier. The club identifier, your EA session, cookies and EA email address are not transmitted to Farut; EA requests remain addressed to EA. Farut receives only the fingerprint. The Farut app computes the same fingerprint on your phone, and Farut uses it in the same way.
Farut uses it to cover at most 2 UT accounts per Farut account and to apply the trial rules: one free trial per Farut account, which starts the first time you use the extension on a UT account while signed in to Farut, and never a second trial for the same UT account. With each link, Farut keeps the date the UT account was added and the date it was last used. The link is kept while it lasts and deleted when you remove that UT account or delete your Farut account. After a removal, the removed UT account’s fingerprint and the date are kept for 30 days, so that it does not take its place back before then. The record that a UT account has used a trial, with the Farut account and the date, is kept for 13 months after the trial started, even if the account is deleted, so that the trial is not given twice. Legal basis: performance of the contract for the links and the UT account limit; our legitimate interest in preventing a free trial from being used twice, for the trial record kept after an account is deleted.
The fingerprint is pseudonymous: it always points to the same club, so it remains personal data.
Calculations
When you start a calculation, the extension sends the challenge rules and card attributes (such as rating, position and price). They are encrypted, inputs are deleted after 15 minutes and results after 30 minutes. Your EA session, cookies, account name and item identifiers are never sent. Legal basis: performance of the contract.
The extension in your browser
Settings, protections, counters and cached prices are stored in your browser. To show prices, the extension sends player identifiers and the selected platform to the price providers you use (for example FUTBIN or FUT.GG), under their own policies. Legal basis: performance of the contract (the features you use).
Autobuyer alerts
If you enable desktop alerts, the extension shows Autobuyer purchases, stops and captchas on your computer. You can also choose a Discord webhook, stored locally in the extension and not sent to Farut. Only when you enable the Discord channel or voluntarily test it does the extension send an alert to that webhook. A purchase alert can include the card name, rating and price, plus purchase and spending counters; stop alerts include those counters. No EA credentials are sent in these alerts. Discord receives the message under its own privacy policy.
Extension usage measurement
Farut records which Farut screens and features you use in the extension, with the date, the extension version and your Farut account identifier, to improve the product and fix problems. It is on by default. You can turn it off at any time on your account’s Data page (app.farut.app/data), linked from the extension’s account window, without changing your access. Nothing from your club, your EA session or what you type is collected. This data is deleted after 30 days and only Farut can access it. Farut also keeps, for 13 months, how many times each screen and feature is used per day, all accounts together and without any account identifier. The dates of your first use of the extension, first calculation, first SBC submitted, first pack opened and first subscription are kept with your account, included in its export and deleted with it. Legal basis: our legitimate interest in improving Farut. We keep your choice and its date for as long as your account exists.
The Farut app
The Farut app for iPhone and Android opens the EA SPORTS FC Ultimate Team Web App and runs Farut inside it, as the extension does in a browser. Each club you add has its own storage space on your phone, separate from the others: the Web App’s cookies and EA session, and Farut’s settings, counters and cached prices for that club, are kept there and are not transmitted to Farut; EA requests remain addressed to EA. Farut does not run on EA’s sign-in pages and never reads your EA password. You can clear a club’s data or remove the club in the app; deleting your Farut account also clears the clubs’ data from the phone.
Inside the Web App, Farut works as in the extension: calculations, prices, Autobuyer alerts and usage measurement follow the sections above, with the same settings, including the measurement choice made on app.farut.app/data. The app sends no notifications: Autobuyer alerts go only to the Discord webhook you choose, stored on your phone. Your sign-in is kept in the phone’s secure storage. To check that its version still works with the Web App, the app reads a public status file on farut.app, without sending any account data. The app contains no advertising and does not track you across other companies’ apps or websites. Legal basis: performance of the contract.
Payments
On farut.app, payments are processed by Sold through Link, LLC (Link), a Stripe affiliate and the merchant of record, with Stripe’s payment companies. They receive your payment details, billing address and email address and process them as controllers under their own privacy policies. Link shares the order data with the publisher. Farut receives the state of the subscription, never your card number. To apply it, Farut keeps the Stripe customer and subscription identifiers, the plan, the current period dates, any scheduled end date, the status and the paid and refunded amounts of the latest invoice, and the references of the payment and management pages opened from your account. This data is kept for as long as your account exists and deleted with it. References of payment notifications received from Stripe (identifier, type, date) are deleted 30 days after processing. Legal basis: performance of the contract. Link and Stripe keep invoices and payments under their own obligations.
Purchases in the app
In the app, the subscription is bought from Apple (App Store) or Google (Google Play), which sell it under their own terms. They receive your payment details and process them as controllers under their own privacy policies; Farut never receives your payment details.
RevenueCat, Inc. (United States) processes in-app purchases on Farut’s behalf, as our processor: it checks purchases with Apple or Google and tells Farut the state of the subscription. It receives a purchase identifier created by Farut (farut_ followed by 32 random hexadecimal characters), never your email address or your Farut account identifier, with the purchases and subscriptions made under that identifier in the app: product, store, dates, state and whether it is a test purchase. Farut keeps a copy of the subscription state (plan, store, period, renewal and status) to apply it in the app, the extension and on the website, without any receipt, transaction identifier or store account. This data is kept for as long as your account exists; when you delete your account, Farut deletes the RevenueCat customer and this copy. References of notifications received from RevenueCat (identifier, type, date) are deleted after 30 days. Legal basis: performance of the contract. Apple and Google keep the transactions under their own obligations.
Yearly renewal reminder
If you have a yearly subscription taken on farut.app, Farut emails you, between three months and one month before each renewal, a dedicated message with the renewal date and the deadline to stop it (article L215-1 of the French Consumer Code). Resend, our email processor, sends it on Farut’s behalf. When sending it, Farut reads the email address recorded by Link when you paid, without keeping it. As proof of sending, Farut keeps the reference of your Farut account, the subscription identifier, the renewal date concerned, the status, the sending date, the template version and languages sent, and the message reference at our email processor, for 5 years after that renewal date, including if you delete your account. Legal basis: our legal obligation (article L215-1 of the French Consumer Code) and performance of the contract, whose terms provide for this reminder, for sending it; our legitimate interest in being able to prove it, for keeping this record.
Cancellation form
When you use the cancellation form at app.farut.app/cancel, Farut receives the email address of your Farut account, the type of cancellation, the reason you give for a cancellation for good cause, the requested end date and the time of receipt. Resend, our email processor, sends the acknowledgement to that address and a copy to Farut support, where the cancellation is carried out. Farut keeps that copy as proof for 5 years after the end of the subscription. Legal basis: our legal obligation to offer cancellation online (section 312k of the German Civil Code) and performance of the contract.
Deleting your account
You can delete your Farut account yourself: in the app, under Account › Delete account, confirmed with a code sent to your email address; on app.farut.app/data, after signing in; or by writing to support@farut.app. The account is disabled at once and its calculations are cancelled. Farut then deletes its data, your WorkOS user, the Stripe customer, which stops a subscription taken on farut.app, and the RevenueCat customer, and revokes Sign in with Apple. The app also clears the clubs’ data and your sign-in from the phone. Deleting the account does not cancel an App Store or Google Play subscription: cancel it in your store, otherwise Apple or Google keeps charging it.
Some data outlives the account, for the periods stated above: a UT account’s trial record (13 months), the proof of yearly renewal reminders and the copy of a cancellation form (5 years). Link and Stripe, Apple and Google keep payments and invoices under their own obligations. Farut also keeps, without your email address, a pseudonymous record of the deletion, so that an old session or a restored backup can never bring the account back; legal basis: our legitimate interest in making the deletion final. Daily backups are erased after 30 days at most.
Transfers outside the European Union
Link (Stripe), Cloudflare, WorkOS, Resend, RevenueCat, Apple and Google may process data outside the European Union, in particular in the United States. These transfers rely on the safeguards the GDPR provides, such as the European Commission's standard contractual clauses or an adequacy decision.
Your rights
You can ask for access, correction, export or deletion of your data, or object to its processing, by writing to support@farut.app. You can also complain to your data protection authority (in France, the CNIL).
Basic audience measurement
We measure page views, visit sources, approximate location, device type, outbound links clicked, key steps and how far the home page is read, to understand and improve Farut. Signed-in visits are linked to the account by its identifier and display name, without sending its email. Payments are linked to the visit, with payment and customer details, including email, received from the payment provider. This measurement runs without prior consent, on the basis of our legitimate interest, and is not used for advertising. The IP address locates the visit and is not kept. Received page and source addresses contain only campaign parameters and no personal codes. The data is stored in Western Europe by our network delivery provider, which may process it outside the EU under its transfer safeguards, and kept for three years.
When you use the extension with your Farut account, four first steps are added once to this measurement: first use in the Web App, first SBC calculation, first SBC submitted and first pack opened. They are linked to your account’s latest measured visit to farut.app or app.farut.app, with that visit’s browser and country, and nothing else from the extension. An objection in this browser stops them from your next signed-in page or extension sign-in, as does turning off the extension’s usage measurement.
These five cookies, shared by farut.app and app.farut.app, recognise visits and attribute sources and payments. The account also uses the necessary session and short-lived sign-in cookies described in the privacy policy.
- datacheap_visitor_id: 365 days
- datacheap_visitor_first_seen_at: 365 days
- datacheap_visitor_session_count: 365 days
- datacheap_session_id: 30 minutes
- datacheap_session_source: 30 minutes
The necessary farut_audience_ignore cookie keeps an objection across both sites for 365 days. The localStorage datafast_ignore flag keeps the choice on this origin until you remove it.
This stops measurement and deletes the five cookies on both sites. Uncheck to allow it again on this site after reloading. If you also objected on the other site, uncheck there too. This choice does not change the extension’s usage measurement, which you can turn off on your account’s Data page.