Privacy policy

Lookup data

When you run a lookup, the service processes the Riot ID and League platform you submit. Public profile, ranked, mastery, and match data returned by Riot may be cached briefly to make repeated lookups faster and reduce unnecessary Riot API traffic. Custom-match history is excluded from public results unless a future Riot-approved sign-in flow obtains the player's explicit opt-in.

Technical records

The web server may record standard request information such as IP address, time, requested route, response status, and browser user agent for security, reliability, and abuse prevention. These records are not used to build advertising profiles.

The Companion page offers optional Hype and Read buttons. To limit repeat inflation, the server converts the requesting public network address into a keyed one-way digest scoped to the selected response and stores only that digest with the response time. It does not store the readable address in the engagement table, set a tracking cookie, or treat a button press as proof of one unique person. People sharing one public network share the same allowance.

Riot credentials

VRC.LOL will never ask for your Riot Games password. API credentials are held only in private server configuration and are not sent to browsers. Future Riot account linking would use Riot Sign On and would receive its own consent and retention details before release.

The API use and rate limits page explains how requests are paced, capped, cached and paused while Production access remains under review.

Desktop companion

The Windows companion is currently an invited test build. It reads player-visible League Client, Live Client, and delayed spectator data from Riot services running on the local computer. Spectator information can arrive late or omit assignments and action history. The companion labels inferred roles and does not claim delayed spectator data is live.

The League lockfile, its local password, and complete local-client responses remain on that computer and are never sent to VRC.LOL. The companion does not read League process memory, inject code, or include a Riot API key. The current build does not write runes, summoner spells, picks, bans, chat, pings, purchases or other actions into League.

Invitation codes are checked against one-way password hashes held in private server configuration. Successful entry creates a short-lived, single-use browser download token; the plain code is not stored in the URL or server rate-limit record. Failed attempts are counted against a temporary network-address hash to limit guessing.

Before opening, the invited build contacts VRC.LOL to retrieve a guarded release manifest. That request includes the installed companion version and build number in its user agent. Required updates are downloaded from VRC.LOL, checked against the published file size and SHA-256, and installed locally. Standard short-lived server security logs may record the request IP address and user agent.

Local match history

Completed non-custom match summaries may be saved on the computer for private post-match review. Each Riot account receives a separate local history identified by a one-way account fingerprint. Stored records exclude player names, Riot IDs, and account identifiers; they retain only the champions, roles, final scoreboard facts, items, and objective totals used by the review.

Completed non-custom matches are saved locally for each Riot account until you clear them. Switching accounts switches this history.

History is protected with Windows account-bound encryption. Records can span game patches and retain their recorded patch when known. The app initially shows 20 matches; showing older matches does not remove saved records. History can be deleted at any time from inside the companion. By default, this history is not uploaded to VRC.LOL.

Optional private match verification

The invited build contains an opt-in client for private completed-match verification. Go service integration, central VRC.LOL identity authorization and Riot registration review remain release gates; the local control does not establish service availability. The existing client sends a provisional, anonymous completed-match record, canonical Match ID, routing region and token-keyed one-way participant proof when separately enabled and configured. It does not send a Riot ID, player name or raw PUUID.

The intended verified flow keeps the record private and labelled pending until the server retrieves the completed match through Riot Match-v5. Riot-returned result, participants, score, items, objectives, queue, patch and duration replace the provisional factual fields. Unverified Companion records are never used for public statistics or aggregate build evidence. If the completed timeline is delayed, statistics can remain verified while event timing is pending. Timeline retries are limited to six attempts within 24 hours. The worker discards the participant proof when verification and timeline recovery complete, expire or are rejected.

Optional live-page connection

The connection is off by default and requires a private token. When the tester enables it during their own active match, the companion can send a restricted factual snapshot containing champion, role, queue, match clock, level, K/D/A, current gold, anonymous team champion composition, completed objective totals, and structure events reduced to side, lane, tier, and match time.

The upload contract rejects spectator mode, player names, Riot IDs, account identifiers, champion positions, local history, inventory, build advice, opponent rankings, the League lockfile, and complete local-client responses. Detailed structure events are limited to the token owner, the active feed expires, and disabling the connection stops future snapshots.

Retention and control

Short-lived web caches and standard security logs are retained only for service operation, abuse prevention, and Riot rate-limit protection. Local companion history is controlled on the tester's computer as described above. Questions or requests concerning server-held data can be raised through the contact below.

Contact

Privacy questions can be raised through the VRC.LOL community at vrc.lol/discord.