Privacy policy

FUT 27 Pack Opener · Last updated: 18 October 2026

This policy explains what the FUT 27 Pack Opener app stores about you, where it is kept and why. In short: we keep only what the game needs to save your club. No ads, no analytics, no tracking.

Who is responsible

FUT 27 Pack Opener is made by Devero, run by Samuel Lind, a private person in Sweden. He is responsible for your data. Contact: hello@devero.se.

What we store

• Your account. A random account id. When you play as a guest, that is all that identifies you. If you save your club with Google, we also store what Google shares at sign-in: your Google account's id, email address, name and profile picture link.
• Your sign-in. The IP address and the device or browser details of your current sign-in session, kept with your account to keep it secure.
• Your game. Your coins, cards, packs, squad, drafts, Title Race progress and rewards claimed, plus a record of each action in the game (such as opening a pack), so that a tap is never counted twice.
• Your purchases. If you buy coins: which bundle, the store and its transaction id, the store's country, and when the coins were added or taken back after a refund. We never see your card or other payment details.
• Notifications. When you open the app, we note when it was opened and your phone's time zone, so that we send nothing on a day you have already played and the one daily reminder arrives at about 18:00 your time. We also keep your notification settings and which reminders you have already had. If you allow notifications, we store your phone's push token, the address notifications are delivered to.
• Technical logs. Our servers also keep logs of requests, which include your IP address, to keep the service running and secure.

The app also keeps a copy of your game on your phone so it loads fast and works with a weak connection.

Where it is kept

Your account and game are stored with Supabase on servers in Ireland (AWS, EU). The game server runs on Google Cloud in Belgium (EU). Both act on our behalf under data processing agreements. When you sign in with Google, Google handles that sign-in under Google's privacy policy.

Coin bundles are paid through Google Play or the App Store, which handle the payment under their own privacy policies. Purchases are checked for us by RevenueCat (RevenueCat, Inc., USA). It receives the store's receipt, your random account id and basic device details, but not your name or email, and acts on our behalf under a data processing agreement that also covers the transfer outside the EU.

Notifications are delivered through Firebase Cloud Messaging (Google). It receives your push token and the reminder's text, and on an iPhone passes them on to Apple's push service. Google acts on our behalf under its data processing terms, which also cover any transfer outside the EU. We use only Firebase's messaging, not its analytics.

Why

We use your data only to run the game: to keep your club, let you get it back on a new phone, stop the same reward being paid twice, and add the coins you buy (or take them back after a refund). The legal basis is our agreement with you to provide the game you chose to play.

We send notifications only if you allow them: at most one a day, about rewards waiting for you, new players, news or your daily bonus. The legal basis is your consent. You can withdraw it at any time with the notification switches on the app's About screen or in your phone's settings.

What we don't do

• No ads and no ad ids.
• No analytics or tracking tools.
• We never sell your data or share it with anyone for their own use.

How long we keep it

As long as your account exists. When you delete your account, everything in it is deleted, purchase records included, at RevenueCat too. A guest account can't be signed back into once the app is uninstalled, so its data stays on our server until you ask us to delete it. A push token is deleted when you sign out or delete your account, or as soon as Firebase tells us it no longer works. Technical logs are deleted automatically within 30 days.

Your rights

You can delete your account and everything in it yourself, in the app; see how to delete your account. You can also ask for a copy of your data, ask us to correct it, or ask us to delete your account for you. Email hello@devero.se from the address you want to talk about or, for a guest account, tell us so we can work out together which account is yours. We reply within one month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY).

Children

The app is for players aged 13 and over. It is not directed at children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, contact us and we'll delete it.

This website

devero.se sets no cookies and uses no analytics. It is hosted on GitHub Pages, which logs visitors' IP addresses for security.

Changes

If this policy changes, we update this page and the date at the top.