Privacy policy

This page explains what data Recall collects, why, how long we keep it and how you control it. We only collect what is strictly necessary.

Data controller

information to come

Data collected

Data	Why	Legal basis
Email address (in lowercase)	Create your account, log you in, send you the service’s emails (login link, “your plan is ready”) and, as long as you keep it ticked, the check-in email one week after each plan	Performance of the service
Interface language, access level (free or other), role, whether you want the check-in email or not	Run the account	Performance of the service
Riot ID (name and tag), region (EUW)	Find your game account	Performance of the service
Riot technical player identifier (puuid) and Solo/Duo rank (tier, division, points)	Find your games, display your official rank, run the analyses	Performance of the service
Your declaration that the game account is yours (date)	Link the account without a password or any action in the client	Performance of the service
Ranked games read for your analysis (game identifier, end-of-game statistics and timeline, for all ten players in each game)	Produce your diagnostic and your plan	Performance of the service
Questionnaire answers: target elo, champions played, hours played per week	Tailor the plan to your goal	Performance of the service
Requested analyses (type, status, date, result)	Show you your diagnostic and your plan	Performance of the service
Beta sign-up: email, Riot ID and rank provided, source, date of your consent	Manage the beta access list	Consent
Login tokens (hash of the link and of the code, number of attempts, expiry date)	Log you in without a password, block abuse	Legitimate interest (security)
Sessions (random identifier of the session cookie and expiry date, server-side)	Keep you logged in	Performance of the service
Rate-limit counters (non-reversible hash of your IP address or your email, number of requests)	Prevent mass sending and mass attempts	Legitimate interest (security)
Technical logs (masked email address, masked player identifiers and tokens, never the query string of URLs)	Fix outages, protect the service	Legitimate interest (security)
Usage measures of your player area, server-side: page opened (plan, diagnostic, cheat sheet), day and number of openings; days on which you open your area; date of your first login and time until your first diagnostic was displayed. Never the time of day, never the IP address, no tracker	Steer the beta: know whether plans are reread, whether the cheat sheet is used, whether the first diagnostic arrives quickly	Legitimate interest (improving the service)
Analytics (Plausible), if enabled	Understand how the site is used	Consent

We never ask for your Riot password. We collect no other data.

Usage measures, without trackers

To know whether the service is useful (a plan reread, a cheat sheet opened before playing, a first diagnostic displayed quickly), we count server-side, in our database, a few actions in your player area: the page opened (plan, diagnostic, cheat sheet), the day and the number of openings; the days on which you open your area; the date of your first login and the time until your first diagnostic was displayed. No cookie, no script, no pixel, no IP address, no time of day: one counter per page and per day, that’s all. We only read these measures in aggregate (headcounts on the beta health page and in a daily email to the team), never player by player. They are included in your export, erased with your account and purged after six months. You can’t opt out of them one by one; if you don’t want to be counted, write to us.

Where the game data comes from

It comes from Riot Games’ official API. The calls are made by our servers, at your request (account linking, analysis). They are never made from your browser. We only read ranked games (Solo/Duo), whose history is available through this API.

Other players’ games

To build the benchmarks by tier and by role, we also read, through the same API, ranked games of players picked at random on the EUW server. From the moment they are indexed, these players are referred to by an identifier derived by hashing, never by their Riot ID, and their games are only used for aggregate calculations (averages, spreads by tier). The raw files are kept for twelve months (see below). If you don’t want your games to be included in these calculations, write to us: we will remove them from subsequent calculations.

Retention periods

• Account, Riot ID, questionnaire and analyses: until your account is deleted.
• Usage measures (counters per page and per day): six months, then automatic purge; erased immediately with your account.
• Login tokens: valid for 15 minutes, single use; expired tokens are deleted automatically within 24 hours.
• Sessions: 30 days from login; expired sessions are deleted automatically every hour, and logging out, “Log me out of all my devices” or deleting your account erases them immediately.
• Rate-limit counters: we store neither your IP address nor your email in plain text, only a non-reversible hash; these counters are purged automatically within 24 hours, including after your account is deleted (they prevent the limits from being bypassed by re-creating an account).
• Emails stored in the development inbox: this inbox doesn’t exist in production. In production, emails are sent by the email provider and aren’t kept in our database.
• Raw files of games read through the API (they contain the Riot IDs of all ten players in each game): at most twelve months on our servers (in practice, they are deleted after ninety days), with access restricted to the team; the files that carry the identity of your game account (API responses about your account, your rank, your game lists) are erased when your account is deleted; the results of your analyses, however, stay in the database until your account is deleted.
• Analysis working folders on the server (intermediate game database, without Riot IDs): thirty days.
• Database backups: encrypted daily copies (sessions are not included in them), kept for fourteen days on the server and in a storage space in the European Union; a deleted account disappears from the backups when they expire.
• Technical logs: about fifty megabytes per service, in rotation, i.e. a few days to a few weeks depending on activity.
• Beta sign-up: until you ask for it to be deleted or the beta ends. information to come

Recipients and processors

Your data is neither sold nor rented. It is accessible to the team and to these providers:

• Hetzner Online GmbH (Germany): hosting of the server, the database and the backups, in data centres located in the European Union.
• Anthropic, PBC (United States): writing the text of your improvement plan. The file sent contains the statistics of your games and the computed findings, without your Riot ID, your email address or your player identifier. Anthropic does not use this data to train its models (commercial terms of the API).
• Email provider: information to come.
• Riot Games: receives your Riot ID and the requests needed for the Riot API.
• Plausible, if analytics is enabled and you accept it: measurement without advertising cookies and without cross-site tracking. See the cookies page.

Transfers outside the European Union

The only transfers outside the European Union are: the writing of the plans by Anthropic (United States), covered by the European Commission’s standard contractual clauses information to come; and, where applicable, the email provider information to come.

If someone declares your game account

During the beta, linking a game account relies on a declaration. Another person could declare your Riot ID: they would then get a diagnostic computed from your public ranked game history, the same one that statistics sites display. If you don’t want that, write to us: we will put your account on an opt-out list and no analysis will be produced for it any more. Official login with a Riot account will replace the declaration as soon as Riot makes it available to us.

Your rights

You have the right to access your data, have it corrected, have it erased, get it back in a readable format (portability), object to processing and request that processing be restricted. You can also withdraw your consent at any time.

You can do it all yourself, without writing to us, on the /app/compte page:

• Export: download all your data in JSON format (usage measures included).
• Deletion: delete your account immediately. Your email, Riot ID, answers, analyses, usage measures and sessions are erased.
• Emails: the “check-in email one week after each plan” box can be unticked on the same page, or in one click from the “stop these reminders” link in the email.

For other requests, write to information to come.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Security

• The site is served over HTTPS.
• Session cookies are HttpOnly: browser scripts can’t read them.
• Login links and codes are stored as fingerprints, not in clear text; the session identifier is a random value unrelated to your identity, and it is deleted when you log out.
• The Riot API key and the other secrets are kept in environment variables, never in the code.

No protection is absolute. In the event of a data breach affecting you, we will notify you and the CNIL within the legal deadlines.

Minors

The service is reserved for people aged at least information to come. Below that age, the consent of a parent or guardian is required.

Updates

We may change this policy. The date at the top of the page changes, and we will let you know by email of any significant change.