Privacy policy — League of Legends

• You can read the whole site without an account, and most of it has nothing to sign in to.
• If you make a community account we store your email address, your handle, and whatever you post.
• Two Google services run on the site — Analytics and AdSense — and they set cookies and receive your IP address. You choose whether they may.
• The site also counts visits itself, in its own systems, and sends that to nobody. The same choice governs it.
• Nothing you do on the reference pages is stored or sent anywhere.
• Nothing is sold, and there is no mailing list.

The community section — guides, builds, the forum, comments and profiles — needs an account. If you make one we store your email address, your chosen handle, your password as a hash (never the password itself), and anything you choose to add to your profile such as a bio or links to your other profiles.

Your email address is used to sign you in and to recover your account. It is never shown to other people, never sold, and never used to email you anything you did not ask for. If you sign in with Google or Discord instead, we receive your email address and an account identifier from them, and store the same things.

Everything you publish is public and shown next to your handle — that is the point of a community site. Drafts are visible only to you. Votes and saves are stored against your account so the site knows what you have already voted on and saved; who saved what is not shown to anybody else.

Signing in sets one cookie, which keeps you signed in. It cannot be read by JavaScript and does nothing else.

There is a Delete account button at the bottom of your own profile. It removes your account, your email address, everything you have published, and your comments, votes and saves. It happens immediately and cannot be undone.

Your handle stays reserved afterwards, holding nothing but the fact that it is retired — so nobody else can take the name and be mistaken for you. If you would rather we did it, or you cannot sign in, ask through the contact page.

You can also edit or withdraw anything you have published at any time, from the page itself or from your profile.

The site runs Google Analytics 4 (measurement ID G-V5NHBM3EVL) to count visits and see which pages are read. It sets cookies in your browser and sends Google your IP address, the page you are on, the referring page, and general details about your device and browser. It is used only to understand which parts of the site are worth the work.

You can block it with any tracker-blocking extension, with a browser that blocks third-party cookies, or with Google's own opt-out add-on. Nothing on the site breaks if you do.

In the EEA, the UK and Switzerland no analytics or advertising storage is used until you allow it. Everywhere else it starts allowed, and you can decline it below — in both cases your choice is remembered in this browser and applies to Analytics and AdSense together.

This site carries Google AdSense (publisher ID ca-pub-5596683677764689). Google and its partners use cookies and similar technology to serve ads and, where you have allowed it, to personalise them based on your previous visits to this and other sites.

You can turn personalised advertising off at Google My Ad Center, and review how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. Third-party vendors may also use their own cookies; aboutads.info/choices lists the opt-outs.

Alongside Google's tools, this site counts its own visits. Those numbers are the only ones we can trust: a large share of a gaming audience blocks third-party analytics, and not a random share, so what Google reports is a biased sample rather than a smaller one. Everything described here stays in our own systems — it is sent to nobody.

A cookie holds a random identifier for your browser. It is not derived from you, your device or anything you have ever typed, and it is used only to tell one browser's visits apart from another's.

Per page you open we record:

• the path of the page — never the query string, which is where a search box or a shared link would be;
• the time, and which visit it belongs to (a gap of over 30 minutes starts a new one);
• the host that linked you to us — www.google.com, not the search you typed, and not the page;
• whether the page was read on a phone, a tablet or a desktop, from the width of the window. The width itself is not kept;
• the utm_ labels on the address you first arrived at, which is how we tell whether an ad was worth running;
• how far down the page you got, at quarter marks, and roughly how long the page was open;
• what you clicked, by the control's own name — “Search”, not what you searched for. Never the contents of anything you type.

If you are signed in, the account is recorded alongside it, which is the only part of this that is tied to a person rather than to a browser. Removing your account removes those rows with it, along with everything else of yours — that is what the section on removing an account covers.

Page-level records are kept for 90 days and the per-browser record for 400 days, after which the database removes them on its own. Nothing here is sold, shared, or sent to an advertising network, and there is no identifier in it that could follow you to another site.

Your answer to the cookie banner governs this as well as Google's tools. In the EEA, the UK and Switzerland nothing is recorded until you allow it. Everywhere else it starts allowed and you can decline, in which case nothing further is sent from your browser at all. Declining is remembered in this browser; you can change your mind at any time using the control above, and the contact page is where to ask for anything already recorded to be removed.

This site keeps very little in your browser's local storage. It never leaves your device, and clearing your site data removes it. (Signing in uses the one cookie described above, not local storage.)

• Your consent choice — whether Analytics and AdSense may run, so you are not asked again.
• Nothing else. The team builder keeps your draft in the page address, so the link is the save; a downloaded team file stays wherever you save it. Neither is stored by the site.

Loading a page makes your browser fetch files from a few other hosts. Each of those sees your IP address and user agent, as any web request does:

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for the typefaces.
• Google Analytics and AdSense, as described above.
• Riot Games (ddragon.leagueoflegends.com) for alternate-skin splash art, when you open a champion's skins.

Every other champion, item, rune and spell image is served from this site itself.

The pages are static files on Amazon S3, served through Amazon CloudFront. The community section is served by a small API on AWS Lambda with a database holding accounts and posts, all in the same AWS account and region.

Like any web host, AWS keeps standard access logs of requests, which include your IP address, the page requested, the time, and your browser's user-agent string. We use them to keep the site working and to count visitors — they are the only visitor count that is not affected by tracker blockers. They are deleted automatically after fifteen months, are never joined to your account, and are not used to build a profile of you. These are records of our own server doing its job, so there is no opt-out for them.

If you have an account, you can see and change everything we hold about you from your profile, and ask us to delete all of it as described above. If you do not, the site holds nothing about you beyond the server logs. To reach the data Google holds, use the Google links above; those controls are the ones that matter. To clear what this site put in your browser, clear its site data.

This site is not aimed at children under 13, and nothing on it asks for personal details.

If this policy changes, the date at the top changes with it. Questions go through the contact page.