Privacy policy

GiBi FUT Tools is a Chrome extension that works inside the EA Sports FC Ultimate Team Web App; gibifut.com is the website that presents it and where the GiBi account is created. Both are developed by GiBi Society, the data controller, reachable at service@gibifut.com.

GiBi FUT Tools is not affiliated with or endorsed by Electronic Arts. EA, EA Sports FC, FUT and Ultimate Team are trademarks of Electronic Arts Inc.

No advertising, no tracking, no data sold or shared with third parties. We process only what the account and the extension's features need: the email and password of the GiBi account (the password is stored encrypted by the authentication provider), an activation code, an anonymous fingerprint of the EA account and the market prices measured, which are anonymous and shared among all users.

The extension runs only inside the EA Sports FC Web App, never reads EA credentials and contains no remote code.

Email, password and username: the account is created on gibifut.com through Supabase Auth, the authentication service of our database, which stores the password as a hash and sends the password-recovery emails. The username is optional and only used for the greeting in the profile.

Profile: creation date, active plan and expiry, credits, promo codes redeemed (code and date), date of the last extension start and version used, account status (active or suspended).

Activation code: a unique code (GIBI-XXXX-XXXX-XXXX) generated when the account is created. You copy it from the profile and paste it into the extension: it is the only account data the extension knows.

Session: while signed in, the site keeps the session in technical cookies (sb-…-auth-token) needed to recognise you from one page to the next. There are no profiling cookies.

Legal basis: performance of a contract (art. 6.1.b GDPR), i.e. providing the service you requested by creating the account.

Activation: the activation code is sent to our Supabase project, which links it to your account and issues a session. The extension never reads your email or password. The session token stays in the extension's service worker, in your browser, until you press Deactivate or remove the extension.

EA account fingerprint: to bind a GiBi account to a single EA account we store a SHA-256 hash of the EA persona identifier, together with the player name and the link date. The plain identifier never leaves the browser. You can unlink the EA account from the profile (once every 30 days).

Market prices: the lowest buy-nows the extension measures on the EA market are sent anonymously to the shared archive (card id, price, platform, date and a random client identifier) and made available to all users as reference prices and history. No data about your cards, coins or transactions.

FUT Gallery collection: for the Album plans, the list of collected card ids (with the holographic and first-owner flags) is stored in the shared archive under the EA account fingerprint, not your email address, so it can be restored on another browser.

Data stored in the browser (ea.com localStorage and the extension's chrome.storage): settings, Trader filters, purchase log, price archive, caches and the state for the popup. They stay on your computer, are never sent anywhere and can be cleared from GiBi → Data saved in the browser or by removing the extension.

Earlier versions: versions up to 2.60 also registered a device identifier. Those versions are blocked and their records are deleted with the account.

Legal basis: performance of a contract (art. 6.1.b GDPR) for activation, EA fingerprint and collection; legitimate interest (art. 6.1.f) for the anonymous price archive, which cannot be traced back to you.

storage: keeps the account session in the service worker and the extension state for the popup.

Host www.ea.com: the EA Sports FC Web App the extension works in. The extension only activates on https://www.ea.com/*ultimate-team/web-app/* and uses the same calls as the Web App, from your browser and with your session.

Host of our Supabase project (agtxblycwzxzmwrzhwpt.supabase.co): activation, shared price archive, history, collections, reference prices and card sheets, for authenticated users only.

No other permission, no access to other tabs or sites, no code downloaded remotely: all the code is in the package published on the Chrome Web Store.

We do not sell, share or rent data to anyone. We show no ads and do not use data for profiling or marketing.

We do not read EA credentials, your EA email or pages other than the EA Sports FC Web App.

We do not use data for purposes other than those described here: the information collected by the extension serves its features only, in line with the Chrome Web Store limited-use rules for user data.

We do not process data of children under 14: the service is not aimed at them.

Hosting: the site is served by Vercel, which keeps technical request logs (IP address, page, date) for as long as strictly needed for security and to run the service.

Statistics: we use Vercel Web Analytics, which counts visits in aggregate, without cookies and without identifying visitors.

Cookies: technical only. The account session (see above) and the language preference. No third-party cookies.

External links: pages link to the Chrome Web Store, the EA Web App and the GiBiArena and GiBiScore sites, which have their own policies.

Supabase (database, authentication, functions): our project is hosted in the us-east-1 region (United States) on AWS infrastructure. The transfer is covered by the European Commission's standard contractual clauses included in Supabase's data processing agreement.

Vercel (website hosting and aggregate statistics): global network headquartered in the United States, with the same contractual safeguards.

Electronic Arts: the extension talks to EA servers through the Web App, with your EA session; EA processes that data under its own policy. We receive nothing from EA.

No other recipient. Providers process data only on our behalf and under our instructions.

Account and profile: for as long as the account exists. On deletion, the profile, activation code, EA fingerprint, redeemed codes, linked collection and sessions are removed.

Price archive: prices are anonymous and stay in the shared archive indefinitely as market history; the random client identifier is not linked to the account.

Technical logs of the hosting: for the provider's retention period, in any case no more than a few days.

Browser data: until you clear it from the extension or remove the extension.

Under articles 15–22 of the GDPR you can request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest. You can also lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Deleting the account: write to service@gibifut.com from the account email; we delete the account and all related data within 30 days. The password is changed from the profile; the EA account is unlinked from the profile.

If this policy changes, the new version is published at this address with the updated date. Substantial changes are announced in the extension or in the profile.

GiBi Society · service@gibifut.com · https://gibifut.com