Privacy

Your account

• Username and email address (the email in lowercase).
• Your password, only as an Argon2 hash; the password itself is never stored.
• Your region, and once you link it, your Riot ID and the Riot account id (PUUID) Riot returns for it.
• Whether you are an admin (and whether that was set with the promote command), when the account was created, and when you were last here and the time before (to the hour), so Match Day can tell when you come back after a break.
• Your settings: whether you get survey questions, whether guidance (the welcome, checklist, hints and nudges) is on, and whether teammates may share your player card by link.
• Guidance you have seen or turned off: which item (for example “hint.draft_keys”) and when, so it is not shown again.

Signing in

• A session cookie (HttpOnly, SameSite=Strict) and the session it points to on the server. A session ends after 30 days without use; ended sessions are deleted.
• Invite codes with how often they were used and, for a team invite, the team and position it leads to.

Your team

• The team's name and region, its members with their place on the roster (starting five, substitute, coach) and position, and join requests with their status.
• What the team writes: drafts with picks and bans, series of drafts (best-of sets), draft trees, ban priority lists, game plans with checklists and checklist templates, reviews, action items (text, owner, due day), Sand Table boards with their saved versions, team notes (with the text before the last edit, and deleted notes for one day, so they can be restored), notes on champion pairs, and the next match (time, opponent, notes, who marked the brief read).
• Opponent dossiers: player names, Riot IDs and Riot account ids, champions seen, mastery and role data read from Riot, and your notes.
• Share links: a random token, what it opens, who made it, when it expires, and whether it was revoked.

Your own pages

• Your champion pool and champion notes, personal learnings and personal goals.

From Riot, when you or your team sync

• Your recent games: champion, kills, deaths, assists, CS, vision score, damage and the result.
• For a game you open: the public match data of all ten players and its timeline.
• Snapshots of your ranked standing (tier, division, LP, wins, losses).
• Game replays a team imports for the Sand Table: the per-minute positions and the events of all ten players, with their Riot account ids.

Bug reports

• What you send with the bug-report button: the page, the element you pointed at, your text, the category and the window size. Open reports are also written to a file on the server for the maintainer to read.
• What the team does with a report: its status, a title and a note the team writes (shown on the bug board only when the team puts it there), an internal note, which admin changed it and when, and when you last looked at your reports.

Community

• Your votes on What next ideas (which idea, when). Others see only how many votes an idea has, never who voted.
• Survey questions you were asked: which question, when it was shown, and your answer or that you dismissed it; and whether you turned survey questions off. Admins see answers without names.
• What admins write: survey questions, What next ideas, the monthly transparency figures, the texts of the transparency page and the champion traits behind the Draft Graph, each with who changed it and when.

What it does not do

No analytics, no advertising and no third-party trackers. The pages load no scripts, fonts or pictures from other sites: fonts are served by Team Companion itself, and champion and item pictures come through Team Companion's own server. Team Companion stores nothing in your browser besides the session cookie.

• Your account, your team's workspace and your own pages: to provide the service you signed up for. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).
• Linking your Riot account, syncing your games and your team's games, and share links: done when you or your team choose to. Legal basis: your own action under the contract with you (Art. 6(1)(b) GDPR).
• Scouting: when your team scouts an opponent, the public match history of the players it names. Legal basis: the team's legitimate interest in preparing for its matches (Art. 6(1)(f) GDPR).
• Logs, rate limits and backups: to keep the service secure, available and recoverable. Legal basis: legitimate interest in the security and operation of the service (Art. 6(1)(f) GDPR).
• Bug reports, votes and survey answers: to decide what to fix and build next, with you. Legal basis: your own action under the contract with you (Art. 6(1)(b) GDPR); you choose whether to send them.

Riot Games

The source of game data. Team Companion's server asks the Riot API for match history, match details and timelines, ranked standing and champion mastery when you or your team sync, link a Riot ID or scout an opponent. The request carries the Riot ID or account id being looked up and Team Companion's API key; your browser never contacts Riot.

Riot Games Data Dragon

Champion and item pictures and the champion list. Team Companion's server downloads them once per game patch and serves them itself; nothing about you is sent.

Hosting

The server and its database run on a rented virtual machine at Hetzner Online GmbH, Helsinki (Finland).

Backups

A nightly copy of the database, encrypted on the server before it leaves, is kept on a storage box at Hetzner Online GmbH, Falkenstein (Germany).

Nothing else: no analytics service, no email service, no payment provider.

One cookie, named id, set when you sign in. It holds a random session number, is sent only to Team Companion (HttpOnly, SameSite=Strict, and only over HTTPS) and ends 30 days after your last visit or when you sign out. It is needed to stay signed in; there are no other cookies and no tracking.

• The web server's access log records each request: time, address requested, status, response size, the request headers except cookies (such as the browser name and language) and your IP address shortened to its first three parts (IPv4) or first three groups (IPv6). Cookies and passwords are never logged. The access log is kept for 14 days, then deleted.
• The application log records errors and notable events, such as an admin change or an account deletion, with the account's internal id. It never records passwords or session numbers. It is rotated by size (five files of 10 MB), so older entries are overwritten as new ones arrive.
• Rate limits keep IP addresses and account ids in memory only; an entry is dropped a minute after it is no longer needed and nothing is written to disk.

• Your account, your own pages, synced games and ranked snapshots: until you delete your account.
• Your team's records: until the team deletes them, or the team is deleted. When you delete your account, what you wrote for the team stays with the team, shown as written by a former member.
• Deleted team notes: one day, so they can be restored. Sessions: 30 days after the last visit.
• Games opened on Team Companion (the public match data of all ten players and the timeline) are cached for everyone and deleted 12 months after they were fetched; a nightly task removes them. The basic record of a game (its id, queue and length) stays as long as someone's synced games use it, and is deleted 12 months after the game once nobody's do.
• Bug reports: until an admin deletes them. When you delete your account, your reports stay without your name, shown as from a former member, and your text, the element you pointed at and your window size are removed from them.
• Backups: 30 days. Data you delete disappears from the backups within 30 days. If nightly backups stop working for a while, the last good copies are kept until new ones succeed, so that a working copy always exists.

• Access and portability: Download my data on your profile gives you everything stored about you as a JSON file, at any time.
• Correction: change your username, region and Riot link on your profile; ask your team to correct team records.
• Erasure: Delete my account on your profile, without asking anyone.
• Restriction and objection, and anything the buttons do not cover: write to the contact above.
• You can complain to a data protection supervisory authority. The one responsible for the operator is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

Team Companion isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games, and all associated properties are trademarks or registered trademarks of Riot Games, Inc.