Privacy Policy

Last updated: June 4, 2026

lol-comp is a champion pool builder for League of Legends. This policy explains what data we collect when you use the service, how we use it, who we share it with, and the controls you have over it.

What data we collect

  • Identity (via Google OAuth): your name, email address, and profile image URL. We never receive or store your Google password.
  • User-generated content: the champion pools you build (per lane), comfort-tier assignments (S / A / B / C), and per-champion notes (markdown text).
  • Session data: a NextAuth session token stored in an HTTP-only cookie, encrypted with a server-side secret.
  • Recommendation telemetry: when a recommendation is served we record enemy-team fingerprints, your pool fingerprints, the model version, the suggestions returned, and their scores. This is used to improve the engine and is tagged with your user ID so it can be anonymized on request.
  • Champ-select state (desktop overlay only): if you use the Tauri desktop overlay, it reads your summoner name and current champ-select session state from your local League Client Update (LCU) API. This data stays on your machine, or is sent to lol-comp's GraphQL API only to compute a recommendation — we do not retain raw LCU state beyond that request.

How we use your data

  • Rendering your pool builder UI.
  • Persisting your pools and notes for return visits.
  • Identifying you across sessions so your data follows you.
  • Generating champion pick recommendations during champ-select.
  • Producing aggregate, de-identified analytics to improve the recommendation engine.

Third parties (sub-processors)

We rely on a small set of infrastructure providers to run the service. We do not sell your data to anyone.

  • Google — OAuth sign-in only.
  • Vercel — hosting for the marketing app and dashboard.
  • Neon — PostgreSQL database.
  • Railway — GraphQL API and background workers.
  • Sentry — error monitoring, with personally identifiable information scrubbed.

Data retention

  • Pool data & notes: retained until you delete them or request account deletion.
  • Session cookies: expire per the NextAuth configuration (typically 30 days).
  • Recommendation telemetry: retained indefinitely for engine improvement; can be anonymized when you request account deletion.
  • Riot LCU data: not retained server-side beyond the per-request recommendation.

Your rights

You have the right to access, correct, export, or delete your personal data. We honor these requests regardless of where you live.

Cookies

We use a single NextAuth session cookie to keep you signed in. It is HTTP-only, secure, and uses SameSite=Lax. We do not use third-party tracking cookies or advertising cookies, and we do not currently use analytics cookies.

Contact

Questions about this policy or your data? Reach us at privacy@lolcomp.tech.