PRIVACY
Version 1 · [PLACEHOLDER: DATE IN FORCE] · Not legal advice until reviewed.
1. Who
Controller: [PLACEHOLDER: FULL NAME], a natural person in [PLACEHOLDER: CITY], Latvia.
Contact for everything on this page: [PLACEHOLDER: privacy@DOMAIN]. We answer within one month.
2. You need no account
The explorer, roll odds and the match page work without one. An account is needed only to upload games from the TFT Recorder.
Signing in and signing up are the same buttons: Discord, Google or an email link. There are no passwords.
3. What we keep, and where it comes from
- Sign-in: from Discord or Google, an account id, a display label and, when the provider says it is verified, your email. From an email link, your email. Provider access tokens are dropped right after sign-in.
- Account: a display name, your stats setting, your answer to 16 OR OLDER, sessions (dates, browser, country), recorders you connected (app, version, dates).
- Your uploads: the recordings the TFT Recorder sends once you link it: your gameplay, your Riot ID, the other 7 players' Riot IDs and boards. No augments, no login tokens, no PC paths.
- Riot API match data: the official result of the same match, fetched to verify an upload.
- Network: IP addresses reach Cloudflare, which serves the site, and its rate limits. We store no IP address; the security log keeps a country.
4. Why, and the legal basis
| Purpose | Basis (GDPR) |
|---|---|
| Your account, sign-in, sessions, sign-in emails | Art 6(1)(b) contract |
| Storing, parsing, grading and showing your games; your share links | Art 6(1)(b) contract |
| The other 7 players' Riot IDs and play inside your private game | Art 6(1)(f) legitimate interest: reviewing a game you played. Their names were visible to you in the game; they are pseudonymized at rest and never shared |
| Verifying uploads against Riot, rate limits, the security log | Art 6(1)(f) legitimate interest: preventing fraud and abuse (Recital 47) |
| The anonymized stats feed (on by default) | Art 6(1)(f) legitimate interest: better grading for everyone. You can object at any time, no reasons needed (section 8) |
| The 30-day KEEP ME SIGNED IN cookie | Your consent: the box starts unticked |
Grades are coaching, nothing more. No decision with legal or similar effect is ever made about you (Art 22).
5. Who else processes it
- Cloudflare (processor): hosting, database and file storage in the EU jurisdiction, Turnstile, email routing, access control. Its DPA applies.
- Resend (processor): sends sign-in emails from its EU region, with click and open tracking off.
- Discord, Google (independent controllers): only if you sign in with them.
- Riot Games (independent controller): the match data API.
- Overwolf (independent controller): the platform the TFT Recorder runs on.
6. Transfers outside the EEA
Accounts, games and files are stored in the EU. Cloudflare and Resend are US companies: transfers rely on the EU–US Data Privacy Framework and Standard Contractual Clauses. Fonts load from Google Fonts. [PLACEHOLDER: CONFIRM BEFORE LAUNCH]
7. How long
| Data | Kept |
|---|---|
| Account and sign-in methods | Until you delete them. After 24 months without a sign-in: a warning email, then deletion 30 days later |
| Sessions | 24 h idle; with KEEP ME SIGNED IN, 30 days sliding, 180 days at most |
| Sign-in requests | Valid 15 min; deleted after 24 h |
| Recorders | Until disconnected or 180 days unused; the record of a disconnected one goes after 30 days |
| Games, their lobby and parsed data | Until you delete the game or the account |
| Raw upload files | 30 days |
| Security log | 90 days |
| Database backups | 30 days, then gone; deletions are applied again after any restore |
| Anonymous stats tables | Hold no personal data; rebuilt every day |
8. Your rights
- Access and portability (Art 15, 20): MY ACCOUNT → DOWNLOAD MY DATA gives one file with everything above, readable by machines.
- Erasure (Art 17): delete a game from MY GAMES, or the whole account from MY ACCOUNT → DELETE. It goes at once; backups expire within 30 days.
- Rectification and restriction (Art 16, 18): change your name in MY ACCOUNT, or write to us.
- Withdraw consent: sign out, and the 30-day cookie is gone.
- Complaint: Datu valsts inspekcija (DVI), Elijas iela 17, Rīga LV-1050, Latvia, or your own supervisory authority.
YOUR RIGHT TO OBJECT (Art 21). You can object at any time to the processing based on legitimate interest. For the stats feed, the switch is MY ACCOUNT → PRIVACY → ANONYMIZED STATS OFF, or per game in MY GAMES. It is unconditional. Aggregates already published can't be taken back; the next daily run drops your games.
9. The anonymized stats feed
Verified games count in site-wide grading tables. We keep no names, dates or match ids there, only counts over many games, published only above minimum group sizes. Games of accounts under 16 never count.
10. Age
Accounts are for people 13 and older, as Riot accounts are. We ask 16 OR OLDER when you sign up or link a recorder; under 16, the stats feed is off for good. [PLACEHOLDER: CONFIRM THE AGE RULE]
11. Cookies
Only what signing in needs, plus one optional cookie. No tracking, no analytics, no banner.
| Cookie | Why | Life | Consent |
|---|---|---|---|
| __Host-tft_s | Your session (sign-in) | Until the browser closes; 24 h idle | Not needed: strictly necessary |
| __Host-tft_s, remembered | KEEP ME SIGNED IN | 30 days | The unticked box |
| __Host-tft_hint | Tells the page a session exists (no secret) | Same as the session | Not needed |
| __Host-tft_oauth_<provider>, __Host-tft_login | Binds a sign-in to this browser | 10–15 min | Not needed |
| Turnstile | The bot check on the email form; nothing is set on our domain | — | Not needed |
The page also stores a few display settings (invert, motion) in your browser's local storage. They never leave your device.
12. You played in someone else's game
If another player uploads a game you were in, their recording holds your Riot ID and your boards and play in that game (Art 14).
- Why: so that player can review their own game (Art 6(1)(f)). They saw your name in the game.
- Who sees it: only that player, when signed in. At rest your name is replaced by a slot number. Share links always show you as PLAYER 1–8. The stats tables hold no names.
- How long: until that player deletes the game or their account.
- Object or erase: email your Riot ID (name#tag) to [PLACEHOLDER: privacy@DOMAIN]. We blank your name in every stored game and delete the raw files that hold it, within one month.
13. Riot Games
TFTINDEX isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games, and all associated properties are trademarks or registered trademarks of Riot Games, Inc.
We honour Riot's data deletion requests. The TFT Recorder never calls Riot, and no Riot key ever leaves our server.
14. Breaches
If personal data is ever exposed, we tell the DVI within 72 hours (Art 33) and tell you without delay when the risk to you is high (Art 34).
15. Changes
A new version of this page gets a new date at the top. Material changes are shown on MY ACCOUNT before they apply.