LoLphabet (“the site”) is a small hobby project run by PaladinLaw (“we”, “us”) for tracking League of Legends A-Z challenge progress. This policy explains what personal information we handle, why, and what rights you have. It is written to meet the UK GDPR, the EU GDPR, South Africa's POPIA and California's CCPA/CPRA.
PaladinLaw is the controller of your personal information (the “responsible party” under POPIA). Contact: [email protected].
If you don't log in: your progress, custom lists and preferences stay in your own browser. We never receive them.
If you log in with Google: we receive your Google account ID, name and email address, and we store them along with your display name, your tracker progress, lists and notes, and a login session token. We use this only to run your account. Lawful basis: providing the service you asked for (contract).
If you create a share link or a shared list link: anyone with the link can see your display name and the progress or list you shared (read-only for progress). You can switch a progress link off, or delete your account, at any time. Lawful basis: your choice to share.
Visitor counter: when a page loads, our server combines your IP address and browser details with a random key that changes every day, turns the result into a one-way hash, and uses it only to avoid counting the same device twice in a day. Nothing is stored on your device, your raw IP address is not kept, and the hashes are deleted when the daily key changes (within 24 hours). Only the running total is kept. Lawful basis: legitimate interests (a simple visitor count that can't be inflated by refreshing).
Technical logs: the hosting setup, and any network service in front of it (such as a reverse proxy or tunnel), may keep standard connection logs for security and troubleshooting.
The site sets no cookies. It stores a few items in your browser's local storage, all strictly necessary for features you use: your progress and lists, your preferences (theme, challenge mode, role-list source, build panel position and open/closed state, collapsed hints), your login session if you sign in (up to 90 days), short-lived cached champion data from Riot (about 24 hours), and a note that you've seen the cookie notice. There is no analytics, advertising or social-media tracking. You can clear all of it from “Cookie preferences” in the footer.
Google: the Google sign-in script is loaded only after you click Log in / Sign up. Google's own privacy policy applies to that sign-in.
Riot Games and CommunityDragon: champion, item, summoner spell and rune icons, and champion data, are loaded directly from Riot's public Data Dragon service (and a few stat-shard icons from the community-run CommunityDragon service), so those servers receive your IP address and browser details when a page loads. Lawful basis: legitimate interests (showing the champion images the site is built around).
OP.GG: the suggested builds and statistics shown under Next up are collected by our own server from OP.GG about once a week and stored on that server. Your browser never contacts OP.GG, and no information about you is sent to OP.GG.
Google and Riot are based in the United States, so this may involve transfers outside the UK, EEA and South Africa, which those companies cover with their own safeguards.
We do not sell or share personal information, show ads, or use it for profiling. Because there is nothing to opt out of, browser signals such as Global Privacy Control have no effect on what happens, and nothing is processed differently if you send one.
Account data and saved progress are kept until you delete your account (Settings, then Delete account). Login sessions expire after 90 days. Shared list links last until your account is deleted. Visitor-counter hashes last under 24 hours.
Depending on where you live, you may have the right to access, correct, delete, restrict or export your data, to object to processing based on legitimate interests, and to withdraw consent. Most of this you can do yourself under Settings (export, edit your name, delete your account); for anything else contact [email protected]. You can also complain to your regulator: the UK Information Commissioner's Office (ico.org.uk), your EU data protection authority, or South Africa's Information Regulator (inforegulator.org.za). California residents can ask us what we hold, to correct it, or to delete it, and we will not treat you differently for doing so.
The site isn't aimed at children under 13, and we don't knowingly collect their information.
We keep data on a server we control and use reasonable measures to protect it, but no system is perfectly secure. We may update this policy; the date at the top shows when it last changed.