A clear record of what we use.

CUJU is maintained as a focused Ultimate Team database and tools service. This document describes the rules and data practices that apply to the live service.

1. Information we receive

When you create an account, CUJU receives the email address and username needed to provide the account. Saved builds, comments and profile choices are stored when you choose those features. Secure session cookies are used to keep you signed in.

For security and abuse prevention, CUJU may record an event such as account creation, login, failed login report, logout, password-reset request, consent, an IP change signal or an administrative action. We store a keyed IP fingerprint rather than the raw IP address, and may store the approximate city supplied by the hosting network. User-agent data is retained only for the security window.

2. Why we use it

We use account data to authenticate you and provide saved features; service data to operate the database and tools; and security data to investigate abuse, protect accounts, audit sensitive changes and meet legal obligations. Optional analytics or advertising storage is not enabled unless the relevant service is introduced and you choose it.

3. Advertising and consent

When a verified advertising configuration is active, CUJU may use Google AdSense to display contextual advertising. CUJU's integration loads advertising only after marketing consent, and configured inventory uses non-personalized ads by default. Google may process request, device and contextual information under its own policies. Personalized advertising in regions where Google requires a certified consent management platform will remain disabled until that requirement is met.

4. Sharing and providers

CUJU uses Firebase Authentication, Cloudflare hosting, D1 database, R2 object storage, Google AdSense when enabled, and external football-data sources. Those providers process information as needed to provide their services under their own terms. We do not sell account information.

5. Retention and rights

Security events are configured to expire after 180 days. Consent records are configured to expire after seven years unless a shorter period is required by applicable law. Expired records are purged when audit data is written or viewed. You can ask about access, correction or deletion of personal information, subject to records that must be retained for security or legal reasons.

6. Contact and updates

Privacy questions or requests should be sent through the CUJU account channels. We publish the active version here and ask for renewed consent when required policy versions change.