ESHArio Privacy Policy

Last updated: 11 September 2026. This page describes the ESHArio browser extension for Google Chrome, the eshario.com website and the purchase of a key.

Short version

ESHArio keeps your data on your own computer. It leaves by two roads, and you switch on both yourself: settings into Chrome's own cloud when you press the button, and your email and password to our server when you sign in to an account. Without that press, without signing in and without asking us to reset your password, the extension sends nothing about you anywhere. It never sees your EA account password. There is no analytics, no tracking and no advertising. We do not sell your data and do not share it for anyone else's advertising. To run the service, some of the data is handled by our suppliers: the payment partner, hosting and a mail service. When you buy, we receive your email and the order details from the payment partner (see "The website and your purchase").

What ESHArio is

ESHArio is an extension for Google Chrome that adds tools inside the official EA SPORTS FC Web App at https://www.ea.com/*/ultimate-team/web-app*. It runs on that address and nowhere else. On every other page it does nothing at all: no script is injected and no request is made.

ESHArio is an independent product. It is not affiliated with, endorsed by, or sponsored by Electronic Arts Inc.

What is stored on your device

ESHArio uses Chrome's storage permission to keep its own data in your browser's local storage. The data consists of:

Your settings. Which features are on, hotkey assignments, display choices, and which panels are open.
Your saved filter sets. The market searches you chose to save.
A local copy of your club list. Card identifiers, ratings and similar game attributes, so squads can be built without asking EA for the same list again. It holds nothing about you as a person.
A purchase log. The price you paid for a card: EA discards that number itself.
Safety counters. How many market searches were made today, and how many purchases and Squad Building Challenge submissions in the last hour and the last day. The built-in limits rest on them.
Reference data read from the Web App. A catalogue of card definitions and EA's rarity groups, so the extension does not re-read them on every load.
A licence key, if you entered one. It is signed, verified on your own machine, never sent anywhere, and says nothing about you.

Chrome stores it on the machine where the extension is installed. There is one exception, described below under "Chrome's own cloud", and you switch it on yourself.

Chrome's own cloud

Chrome can carry an extension's data between the computers where you are signed in to your Google account. ESHArio uses this only once you press "Sync settings" in the "Chrome's cloud" section of the settings window: until that first press nothing goes into that store and the extension does not even read it. After that, changes travel there by themselves.

Seven groups travel: feature toggles, saved filter sets, the limits and options for buying, the options for selling, the interface state and pack locks. The licence key, the local club mirror, the purchase log and the safety counters never travel there.

That store belongs to your Google account, not to us: we do not look into it and receive nothing from it. How Google handles it is set out in Google's own terms. To take our settings out of it, remove the extension on every computer or clear the extension's data in Chrome.

What is sent over the network

ESHArio makes network requests to exactly two third-party sites (four host patterns in the manifest), and only to read public reference data. Both sites, r2.fut.gg and www.fut.gg, belong to the fut.gg price service: from there the extension takes the shared market price file and the public list of Squad Building Challenges with community ratings. What leaves your computer is only a page number and the id of the challenge you opened. The requests go without cookies, and fut.gg does not know who asked.

The fourth pattern is not a third party at all: it is our own account server, api.eshario.com. The extension contacts it only when you sign in to an account yourself, ask to reset a password or press "Sync settings"; while you are signed in it also asks that server from time to time whether your paid access is open: when the web app opens, when you come back to it and when you press "Refresh". What goes there is described under "Accounts and paid access".

ESHArio has no analytics and no telemetry. There is no usage reporting, no crash reporting and no advertising network. Requests to EA's servers are only the ones the web app itself makes with your own EA session; they carry no identifier of ours.

What ESHArio never touches

Your EA credentials. ESHArio does not read, store, transmit or fill in your EA email address, your password, or your two-factor code. You sign in yourself, in EA's own form. The only thing ESHArio presses on its own is the platform choice after you are already signed in, which saves one click.
Your cookies and your EA session. ESHArio does not read cookies. It does not request the cookies permission and cannot.
Your browsing history. ESHArio does not request the history or tabs permission and has no way to see what other pages you visit.
Other websites. ESHArio has no permission to run on any site other than the EA Web App and the two read-only sites above, plus our own account server api.eshario.com, which it also writes to: sign-in, access rights, password recovery and the settings you sync by pressing the button.
Your clipboard's contents. ESHArio can place a diagnostic report into your clipboard when you ask it to. It never reads what is already there.

Accounts and paid access

ESHArio is a free set of features plus paid access for a term, opened either in an account or by a licence key. You sign in yourself, inside the extension and never on an EA page: your email and password go to our server api.eshario.com. Along with them go a random device name the extension invents for itself, which is tied to nothing but our own extension, and a short device label such as "Windows · Google Chrome": the "new device" email names it, and the limit on devices per account counts it. No other information about you is in these requests. What comes back is a signed statement of your paid access and a session token; later requests to the server carry that token, while signing in itself and password recovery go without it.

The server holds: your email address, an irreversible hash of your password (never the password itself), device sessions, orders and an account event journal (a sign-in, a sign-out, a renewal). A session is limited in time and in the number of devices. The "set your password" link from the email works for 24 hours and once. The IP address is used only to rate-limit sign-in attempts and is not stored in the database.

On your computer the extension keeps a signed snapshot of the access (it keeps the extension working offline for up to 7 days) and the session token. The session token goes to our account server only; the EA page and any other website cannot reach it.

The extension's settings go to our server only if you press "Sync settings" on the account page yourself: the same seven groups as in Chrome's cloud. Club lists, purchase journals, the safety counters and the licence key never travel.

The website and your purchase

The website eshario.com sets no cookies. It has two forms. The promo code field: the code you enter is kept in your browser's storage and is not sent anywhere. And the new-password form on the /password page, which the link in our email opens: the password you type goes once to our account server and nowhere else. The site is served through a hosting provider; like any host, it keeps technical logs with visitors' IP addresses, they live with the host under its rules, and we do not read them. The visit counter, when enabled, works without cookies and without identifying the visitor.

Payment happens on the payment partner's page under its rules; we never see card details. From the partner we receive the email given at checkout, the order number, the amount, the term, the promo code, the partner code, the date and the page language. Emails about the key and the account are sent by a mail service from noreply@eshario.com; it sees the address and the text of the email. Order and account records are kept on our rented server; only we have access to it. Support emails arrive through email forwarding into our mailbox; Telegram conversations are stored by Telegram under its rules. Our hosting and mail suppliers process data on our instructions.

What we keep about a purchase, and why:

Email and order number: to deliver the key and answer emails.
Amount, term, promo code: refunds and the partner's reward.
Order records: tax accounting.
Support correspondence: to help you.
Delivery log and correspondence in a dispute: defence against payment disputes and abuse.

We process purchase data to perform our contract with you and to meet legal requirements. Our suppliers (hosting, mail, the payment partner) may be located in other countries and work under contracts with us.

Order records are kept as long as tax accounting requires; an account lives until you ask us to delete it. Your rights: to learn what we hold about you, to correct it, to delete it, and to object to its processing. The partner whose promo code you entered does not see your data: only the fact of payment and the term.

Sharing and selling

ESHArio does not sell your data, does not share it for anyone else's advertising, and does not use it to assess creditworthiness or for lending. Purchase data is used only for delivery, support, refunds and tax records, and is passed only to the suppliers named in the section "The website and your purchase", in the amount their work needs.

The use of information received through ESHArio adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

How long data is kept, and how to delete it

Data stays in your browser until you remove it. To delete all of it, remove the extension from chrome://extensions. Chrome deletes the extension's local storage with it. Removing the extension deletes nothing in your EA account. Retention for purchase and account data is set out in the section "The website and your purchase".

Children

ESHArio is not directed at children and does not knowingly collect data from them. Apart from the account email and the purchase data, the extension collects no personal data from anyone; access may be bought only by an adult.

Changes to this policy

If ESHArio's handling of data changes, this page is updated first, with a new date at the top, and the Chrome Web Store listing is updated at the same time.

Contact

Website: https://eshario.com Email: support@eshario.com Requests about your data: from the email given at checkout; we reply within 10 working days.