RiftCoach

Compliance and API use

Last revised 29 September 2026

This is the complete technical description of what RiftCoach does with the Riot Games API, written for anyone reviewing it — at Riot or elsewhere — and for any player who wants the reasoning before installing a binary.

The short version: it only ever reads matches that have already ended, it refuses to run during a live game, and that refusal is enforced by code that fails closed, not by a promise in a document like this one.

What RiftCoach is

A Windows desktop application that reviews League of Legends matches that have already finished and produces a coaching report. It is aimed at players who can see that they lost but cannot see where. Its purpose is to point at the specific decision that cost them the game, at the second it happened, so they can watch it again in the replay.

How it works

  1. The user supplies their Riot ID. Today the user also supplies their own Riot API key; see Business model for how that changes under a Production Key.
  2. The app fetches completed matches via match-v5 and the match timeline.
  3. All perception and arithmetic is done deterministically in Python. Item, champion and rune facts are read from Data Dragon, pinned to the patch of the match being analyzed rather than the current patch.
  4. An evaluation engine converts game state into a gold-equivalent advantage and then into win probability, so a mistake is reported as a measured win-probability loss rather than an opinion. Every statement carries a timestamp and an evidence tier: measured directly from telemetry, derived from telemetry plus a stated assumption, or inferred.
  5. Optionally, a language model writes the explanatory prose on top of the already-measured numbers. The model never produces the numbers. If no model is configured, the full deterministic report is still produced.
  6. The user can open the replay in the League client, and the app draws the annotations over the replay window, synchronized to the replay clock.

It never runs during a live game

This is the part worth verifying rather than believing, so here is the mechanism.

A single module is the only code in the application authorized to open a connection to 127.0.0.1:2999. Before every request it checks GET /replay/playback — a route that exists only while a replay is playing. During a live game that route returns 404, while /liveclientdata/* keeps answering, and the 404 raises an exception that aborts the operation.

It fails closed on 404, on connection error, on timeout, and on an unexpected response body. The overlay itself does not know the port, opens no socket and builds no URL; it asks the guarded controller. It reads the replay clock through the official Replay API.

What it deliberately does not do

Riot APIs used

Expected request volume

One report costs roughly five requests: account-v1 once per user and cached, the match id list, the match, its timeline, and league-v4 for the rank. The heaviest consumer is a periodic sampling job that reads the top three ladders to build the per-patch aggregates; it is not user-triggered and is throttled by a limiter that reads the X-App-Rate-Limit header and adapts to whatever limit the key carries.

Data handling

Match data is cached locally on the machine of the user and is not transmitted anywhere except to an AI provider the user explicitly configured. A strict privacy mode removes all cloud providers at the router level. API keys are stored in the credential vault of the operating system, never in the repository.

An optional, off-by-default sharing feature prepares aggregate categorical counts only — error category, severity, phase, role, champion, opponent champion, patch. It never includes free-text prose, PUUIDs, Riot IDs, match IDs or any other identifier. Consent is versioned. There is currently no upload service, so those packages remain on the machine of the user.

Full detail is in the privacy policy.

Machine learning

The project does not and will not train machine-learning models on match data. Trained weights cannot be selectively deleted, which would make the deletion obligation in the API terms impossible to honor, and data protection law creates the same impossibility. Personalization is retrieval over a database that a DELETE statement can empty.

Business model

The desktop application is free, requires no account, and keeps every capability it has today for the matches of the user themselves. Nothing that works today moves behind payment, and no competitive information is gated. This is a written rule of the project, and the Terms of Use bind ToriiTech to it irrevocably.

What ToriiTech intends to charge for is a hosted service, which does not exist yet:

Every paid item is a service that costs money to run. None of them is a capability removed from the free client.

The key and the distributed client

An API key cannot be shipped inside the client: Riot's terms forbid disclosing it, and in a distributed binary it is extractable in minutes, proprietary or not. Under a Production Key the key stays on the server, the distributed client never receives it, and the client has no code path that would send it anywhere.

Verification

The source repository is private, so none of the above has to be taken on trust: we will grant read access to a reviewer on request, and provide a build. The live-game interlock lives in a single module, riftcoach/replay/guard.py, and is covered by the test suite, so it can be verified in a few minutes with access.

Write to toriitech2026@gmail.com.

Privacy Policy · Terms of use

RiftCoach is not endorsed by Riot Games and does not reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. League of Legends and Riot Games are trademarks or registered trademarks of Riot Games, Inc.

A product built by ToriiTech · toriitech2026@gmail.com