Privacy Policy

Who We Are

Draft Coach is a League of Legends draft guidance website and desktop companion operated by the Draft Coach team. Contact us about this policy or your data at privacy@draftcoach.gg.

Data We Collect

We collect only the data needed to operate, secure, support, and improve Draft Coach.

• Draft Coach account: verified email address, optional display name, Argon2id password hash, account and password timestamps, hashed single-use verification/reset credentials while active, hashed Draft Coach sessions, user agent, session expiry/revocation records, keyed authentication throttle buckets, and credential security events. Draft Coach never stores a plaintext password or plaintext verification/reset token.
• Desktop app: the Windows app stores only the Draft Coach bearer session in Windows Credential Manager. Profile data remains in memory. The app deletes the retired plaintext session file when found.
• Champion select: the desktop app reads local League Client champion-select state and sends role, champion picks, bans, and queue context needed to calculate recommendations.
• Riot account links: when you connect Riot, we receive an opaque Riot subject, PUUID, visible Riot ID, platform or region, and verification timestamps. Riot authorization, ID, access, and unexpected refresh tokens are discarded after the lookup and are not retained.
• Riot statistics: our internal pipeline may process Riot-provided match IDs, PUUIDs, summoner IDs, champion selections, ranks, item and skill events, outcomes, and related gameplay data to produce aggregate statistics.
• Supporter billing: Draft Coach stores your account-to-Stripe Customer and Subscription mapping, subscription status, paid-through and cancellation projection, Checkout recovery identifiers, and processed webhook IDs. Stripe handles payment methods, invoices, billing addresses, tax calculation, and payment processing. Draft Coach does not store card details, full Stripe event bodies, or invoice history.
• Support and technical data: messages or bug reports you send, IP address, user agent, device or browser information, request metadata, security logs, and essential cookies.

The desktop app does not send us your Riot password, League Client lockfile password, or local Riot authentication token.

How We Use Data

• To maintain verified Draft Coach accounts and revocable browser or desktop sessions.
• To link and unlink Riot accounts that you separately authorize.
• To calculate draft recommendations and publish aggregate game statistics.
• To create Stripe Checkout or Customer Portal sessions and project verified Supporter payment and cancellation state across your Draft Coach account.
• To secure the service, prevent abuse, troubleshoot issues, respond to support, and meet Riot, payment, tax, accounting, and legal obligations.

Supporter status does not gate recommendations or existing product functionality.

Legal Bases

Where laws such as the GDPR apply, we rely on performance of a contract to provide Draft Coach and a requested Supporter membership; legitimate interests for security, abuse prevention, debugging, and product improvement; consent for optional Riot linking or communications; and legal obligations for limited billing, tax, dispute, or disclosure records.

Cookies And Analytics

Draft Coach uses essential host-only session cookies and short-lived OAuth binding cookies for browser account security. We do not currently use advertising cookies or third-party behavioral analytics cookies. Static asset providers may receive normal browser request information such as IP address and user agent.

Processors And Sharing

We do not sell personal data. We disclose limited data only as needed to:

• Resend: deliver account verification, password-reset, and password-security messages and process the recipient address and delivery metadata needed for that purpose.
• Riot Games: complete account authorization, obtain linked Riot account data, use Riot APIs, and process Riot-required deletion identifiers.
• Stripe: process payments, collect billing details, calculate applicable tax, provide invoices and the Customer Portal, and send signed billing events.
• Cloudflare, Hetzner, and supporting service providers: host, proxy, store, secure, log, and operate Draft Coach.
• Advisers or authorities: comply with law, security, disputes, or legal process.

Retention

• Account and linked Riot records are kept while the account is active, then deleted or de-identified after a valid request unless limited records are required for security, law, disputes, billing, tax, or backup integrity.
• Browser sessions last about one day, or about 30 days when remember is selected. Desktop sessions last about 30 days. Logout revokes the presented Draft Coach session.
• OAuth transactions expire after about 10 minutes; desktop start, Riot-link start, and desktop handoff codes expire after about two minutes.
• Stripe projection and event-deduplication records are retained as needed to operate the membership and meet payment, accounting, tax, dispute, and legal obligations. Stripe separately retains payment and invoice records under its policies.
• Recommendation inputs are used to calculate recommendations; we do not intentionally keep champion-select snapshots as user history.
• Most Riot match-processing tables are retained for 7 to 30 days. The bounded Riot crawl frontier keyed by PUUID may remain while needed for aggregate coverage.
• Backups and infrastructure logs may persist for a limited rolling period before expiry or overwrite.

Your Choices And Rights

You can revoke a Draft Coach session by logging out, reset your password through Draft Coach's single-use email recovery, unlink Riot accounts from the account page, and manage payment methods and end-of-period cancellation in Stripe's Customer Portal. You may request access, correction, deletion, or unlinking at privacy@draftcoach.gg. We process Riot-provided deletion identifiers as required by Riot policy and applicable law.

Security

Measures include salted Argon2id password hashing, common-password screening, verified email, short-lived hashed single-use verification/reset credentials, database-backed account and network throttling, server-side session revocation, SHA-256 session hashes, encrypted Riot OAuth verifiers, PKCE and nonce binding, host-only secure cookies, Windows Credential Manager, exact-body Stripe webhook signatures, HTTPS, restricted infrastructure access, and sanitized credential security events. No online service is perfectly secure; contact security@draftcoach.gg if you believe data has been exposed.

Children

Draft Coach is not intended for children under 13, and we do not knowingly collect personal data from children under 13. Contact us if you believe a child provided personal data.

International Transfers

Draft Coach and its providers may process data outside your country. Where required, we use appropriate safeguards for those transfers.

Changes

We may update this policy as Draft Coach changes. Material changes will update the date above and receive additional notice when appropriate.