Privacy Policy
Version and last updated: 2026-09-18
This notice explains how Thomas BARTHOIS, the individual operator of RiftEssence, handles personal data during the beta. The GDPR and the French Data Protection Act apply. Acknowledging this notice does not consent to optional tracking.
1. Data and where it comes from
Account data includes your username, email when supplied, password hash, linked Discord identifier and username, session information, age range, and the version, language and time of your legal acceptance. We ask for an age range, not your date of birth or identity document. Required fields enable the account or requested feature; optional profile fields may be left blank.
You provide profile details, languages, roles, champion collections, posts, guides, teams, community memberships, messages, ratings, media and support requests. Reports may include evidence links and an optional Discord contact. PE balances, rewards, purchases, refunds and ad campaigns produce transaction records.
Discord and Riot supply the account information you authorize. Riot services supply game identifiers, rankings and statistics. Authorized Discord integrations can relay posts and ratings into the service. Technical requests expose IP addresses and browser information to the servers handling them. Ad measurement, when allowed, uses a hashed IP address and an account identifier when available; these are pseudonymous personal data, not anonymous data.
2. Purposes and legal bases
Providing the account, requested integrations, messages, community features and PE transactions is based on performing the service contract (GDPR Article 6(1)(b)). Fraud prevention, account security, moderation and necessary diagnostics rely on legitimate interests (Article 6(1)(f)); you may object for reasons relating to your situation. Responding to applicable legal obligations relies on Article 6(1)(c).
Optional audience measurement, advertising measurement and third-party media rely on your separate consent (Article 6(1)(a)). Refusal does not prevent account creation. Change or withdraw each choice through Cookie settings. Discord message forwarding is a separate account setting; enabling it sends message previews and relevant notifications to Discord. We do not sell personal data.
3. Visibility, recipients and providers
Public profiles, posts, guides, shared collections, communities and ratings can be read by other people and may be indexed by search engines. Avoid publishing sensitive information or information about others without a lawful reason. Private messages are available to their participants; authorized moderators may access relevant records to investigate abuse. Report and bug-report details, including evidence links and contact details, may be forwarded to the restricted Discord channel used by the moderation team.
The frontend is hosted by Vercel. During beta, Thomas BARTHOIS operates the backend on a personal server. Authorized administrators operate the service and its database. Cloudflare provides security and bot protection where enabled. Riot and Discord handle their respective integrations. Vercel Web Analytics is loaded only with audience-measurement consent. YouTube and externally hosted profile media load only with external-media consent; advertising images and measurement require ad-measurement consent.
Some providers process data outside the European Economic Area, including in the United States. Provider-specific information and available contractual safeguards are linked below, including Vercel’s data-processing terms. Contact the operator for details of the safeguards applicable to a particular processing operation. An external website you deliberately visit has its own privacy rules.
4. Retention and security
Account and integration data are kept while needed to provide your account and requested features, until removal or an erasure request is actioned. Public content remains until you remove it or it is removed through moderation. Messages, reports and evidence are retained while needed for their conversation, investigation or an associated dispute; continued retention must be justified by that purpose. Withdrawn provider access is no longer used.
PE and campaign history is kept to operate balances, provide your dashboard and resolve transaction disputes. Any necessary legal or dispute records may be retained with restricted access after other account data is removed, only for the applicable legal period or duration of the dispute. Acceptance receipts remain associated with the account; they are not public. Operational diagnostic incidents are retained for 30 days and process-run records for 14 days. These limits do not describe separate hosting-provider logs or backups; ask the operator about those records.
Access controls, password hashing, secure session cookies and transport security protect the service. No system provides absolute security. Do not submit passwords, identity documents or other unnecessary sensitive data as report evidence. Account erasure, backup erasure and deletion from third-party moderation records require handling across those systems; we will explain any necessary retention exception when responding to your request.
5. Your rights and requests
You may request access, correction, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. You can withdraw consent without affecting processing lawfully performed before withdrawal. French law also allows instructions concerning your data after death. Requests are free unless a lawful exception applies.
Use the legal contact below, identifying your account and request. We may request proportionate verification if necessary, without routinely requiring an identity document. We respond within one month; complex requests may take up to two additional months, with an explanation within the first month. You may complain directly to the CNIL at cnil.fr or another competent supervisory authority.
6. Minors and changes
Self-registration is available from age 15, with any legally required parental permission. If an account appears to belong to a younger child, contact us so we can restrict it and address the data involved. We do not request a full birth date. Parents or guardians may contact us to exercise applicable rights.
Matching, rankings and game statistics help you browse the community; they do not make legal decisions about you. You can ask for a human review of a moderation decision. Material changes to these notices are presented for renewed acknowledgement with a new version. Optional tracking is never enabled by accepting revised terms.
Operator contact
Thomas BARTHOIS · RiftEssence