Privacy policy

Last updated: 2026-10-15

Data controller

Daniel Gassió Gomez · Av Raval del Carme 64 · tftcoachofficial@gmail.com

What data we process

• The Riot ID you enter in “My matches” (name#tag and server). It is sent to the Riot Games API to retrieve your public matches. We don’t store your Riot ID on our servers; API responses may be cached for a few hours to avoid repeating requests.
• Your account, if you create one (it’s optional): first name, last name, email address and your password transformed with an irreversible hash (we never store the password itself), plus the date you signed up and the date you last signed in. While you’re signed in we store a session identifier, also only as an encrypted fingerprint. We don’t store your IP address or browser.
• Your Riot ID and server (asked when you sign up): we check them with the Riot Games API and store your Riot account identifier (PUUID) and your profile icon. If you verify that the account is yours (by setting a specific icon for a moment), we store the verification date.
• The comps you share (board, name and notes): we review them before publishing. Once published they are public on the website: with your Riot name (only the username, or username and tag) and your icon if you choose so in your profile and have verified your Riot ID; otherwise, as anonymous.
• Protection against bots and fraud in the account forms: Cloudflare Turnstile analyses technical signals (IP, browser, interaction) to check that you’re not a robot. We count sign-up and sign-in attempts per IP and per email using an irreversible fingerprint (HMAC), without storing the IP or the email, and those counters are deleted after two days.
• Preferences in your browser (local storage): In-game board, comp chosen in the cheat sheet and last Riot ID searched. Only if you accept preference cookies; they never leave your device.
• Technical data (IP address, browser) processed by the hosting provider to serve the website and protect it against abuse.
• Analytics: if you accept it, Google Analytics (Google Ireland Ltd.) uses cookies to record the pages you visit, where you came from and technical data (browser, device, approximate country) to count visits and improve the site. It does not store your IP address, we do not use it for advertising and its advertising features (Google signals) are turned off.
• Advertising: Google AdSense (Google Ireland Ltd.) may use cookies or identifiers to show and measure ads, only with your consent. More information in how Google uses information from sites that use its services.

Purposes and legal basis

• Showing your stats when you request them: performance of the service you request (art. 6.1.b GDPR).
• Creating and managing your account: performance of the service you request by signing up (art. 6.1.b GDPR).
• Reviewing and publishing the comps you share: performance of the service you request (art. 6.1.b GDPR). Showing your Riot name with them: your choice, which you can change at any time (art. 6.1.a GDPR).
• Protecting accounts against bots, spam and fraud: legitimate interest (art. 6.1.f GDPR).
• Remembering preferences and showing ads: your consent (art. 6.1.a GDPR), which you can withdraw.
• Security and operation of the website: legitimate interest (art. 6.1.f GDPR).
• Measuring how the site is used with Google Analytics: your consent (art. 6.1.a GDPR), which you can withdraw.

Who it is shared with

• Riot Games, Inc. (Riot Games API), to look up your matches and check your Riot ID.
• Vercel Inc. (website hosting).
• Supabase Inc. (database where accounts are stored, in the EU).
• Cloudflare, Inc. (Turnstile bot check in the account forms).
• Google Ireland Ltd. (Google Analytics, usage statistics).
• Google AdSense (Google Ireland Ltd.) (advertising).

Some of these providers are located in the US; transfers are covered by the EU-US Data Privacy Framework or by standard contractual clauses.

How long we keep it

• Your account data, until you delete it. You can delete it yourself from “My account”, instantly.
• Sessions expire after 30 days without using the website, or when you sign out.
• The comps you share, until you delete them (from “My account”) or delete your account. We may remove those that break the community rules.
• Anti-abuse counters, 2 days.
• Google Analytics statistics, 2 months.

Your rights

From “My account” you can see and correct your data, close your sessions and delete your account at any time. You can also exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to tftcoachofficial@gmail.com. If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).

Minors

This website is not aimed at children under 14.