Privacy Policy

Who runs this site

TFT Guessr is an independent fan project. For questions about your data, contact contact@tftguessr.com. It is not operated by Riot Games.

What we use and why

Accounts: We store your email address, account name, a salted password hash, account timestamps, and session information to create and secure your account. We do not store your password in plain text. Providing these account details is necessary to register; you can play without registering.

Progress and rankings: Signed-in guesses, fight dates, results, timestamps, and any progress resets are stored to remember your results and calculate leaderboard scores. Your account name and ranking statistics are public. Your email address is not shown on the leaderboard.

Security: Your IP address is processed to deliver the site and limit repeated requests that could disrupt sign-in or gameplay. Hosting and video providers also receive connection information when serving pages or media.

Contact: If you email us, we use your email address and message to respond. Do not send your password.

Where the GDPR applies, account and score processing supports the service you request (Article 6(1)(b)); security and responding to enquiries rely on our legitimate interests in running a safe, usable service (Article 6(1)(f)). Optional analytics is enabled only with your consent (Article 6(1)(a)).

Cookies and browser storage

We use the following storage to provide sign-in, remember game progress, and save your analytics choice. Blocking necessary cookies may prevent sign-in.

• tftguessr_session: a random sign-in token in an HTTP-only cookie, normally valid for up to 30 days. Signing out clears it. The server stores a hash of the token.
• tftguessr_admin: an HTTP-only cookie for authorised administrators, normally valid for up to 12 hours. It is not needed for ordinary play.
• tftguessr:progress:{date}, tftguessr:progress:{date}:user:{id}, and tftguessr:month:{YYYY-MM}: daily guesses and monthly progress for this browser, with separate daily progress for guests and each signed-in account.
• tftguessr:analytics-consent: your analytics preference and the provider you agreed to for this browser.
• _ga and _ga_085J7X98MR: optional Google Analytics cookies used to distinguish browsers and maintain session information after you allow analytics. Their default lifetime is up to two years and may be renewed on visits.

Local storage has no automatic expiry. You can remove it through your browser’s site-data settings. Clearing browser data does not delete your account or server-stored scores.

Optional analytics

We load Google Analytics 4 only after you select “Allow analytics”. It measures page visits, referral sources, approximate location, and browser/device categories. We do not send your account details or individual guesses to Google Analytics.

Google Analytics uses cookies and browser identifiers to measure visits and sessions. Google says Analytics does not log or store individual IP addresses and uses them to derive approximate location. We disable Google signals and advertising personalization in our tag. Google may process analytics data outside the EEA. See how Google uses information from sites that use its services.

You can refuse analytics and keep playing. Use Privacy Choices in the footer at any time to change or withdraw your choice. Withdrawal stops future measurement and clears this site’s Google Analytics cookies in this browser; it does not delete data already collected by Google Analytics. Your choice is not shared between devices.

Who receives data

Hosting, media-storage, analytics, and email providers process the information needed to deliver their services. The site is configured to use Hetzner for hosting and media storage, and Google for optional analytics.

Fight recordings can contain in-game names visible in the footage. Contact us if a recording raises a privacy concern.

How long data stays

Account details and score history remain while your account exists, so you can return to your progress. The app does not currently expire inactive accounts or old scores automatically. Contact us to request deletion.

Session access expires at the cookie durations above. IP-based request counters are held in server memory and reset for rate limiting, normally every 15 minutes; their records are cleared when the process restarts. Local browser storage remains until cleared.

Your rights and requests

Where the GDPR applies, you can request access, correction, deletion, restriction, or a portable copy of your personal data, and object to processing based on legitimate interests. These rights have legal conditions and exceptions. You can withdraw analytics consent at any time without affecting earlier lawful processing.

Email contact@tftguessr.com to make a request. We may need to verify that the account belongs to you. GDPR requests normally require a response within one month; if a permitted extension is needed, we must explain it within that month. You can also complain to your local data-protection authority.

Scores are calculated automatically from guesses. We do not use them to make decisions with legal or similarly significant effects on you.