Privacy Policy

Version 1 · in effect since 29 September 2026

1. Who is responsible

RiftCoach is developed by ToriiTech (Gustavo Momma). The contact for anything in this policy, including your rights as a data subject, is toriitech2026@gmail.com.

2. What stays on your machine

The program creates a folder at ~/.riftcoach (inside your user directory) and keeps there:

• The cache of the matches you analyzed, exactly as Riot returned them.
• The reports it generated.
• The memory — a SQLite database with the findings from your previous matches, which is what lets it say "this repeats across your last five games".
• Champion and item icons downloaded from Data Dragon, so the program works offline.

Your API keys — the Riot one, and an AI one if you use it — live in the credential vault of your operating system (Credential Manager on Windows, Keychain on macOS), never in a text file and never in the source code.

None of this is sent to us. We have no way to read that folder, because there is no server for it to go to.

How to delete it

Delete the ~/.riftcoach folder. That is all — there is no copy anywhere else. Keys come out through the operating system vault, or with riftcoach logout.

3. What leaves your machine

Three destinations, and none of them is us.

The Riot Games API

The program fetches your matches straight from Riot servers, from your machine, using your key. That request carries your Riot ID and the account identifier (PUUID) Riot returns. This traffic is between you and Riot; how Riot handles it follows the privacy policy of Riot Games itself.

An AI provider, if you configure one

The written part of the report is optional. If you configure an AI provider, the program sends it the already-measured numbers from the match — time, gold, approximate position, error category — so it can write the explanation in prose. The model never produces the numbers; it explains the ones already computed.

If you run the model locally (Ollama), nothing leaves the machine. And privacy_mode: strict removes cloud providers at the router, before the choice is made — it is not a warning on screen, it is the absence of a path.

Data Dragon

The official public Riot CDN that serves names, costs and icons. It carries no key and nothing of yours beyond the request for the file.

4. Aggregate sharing — optional and off

The program has a feature, off by default, that prepares aggregate counts from your analyses, for the purpose of calibrating the evaluation engine. If you never turn it on, it never does anything.

When on, the package it builds contains counts only, per row:

• patch, role, champion, opponent champion;
• category and kind of the finding;
• number of occurrences and average severity;
• the total of matches analyzed, because a count with no denominator calibrates nothing.

It does not contain prose, free text, PUUID, Riot ID, match ID, or any other identifier. There is no path from it back to you.

Today that package goes nowhere. No upload service exists: the file sits on disk, on your machine. When one exists, uploading will be a step of its own, with consent rechecked at the moment of upload.

Consent is versioned: if we ever change what is done with this data, the version goes up and the program asks again instead of assuming the old yes still holds. Revoking deletes the local queue.

5. This website

The site is hosted on Cloudflare Pages, and the installer is distributed by Cloudflare R2. Cloudflare logs accesses (IP address, browser, timestamp) to operate and protect the infrastructure, as any web server does.

The subscription API (api.toriitech.app.br) also runs on Cloudflare. It receives your email when you subscribe, because Mercado Pago needs it to issue the charge, and stores a random identifier for your subscription. It never sees your card: payment happens entirely on Mercado Pago's own site.

There is no analytics, no pixel, no tracking cookie and no advertising. Typefaces are loaded from Google Fonts, which means your IP reaches Google during that load — we say so because it is true, not because the site needs it.

If you email us, we keep the email in order to reply.

6. AI models and match data

The project does not train machine-learning models on match data, and does not intend to. The reason is concrete: the Riot terms require, on termination, deleting all Game Information in our possession, and Brazilian data protection law (LGPD) gives you the same right to erasure. Trained model weights cannot be selectively deleted — training would mean taking on an obligation with no mechanism to honor it.

All personalization is retrieval over a database, which a delete statement genuinely empties.

7. Paid services

Paid hosted services are planned and do not exist yet. When they do, they will handle data differently from the local program — there will be an account, there will be a server — and this policy will be updated before launch, not after.

8. Your rights

Under the LGPD (Law 13.709/2018, art. 18) you may request confirmation of processing, access, correction, anonymization, portability, erasure, and information about sharing, and you may withdraw consent at any time. If you are in the EU, the GDPR grants equivalent rights.

In practice, for the local program, most of this you carry out yourself without asking anyone: the data is your files, on your machine. For anything that depends on us, write to toriitech2026@gmail.com — we reply within 15 days.

9. Children

RiftCoach is not directed at children under 13 and does not knowingly collect their data.

10. Changes to this policy

If it changes, the date and version number at the top change with it. A change that affects what leaves your machine will be announced in the program, not only here.