Privacy

Fantasy LoL is a small alpha project run by one person. This page says what data it keeps, why, and what you can do about it. If anything here is unclear, email privacy@fantasylol.app or use the in-app Send feedback button.

The short version

• The account data is a username, an email address, a hashed password, and the date you registered. The email is used to sign in and to send you a code when you forget your password. No phone number, and no marketing email unless you tick the optional mailing-list box at signup.
• The survey after signup is optional: every question, and the whole thing. You can skip it and use the app normally.
• We use your answers and how you use the app to decide what to build, and to show organizations in the League ecosystem, including Riot Games, that there is a real audience of people who still follow competitive League. Anything shared outside this project is grouped statistics only. Never your username, never your individual answers.
• No ads. No selling data. No third-party trackers or analytics SDKs. One essential cookie of our own. The optional draft music is YouTube’s player, with YouTube’s own cookies and storage, and it loads only once you press play, then in later drafts until you turn it off (see below).

What we collect

To run your account. Your username, your email address, a scrypt hash of your password (never the password itself), the date you registered, and a login session — a random token set as one cookie, which we store on our side only as a hash, with an expiry. When a password reset is requested for your account, we keep a hash of that 6-digit code (it works for 15 minutes), when it was requested, and how many wrong codes were tried; that record is deleted within about a day. Your email is never shown to other players. Accounts made before email was added may have none until you add one from your profile.

If you fill in the survey (optional). Your answers to questions about how often you play League now and used to, what changed if you play less, how much pro League you watch and where, which leagues and teams you follow, how long you have played and followed the scene, the highest rank you reached and the roles and modes you played, which other Riot games you have played and which Riot shows, music, lore, merchandise or live events you have tried, whether you have ever spent money in League (a rough range, not amounts), how you found this site, and, only if you choose to answer, your age range. We also store whether and when you consented to us using this for the purposes below, and a one-time flag recording that you have seen the survey so it stops prompting.

As you play. The rosters you build: your standing solo ladder roster for each region, and your team and roster in any league you create or join. Each time you save a roster we also add one dated line to an append-only log (your user id, which region or league, and when). We keep this to count, week by week, how many people come back — a genuine returning-player count instead of a re-saved default. Only grouped totals are ever shown or shared; the raw lines are never published tied to you. Plus anything you type or score in the feedback form, stored with your username so we can tell reports apart and follow up on the bug or request. The message is also passed to our email provider so it can reach us (see Who else touches the data).

We do not collect your real name, precise location, contacts, browsing outside this site, or any payment information (the app is free and has no payments). We do not keep an application record of each login, though the server log below records requests as they arrive.

Server logs

The web server (Caddy, on the same host as everything else) keeps a standard access log. For each request it records, among the usual fields, your IP address, your browser’s user-agent string, the address requested — which can include an invite code (?code=) or a link tag (?ref=) when you follow such a link — the page you arrived from (the Referer header, when your browser sends it), and the response status, size and timing. It does not log your session cookie or any other credential header; Caddy omits those by default. The Referer is stored but is not used to build any cross-site profile; the log exists so we can tell whether a shared link was opened and fix errors.

The log is rotated every day and nothing older than about 30 days is kept. The lawful basis is our legitimate interest in running and understanding the site.

Why we use it

• To build the app: deciding which features and leagues to prioritize.
• To show the audience exists: grouped, de-identified statistics (for example, "68% of users played daily a few years ago and monthly or less now") shared with partners and potential partners in the League ecosystem, including Riot Games. These reports never contain your username or your individual responses, and cannot be traced back to you.
• To understand and fix what you reported when you send feedback.

Lawful basis. Running your account — storing your username, your email, your password hash, your registration date, your login session and any pending reset code — is necessary to provide the service you asked for. The mailing list is a separate consent: it only holds your address if you checked that box at signup. The survey and any analysis of your survey answers also run on your consent. You can withdraw either any time (see Your choices), and withdrawing does not affect your account. The roster-save log, the server access log, the feedback you send us (kept with your username), and the one-time flag that you have seen the survey all run on our legitimate interest in running the site, fixing what you report, and knowing whether people come back; you can object to any of these by asking through the contact below. If you are in the UK or EU you also have the right to complain to your data protection authority.

What we don't do

• No advertising, and no advertising or analytics trackers of any kind.
• We never sell, rent, or trade your data, and we never hand your email address or your individual survey answers to anyone: partners only ever see grouped statistics. If Fantasy LoL shuts down, the database, every email address in it included, is deleted, not sold or transferred as an asset.
• We don't send marketing email unless you opt in. Every account gets transactional email only: a password reset code, and only when you ask for one. At signup you can separately check a box to join a mailing list for occasional Fantasy LoL updates; leaving it unchecked sends none. If you email us, we use that address only to reply.
• The only cookie we set is the login session cookie. It is essential, it is not used for tracking, and it is cleared when you sign out. YouTube’s player sets its own cookies and storage, but only once you press play on the draft music (see below).

Who else touches the data

• DigitalOcean hosts the server the data sits on.
• Cloudflare provides DNS for the domain and runs the mail routing for privacy@fantasylol.app: a message you send to that address passes through Cloudflare and is forwarded to a private mailbox.
• Google hosts that mailbox, so an email you send us is stored in Gmail.
• Klaviyo sends our email. Having an account does not send Klaviyo your address; it receives data only in these cases. When a password reset code is issued for your account, we send it your email address and the 6-digit code so it can email the code to you, and it keeps a record of that event (address, code, time) and of the email it sent. When you use the in-app feedback button, we pass it the text you wrote (not your username) so the message can be forwarded to us. If you ticked the mailing-list box at signup, your address is added to a list there and you may receive occasional Fantasy LoL updates; you can leave that list any time (see Your choices) without affecting your account. Klaviyo keeps these records, plus its own delivery logs and (for anyone on the list) opens and clicks, under its own retention and privacy terms, separately from our database. When we delete your account we delete any profile Klaviyo holds for your email address too (see Your choices; tell us if you used a different address before); to have it removed without deleting your account, ask through the contact below. Feedback text sent this way stays in Klaviyo until we delete it there, so it can outlive our own copy.
• Riot Games and image hosts. Your browser loads some League content straight from outside hosts, not through our server: on the Research tab, the current patch number from Riot’s Data Dragon service; and team logos and player photos, mostly from Riot’s esports image server and for some images from a wiki image host (Fandom) or an esports or team media site. Player photos in the draft lock-in animation always load this way. Any time your browser loads one of these, your IP address, your browser string and the fact that you came from fantasylol.app reach that host — not the page you were on or any invite code, and never your username or what you do in the app. A future version may also let you link a Riot account to pull your own stats — that would be opt-in and is not built yet.
• YouTube, only if you press play on the draft music. During a live snake draft you can play the classic champ-select theme. Nothing loads from YouTube until you press Play the draft music; after that your browser loads YouTube’s own player in an embedded frame from youtube-nocookie.com (none of YouTube’s code runs in the Fantasy LoL page itself), so YouTube, which is Google, receives your IP address, your browser string and the fact that you came from fantasylol.app, and as soon as the player loads it can read or set its own cookies and browser storage (and recognise you if you are signed in to Google), under Google’s privacy policy. YouTube decides what its player shows, which could include its own ads. We send it nothing about you. Your device remembers the choice for later drafts; the ✕ next to the player turns it back off.

That covers hosting, DNS and mail, League patch and image data, and the optional draft music. There is no analytics and no advertising. The only marketing tool is the optional mailing list described under Klaviyo above.

Our infrastructure providers, Google, Klaviyo and Riot Games are United States companies; the smaller image hosts may be elsewhere. Where any of them handle data about UK or EU visitors they do so under their own published privacy terms; ask us if you need the specifics for a particular one.

Your choices

• Review and edit your survey answers any time from your profile, under Update your survey answers.
• Withdraw consent and delete your survey answers yourself, any time, from that same screen (the Withdraw consent and delete my answers link). This stops any further use of your answers and permanently removes every survey answer tied to your account straight away. Your account is unaffected.
• Skip the survey entirely: it never blocks the app.
• Leave the mailing list any time via the unsubscribe link on any list email, or by asking through the contact below. This only stops list email; you still get password reset codes when you ask for them, and your account is unaffected.
• Delete your whole account: ask through the contact below. This is a one-person alpha with no automated account deletion yet, so we do it by hand — our target is within 7 days of confirming your request, and always within the one month the law allows. On deletion we remove your login and email, your rosters, your survey answers, your consent record and your lines in the roster-save log, we delete any profile Klaviyo (our email provider) holds for your email address too, and we scrub your username from the saved data of any league you were in (it is stored there to label your team). It also clears from our nightly backups within about two weeks after that. Some things can stay: statistics we have already grouped (which no longer single you out), the feedback you have sent us (we keep the text but strip your username off it, unless you ask us to delete it entirely, which also removes the copy Klaviyo holds), and messages you posted in a league chat, which stay in that league’s history attributed to your team name. Leaving a league after it has started is not a deletion: your team stays in that league, run by an auto-manager, and your login is detached from it. Your team can be taken back with the invite code while the league runs.
• Get a copy of your data: ask the same way.

How long we keep it

Account data, survey answers and your rosters are kept while your account is active, and removed when you delete your answers or your account on the timeline in Your choices. Roster-save log lines are kept while your account exists and are deleted with it. Server logs are rotated daily and nothing older than about 30 days is kept (see Server logs). Feedback you send, and any email you send to privacy@fantasylol.app, are kept while they are useful for acting on your report or request and then deleted. Nightly backups are kept about two weeks before they roll off.

Children

This app is not aimed at children. If you tell us you are under 18, the server does not keep any survey answers for your account, turns analytics consent off, and deletes any answers already given.

Security

Passwords are hashed. Traffic is served over HTTPS. Backups are kept on the same provider. This is a small project without a dedicated security team; we keep the data we hold minimal on purpose, and we will tell affected users if we ever learn of a breach.

Changes

If this note changes in a way that matters, signed-in users get a one-time notice in the app pointing back here the next time they open it. The date below always reflects the current version.

Who runs this. Fantasy LoL is operated by Nelson Tan, an individual, on a non-commercial basis. Nelson Tan is the data controller for the personal data described on this page.
Contact: email privacy@fantasylol.app with any privacy question or request — deleting your account, a copy of your data, withdrawing consent, or objecting to a use. You do not need an account to write. If you are signed in, you can also use the in-app Send feedback button.

Effective: 21 September 2026

Back to Fantasy LoL →