Privacy Policy

This policy explains what The RiftDB team collects when you use RiftDB, why, who it is shared with, how long it is kept and the choices you have. We collect as little as we can to run the service. We never sell your data or use it for advertising.

Who we are

RiftDB is run by The RiftDB team, who is responsible for your personal data (the “controller”). You can reach us at riftdb@proton.me, including about your data and your rights.

What we collect

Account: your email address, your username and your password (stored only as a secure hash).
Profile: what you choose to add — display name, bio, a profile picture or League icon, and a custom status.
Riot accounts you link: Riot ID, region, PUUID, summoner level and icon, and how the link was verified. If you link through Riot Sign On, the sign-in tokens Riot gives us stay on our servers.
What you create: messages and the images you send, comments, lobbies, goals, favourite GIFs, the players you follow, friends and blocks, and reports you file.
Activity: whether you're online, away or in a game (with the champion and queue), when you were last active, which days you used RiftDB, time spent in voice, your notifications and how far you've read in each conversation.
Settings: language, region, theme, privacy and notification choices, and voice preferences.
Technical data: your sign-in sessions (device, browser and IP address) to keep your account secure, and anonymous page-view statistics that use no cookies.

You can use most of RiftDB without an account. Then we only process what's needed to show you the page, plus the anonymous statistics.

Players you look up

RiftDB shows public League of Legends data from the Riot Games API about any player, including people who don't use RiftDB: Riot ID, rank, match history, champion mastery and live games. We keep some of it, such as rank snapshots that draw rank history and short-lived copies of Riot's responses, so pages load quickly and stay within Riot's limits. We do this under Riot's developer terms and our legitimate interest in offering statistics about a public game. If you'd like data about your Riot account removed from RiftDB, write to us.

To suggest players as you type in the search, RiftDB keeps a shared list of every player it has seen in that data, including in custom games and in data received when someone signs in with Riot: their Riot ID, region, profile icon and summoner level. The list is filled only from what RiftDB already receives from Riot while people use it, never by looking players up just to add them. Each player is kept with the newest Riot ID seen. Older games can show a Riot ID that has changed since, so a suggestion can be out of date until a newer one turns up, and a Riot ID that no longer exists is removed as soon as Riot reports it. Making your player page private in Settings → Riot accounts keeps that account out of the suggestions, and you can write to us to have your Riot ID removed.

How we use it, and why we may

To run RiftDB for you: your account, profile, linked accounts, friends, messages, lobbies, voice and notifications. Legal basis: our contract with you, the Terms (Art. 6(1)(b) GDPR).
To keep RiftDB safe: securing sign-ins, preventing abuse, handling reports and enforcing the Terms. Legal basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR).
To show League data about the players you and others look up. Legal basis: our legitimate interest, as above (Art. 6(1)(f) GDPR).
To understand how RiftDB is used: anonymous page views and simple counts, such as how many people were active on a day. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).
To meet legal obligations, for example answering lawful requests from authorities (Art. 6(1)(c) GDPR).

We don't sell your data, show ads, build advertising profiles, or make automated decisions about you that have legal or similarly significant effects.

Who can see what

Your profile (username, display name, picture and bio), the Riot accounts you haven't hidden, your comments, and open lobbies (unless they're friends-only) can be seen by anyone, including people who aren't signed in.
Your online status and activity follow your privacy settings: everyone, friends or nobody.
Messages can only be read by the members of the conversation. An admin sees a private message only if someone reports it, and then only that message and a few around it.
Admins can see account details, such as your email address and sign-in times, to run and moderate RiftDB. Every admin action is recorded in a log that can't be edited.

Service providers

A few providers process data for us, only to run RiftDB:

Supabase: database, accounts and sign-in, file storage, live updates, and account emails such as confirmations and password resets.
Vercel: hosting, and privacy-friendly web analytics without cookies. Page addresses that name a player or a person are anonymised before they're counted.
Riot Games: the League data RiftDB shows, and Riot Sign On if you link your account that way.
Cloudflare: relaying voice in voice channels and calls. Nothing is recorded.
GIPHY: GIF search. Your search terms go through our server, not straight from your browser.

Game images and champion videos load from Riot's servers and CommunityDragon (a community copy of the game's files), and GIFs from GIPHY's servers. Like any site your browser loads images from, they see your IP address.

Some of these providers are based in the United States. When data leaves the European Economic Area or the UK, it's protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Cookies and storage on your device

We only use cookies that RiftDB needs to work or to remember choices you made. None of them track you, there's no advertising or third-party tracking, and our analytics don't use cookies, so there's nothing to consent to and no cookie banner.

Cookie	What it's for	Kept for
sb-…-auth-token	Keeps you signed in	Until you sign out
riftdb-locale	Remembers your language	1 year
riftdb-region	Remembers your region	1 year
riftdb-standing	Lets us check quickly that your account isn't suspended	2 minutes
riftdb-ingame-check	Spaces out the checks for whether you're in a game	1 hour
riftdb-icon-verify	Remembers a Riot account verification in progress	20 minutes
riftdb-rso-state	Protects linking an account through Riot Sign On	10 minutes

Some things are saved only in your browser and never sent to us: your theme, recent player searches, recent emoji, the lobby settings you last used, announcements you dismissed, the chat layout and whether you're muted in voice. Clearing your browser's data for RiftDB removes them.

How long we keep it

Your account and what you create: while your account exists. When you delete something, such as a message, comment, lobby or post, it's removed. A deleted message leaves an empty “Message deleted” marker in the conversation.
Days you were active, and voice sessions: 90 days.
Sign-in sessions: until you sign out or they expire.
Reports and moderation: reports, the copy of what was reported and the admin log are kept as long as they're needed to keep RiftDB safe and to handle disputes, including after an account is deleted.
League data about players: refreshed whenever someone looks a player up; rank history is kept to show progress over time.
Players suggested in search: kept until the Riot ID no longer exists or you ask us to remove it.
Analytics: only anonymous, combined figures.

Deleting your account

You can delete your account at any time in Settings → Your data. Your account, profile, linked Riot accounts, friends, comments, lobbies you host, goals, notifications, activity and uploaded pictures are deleted for good. Messages you sent stay in other people's conversations only as “Message deleted”, without their text or images. Reports about you and the admin log are kept, as described above.

Your rights

Under the GDPR and similar laws, you can:

Get a copy of your data and take it elsewhere: download everything from Settings → Your data.
Correct it: change your details in Settings, or ask us.
Delete it: delete your account in Settings → Your data, or ask us.
Object to or restrict what we do on the basis of legitimate interests, such as showing League data about your Riot account.
Complain to the data protection authority where you live or work.

For anything Settings can't do, or if your account is suspended or banned, write to riftdb@proton.me. We'll answer within one month.