Trust & fair play

How we protect your account and data, and the rules that keep every league fair.

Security

The entire site is served over HTTPS — every connection between your browser and our platform is encrypted in transit.
Passwords are never stored in readable form; they are salted and hashed by our authentication provider, and nobody at EPL Knockout can see them.
Password resets use emailed, single-use, time-limited links. We will never email or ask for your password.
Database access is protected by row-level security, so one player's account details cannot be read by another player.
Administrative functions are restricted to a named list of accounts and are checked on the server on every request.
We collect the minimum needed to run the game: your email, display name, picks and league activity. We never sell your data.

Every pick is recorded with a server-side timestamp, and results are settled automatically from official match data — so what happened is never a matter of memory.
Picks lock at the first kickoff of each gameweek and are hidden from other players until then, so nobody can copy a pick.
House rules (second chances, wildcards and team reuse) are shown before you join a league and apply equally to everyone in it.
Each person may enter a league once. We use technical signals to detect duplicate accounts and multi-entries, and offenders can be removed and banned.
Disagreements about how a league is run are between you and your league host — speak to them first. If you believe a host or player is abusing the platform, contact us via the form in the footer and we'll review.