Privacy

Updated 1 October 2026.

This notice covers the FUTLoom website, optional accounts and the free browser extension. Contact contact@futloom.com with privacy questions or requests.

The free extension

The FUTLoom extension does not require a FUTLoom account, contact the membership service, or contain advertising or analytics code. It reads club, squad, player, market and persona information available in your signed-in EA Web App to display tools and carry out actions you choose. It does not ask for your EA password.

Settings, player locks and inherited FSU preferences use extension-local storage. Saved filters, the one-click preference, Gallery caches and observed ownership use the EA page's local storage. Gallery history is separated by game year, platform and persona. Stored data remains until cleared. Uninstalling clears extension storage but may leave EA page storage; browser site-data controls can clear that storage and may also affect EA's settings and sign-in.

External extension services

EA receives requests for club, SBC and market actions. The current EA session identifier may be sent to the specifically allowed EA market endpoint. FUT.GG supplies Gallery sets, card pools and prices. FUTBIN's futbin.org API supplies player searches, squad and price information. FUTNEXT supplies inherited price and pack/player-pick information. These requests can contain game-year, set and player identifiers, search filters and platform. The legacy FC26 api.fut.to metadata loader is disabled in FC27.

Public-data requests omit browser credentials. EA session headers are restricted to the allowed EA market endpoint. Providers receive normal connection information, including IP addresses, and process it under their own policies.

Optional website accounts

If you create an account, FUTLoom stores your email address, a password hash, email-verification status, hashed sign-in tokens and hashed email-action tokens. Account-security emails are sent through Simply.com using accounts@futloom.com. Messages wait in an encrypted queue and are removed after delivery or expiry. Verification and password-reset links expire and can be used once. Browser sign-in tokens use session storage. Changing your password or signing out on all devices revokes server sign-in tokens.

Accounts support registration, sign-in, email confirmation and password recovery. They are optional and do not unlock additional extension features. We process this information to provide the account service you request. Security rate limits and hosting access logs are used to protect the service against abuse.

Hosting and retention

Simply.com hosts the website, account database and email service. The host may process connection information and access logs, including IP addresses. Account records remain while the account is maintained. Token records have expiry dates; expired rate-limit records are cleaned during requests. Contact us to request account deletion or details about retained records. There is currently no self-service account-deletion button.

Historical Stripe sandbox customer identifiers, order records and payment-event identifiers may remain from development tests. These were test transactions, not real payments. This free version does not start checkout or refresh membership through Stripe.

Website advertising

The website includes Google AdSense. If advertising is enabled for your visit, Google and its partners may use cookies or similar technologies and process information such as your IP address, device and browsing activity to deliver and measure ads, subject to applicable consent requirements. Advertising is separate from the extension and does not affect access to its tools.

Read how Google uses information from partner sites and manage preferences through Google My Ad Center. Your browser can also block or clear cookies. We do not use account emails or passwords for advertising.

Your choices and rights

You can use the extension without a FUTLoom account. You may request access, correction, deletion or portability of your account information, or object to or request restrictions on processing where applicable, by emailing contact@futloom.com. Where processing relies on consent, you may withdraw that consent. You can complain to your local data-protection authority, including Datatilsynet in Denmark. Third-party services have their own privacy policies and retention practices.