Privacy

If someone searched for you

You do not need an account here, and you may never have used this site at all — someone else can look you up. In that case what this app handles about you is the data Riot publishes for exactly that purpose: your Riot ID and its tag, your internal Riot player id, the server you play on, your ranked tier and division, and the statistics of your recent ranked solo/duo games.

Why we may hold it: legitimate interest. The data is already published by Riot for third-party sites like this one, the processing is what the person searching asked for, and it covers competitive statistics only — nothing sensitive, nothing about you outside the game.

If you sign in

The beta requires sign-in for player pages. We hold the account identifier issued by our sign-in provider (Amazon Cognito), the email address you signed up with, the list of players you have saved, and any paid-access period and generation allowance assigned to your account. During the closed beta, only invited email addresses can create an account, and the invited list is kept by the operator until the beta ends. We count generation attempts across coaching reviews and champion recommendations. If you send feedback or rate a coaching review or champion recommendation, we keep your message, the page you sent it from, and your thumbs up or down, linked to your account. Access is free by default. When subscriptions are enabled, Stripe handles checkout and billing management. We retain your Stripe customer/subscription identifiers and paid-access dates; card details stay with Stripe.

Why we may hold it: to provide what you asked for. Your saved players exist because you saved them, and your feedback exists because you sent it.

Cookies

The only cookies this site sets are the sign-in session cookies, and they only exist once you sign in. They are HttpOnly, so no JavaScript on the page can read them, and they are used for nothing but keeping you signed in.

Where analytics is switched on, a banner asks whether Hikaro may use Google Analytics to count visits and see which pages are used. Until you accept, nothing is requested from Google and no analytics cookie is set; declining, or never answering, keeps it that way. If you accept, Google Analytics sets its _ga cookies and receives anonymous usage data (pages viewed, approximate location, browser). Your choice is remembered in your browser only, and the “Cookie settings” link in the footer lets you change it at any time; declining removes the cookies again. There is no advertising cookie.

How long it is kept

Cached match and timeline records expire after 90 days; older stored versions may remain for a further 30 days. Derived player statistics and completed reviews remain until erased. Temporary job records expire after one day, except completion records needed to retrieve saved reviews. Feedback messages and review ratings remain until erased. Usage counters expire 90 days after their access period ends. Expiry cleanup can take additional time. Operational logs are kept for 30 days in production, and failed-job records for 14 days. Database recovery history can retain earlier versions for up to 35 days. Billing-setting audit records retain the administrator identifier and settings for one year. Verified payment-event identifiers expire after 90 days. Billing-account records remain until coordinated account closure.

Having your data deleted

There are two ways, because there are two situations.

• If you have an account: DELETE /me/data deletes your saved players, your feedback and ratings, and non-Stripe paid-access records, authenticated as you. Usage counters remain until their stated expiry to prevent resetting the free generation allowance. If you have a Stripe billing account, first manage your subscription from Your access and billing, then contact support for coordinated closure; this endpoint refuses to orphan a billing account. It does not delete your Cognito sign-in account.
• If you do not have an account: DELETE /players/<your-riot-player-id>/data deletes derived player records. The backend operation needs no player account, but the deployed gateway restricts it to authorized operators. A public self-service request flow is still being completed.

One limit, stated plainly: the raw match records cached from Riot are not deleted by a single player's request. Each one describes all ten players in that game, so deleting it because one participant asked would erase nine other people's records — and it would not remove anything from Riot, which is where the data actually comes from. What a deletion request removes is everything this app itself derived and stored about you.

What we do not do

Your data is not sold or shared with advertisers. Hikaro does not use it to train models. Groq receives computed game statistics to generate advice and has its own retention controls; retained customer data may be stored in the United States. Hosting our application in Paris does not make this AI processing EU-only. How that works is described on the AI transparency page.