Privacy Policy

Who we are

winrate.lol is an independent League of Legends statistics site. It is not endorsed by Riot Games and does not reflect the views of Riot Games. We decide what this site collects and what it is used for, which makes us the data controller for everything described below.

What we collect

The site works without an account, and most of it never learns who you are. What we hold depends on how far into the site you go.

Just visiting

Each request adds one to a daily counter kept as (day, country, interface language, page type, bot or not). A second counter records only the host that sent you here, google.com or reddit.com and nothing more, never the full address you came from. Those rows are numbers, not a visit log: they cannot be traced back to a person, and no request is stored on its own. Your IP address is read while the request is being answered, to work out the country and to apply rate limits, and it is never written to the database.

If you create an account

We store your email address, your password as an argon2id hash and never as text, your display name, your country if you set one, and the date you joined. If you sign in with Discord or Google we store the account id that provider gives us instead of a password. Whatever you write into your public profile, including your bio links, is stored as you typed it and is public on purpose.

Game data from Riot

Ranked and match data comes from the Riot Games API. It is public game data about accounts, not something you hand to us. Raw matches are not kept: a match is turned into counters once and then only the counters remain. Per account we keep the Riot ID, the encrypted PUUID, region, level, profile icon, rank history and champion counters, which is what profile pages, leaderboards and tier lists are built from.

Duo Finder

If you use Duo Finder we store the listing you wrote, the roles, languages and voice preference you chose, who you passed on or accepted, your matches and the messages you send. Messages are scanned automatically for abuse and a flagged message can be opened by a moderator. If you report someone, the report and its text are stored.

Professional players

Pages about professional players are built from data we did not get from those players. We collect it from lolpros.gg, which publishes rosters, and from Leaguepedia at lol.fandom.com, which publishes official season photographs. Per player we hold the handle, team, role, country, league, the Riot accounts that are publicly attributed to that player, the counters computed from their ranked matches, and the photograph together with the address it came from. We hold it because a competitive scene is public and a site about that scene cannot describe it otherwise, which is a legitimate interest, and it stays as long as the pages exist. If you are one of these players and you want your page, your photograph or your accounts removed, write to the address at the bottom of this page and say which player you are: it is a single row and it will go.

Desktop app and stream overlay

The Windows app reads the League client on your own computer to know which account is playing and which champions are being picked. That stays on your machine, with one exception: if you use the stream overlay, the app tells the site which account is playing right now so the overlay card can show it. Each installation gets a device key that ties it to your account, and you can unlink it from your account panel.

Why we are allowed to hold it

Account data, Duo Finder data and the desktop app link exist because you asked for a feature that cannot work without them, which is performance of a contract. The daily counter, the abuse defences and the Riot game data exist because a statistics site cannot run without them, which is a legitimate interest. Analytics and advertising cookies exist only because you said yes, which is consent, and consent can be taken back at any time without giving a reason.

Cookies and measurement

Necessary cookies keep you signed in, remember your language and protect forms. Google Analytics 4 runs only after you accept it in the cookie banner, and the answer it starts from is no, in every country, not only in Europe. Cloudflare Web Analytics runs without cookies. Our own traffic counter runs on the server and stores no identifier at all, so blocking scripts does not hide you from it and accepting does not expose you to it.

Cookie Policy: every cookie by name

Who else sees it

Google receives Analytics 4 events, but only if you accepted them. Cloudflare serves and shields the site, so requests pass through it. Discord, Google and Riot see only the sign in round trip that you started yourself. On pages that carry ads, advertising partners receive an ad request once you have accepted. We do not sell personal data, and your email address is not passed to anyone.

Where the data goes

Two of the services named above are run from the United States. Google receives Analytics 4 events, but only from visitors who accepted them, so a refusal keeps everything of yours away from Google. Cloudflare serves and shields the site, which means every request passes through the Cloudflare location nearest to you and that location may be outside your own country. Both companies take part in the EU to US Data Privacy Framework, and where a transfer needs more than that it runs on the standard contractual clauses published by the European Commission.

How long we keep it

Account data stays until the account is deleted. A session expires after a year. The daily traffic counter is pruned after about a year. A Duo Finder listing lives as long as the listing does: it goes when you unlink the Riot account it belongs to, and it goes when you delete your account. Messages inside a match go the same way, and they also go on their own 90 days after they were sent, whether or not the match is still open. Data about professional players stays while the pages exist, and it goes on request. Champion and match counters are statistics with no person behind them, so they are kept for as long as the site runs.

Your rights

You can ask for a copy of your data, have it corrected, have it deleted, have it handed to you in a portable form, object to anything we do on the basis of legitimate interest, and withdraw consent to analytics. Deletion needs neither a letter nor our permission: the profile section of your account panel does it, and it removes the email address, the password hash, linked accounts, your links and your Duo Finder data. For anything else, write to us and you will get an answer within one month. If you are in the EEA or the UK you can also complain to your national data protection authority, and in Turkey to the KVKK.

Security

Passwords are hashed with argon2id. The session and CSRF cookies are HttpOnly and, over HTTPS, carry the __Host- prefix, so a compromised subdomain cannot write them. Sign in attempts are rate limited. None of this makes a site unbreakable, so use a password you use nowhere else.

Children

The site is not aimed at children under 13 and accounts are not meant for them. If you think a child has registered, write to us and the account will be removed.

Changes to this page

If something here changes in a way that matters, the date at the top changes with it. Wording fixes that do not change the meaning are made without notice.

Contact

Write to [email protected] for anything on this page: a copy of your data, deletion, or a question about how one of these things actually works.