Privacy Policy

The champions you place on the board, the rank tier you selected, and the probability and rankings the model returned. These are stored so the model’s published accuracy can be measured against predictions that were made before the games were played rather than reconstructed afterwards — that is the whole argument of the Accuracy, and it is not possible without keeping them.

Your browser mints a random opaque string per draft and sends it with each update, so that a sequence of boards can be recognized as one champion select rather than several people drafting at once. It contains nothing and is derived from nothing about you, it is hashed before it reaches disk, it is kept in the tab’s own storage rather than a cookie, and it is discarded when you close the tab.

The site needs to know roughly how many people use it, and it has no cookie and no analytics to tell it — nor any help from the private profile, which the counter never sees: a visit is counted the same way with or without one. So your browser mints a second random opaque string — one per tab, kept in the tab’s own storage and discarded when you close the tab — and sends it with the one request each page load already makes. The server uses it to recognize that six page loads were one visit rather than six people, and then throws it away: it is folded into a counting sketch that keeps no identifiers and cannot be asked whether a particular token has been seen. Turning on “Don’t count my visits” below stops it being sent.

Opening or joining an arena room or a one-pick match gives your tab a random token that proves which seat is yours — whoever holds it can pick for that seat, so it is sent only to the game that minted it and never shown. It is kept in the tab’s own storage, so that reloading the page puts you back in your chair, and it is discarded when you close the tab. The game it belongs to lives in the server's memory and is gone within the hour. The one exception is the draft’s graded report, described under “What is kept”, which is stored without anything that names you.

To count visitors that never run JavaScript, the same sketch is fed a one-way hash of the connecting address and browser user-agent. That hash is never written down, and the key it is made with changes every day, so the same visitor is an unrelated value tomorrow and two days’ counts cannot be added together into a person. What is stored is a fixed-size array of small integers — how many distinct visitors there were, and nothing about any of them.

Choosing a language in the switcher saves that choice in your browser, so that the front door can send you to the right version next time instead of guessing from your browser's settings. It is one of three values — English, Spanish or Korean — and it is never sent to the server; it is listed because this page covers what the site keeps in your browser as well as what reaches the server. Clearing your site data removes it and the switcher falls back to your browser's own language preference.

Playing a draft in the arena — or a one-pick match, or the placement that finds your level, or choosing a level by hand — saves a rating in your browser for the name you played under: a number, how many drafts are behind it, and an id for the last board counted so the same draft cannot be counted twice. It is a scoreboard for whoever plays on this device, which is why it is keyed by the name you type rather than by anything about you. It is never sent to the server — the server grades the draft and this browser does the arithmetic — so nothing about it reaches a log. The daily board and Call the map, described below, are the places this site keeps a public score, and both are separate from this one. Clearing your site data removes it and the next draft starts again from the beginning.

If you created a private profile, a draft you play in that browser is also rated on the server, with your profile, and the two numbers are deliberately kept apart. The one in this browser is a score for this device, kept under whatever name is typed on the board; the one in your profile is a score for you, and nobody but you can see it. Neither is copied into the other: seeding the server’s number from one this browser can edit would make it worth exactly what the browser’s is worth. Clearing your site data clears the first; erasing your profile clears the second.

The daily board is a public scoreboard and that is the point of it, so it stores something after you close the tab — and so does one-pick practice, which keeps your first answer to each board so that the next person to draw that board has somebody to play against (“a past player”). Either way it records the name you typed, the champion you chose, the board, and when — nothing else. Call the map is the same kind of public ladder: it records the name you typed, the probability you gave for each professional game, and when, and ranks the names against the model. No IP address, no cookie, no account, and no way to connect one day’s entry to another except by the name itself. The name is remembered in your browser so you do not retype it, and clearing your site data forgets it.

• Anyone can type any name. None of the three is tied to an account — each takes the name you type and nothing else, and a private profile changes nothing about that — so they run on the honor system and a name on them is a claim rather than an identity. That is a deliberate trade: tying them to accounts would be more accurate and would mean they held something about you, and this way they hold nothing.
• The entries are public. A name with its pick or its call is visible to everybody who opens the page, which is what a leaderboard is — so put on it whatever you are content for strangers to read.
• There is nothing to delete on request, and nothing to identify. A row is a name, a pick or a probability, and a date, with no address, no session and no account behind it, so we could not connect one to a person even if asked to.

If you post on the ideas board or reply to a post there, ask a research question, or share counter advice, we store the text you wrote (after links, email addresses and phone numbers are removed), the optional name for board and research posts, the counter matchup and role when relevant, the kind of post and when it was posted. Counter advice has no display name. Before a post appears, its text — not your name — is screened for abuse by Google’s Vertex AI, described under “Who else is involved”; flagged posts wait for review. Posts that pass review are public. No address, account or browser identifier is stored with a post. If you vote, your browser keeps a random string and local vote state; the server stores only a one-way hash of that string combined with the post and the vote direction, so votes on different posts cannot be linked to each other. We may hide or delete any post. To have a post of yours removed, write to us.

If you ask us to audit a source on the benchmarks page, we store the link you gave, the reason you picked, the note you wrote (with any links, email addresses and phone numbers removed from it) and when you sent it. Nothing about you is stored with it: no name, address, account or browser identifier. A request is held until we look at it, and its text is not sent to any third party. An approved request is listed publicly on that page with its outcome. To have a request removed, write to us.

Some pages offer a short written explanation of a result, produced by a language model from the numbers already on the page. Under each one there is a thumbs-up and a thumbs-down. If you use it, we store the explanation itself, which model wrote it, how many times it was shown, and your verdict plus the reason you picked from the list — there is no free-text box. When the explanation is about a specific player (a scouting summary, a rivalry, your own profile, or a prediction for a seat you gave a Riot ID for), the text is not stored at all; only its length and your verdict are. Your browser keeps a random string, a list of what you rated and anything it could not send yet. The server stores only a one-way hash of that random string combined with the explanation, so your ratings of different explanations cannot be linked to each other. No address, account or browser identifier is stored with a rating.

Identity is optional on every page that offers it. When you provide a Riot ID, the server resolves it to a PUUID through Riot’s API in order to read that account’s rank, champion mastery, recent matches or current game — on head-to-head, for both of the two accounts you name, to find the games they played in the same match and to show each one’s recent record — and then:

• the PUUID is never sent to your browser. A page that resolved a Riot ID to a PUUID in the client would be a public de-anonymization endpoint wearing a win-predictor costume, and it would hand every visitor a key for looking that player up elsewhere;
• the Riot ID and the PUUID are never written to the prediction log. What is recorded is a salted handle — a one-way hash that lets one player’s predictions be matched to their own game results, and keeps their own player profile (below), and nothing else.

A raw PUUID exists briefly in a short-lived, non-public queue while a prediction is waiting to be matched against the game you actually played, and is dropped once it is.

If you use KayLoL as yourself, your player profile is kept. The personalized predictions read a player table that drops anyone who has gone 60 days without a ranked game. That rule does not apply to you if, within the last year, you asked for a prediction with your own Riot ID in your seat on the draft page, ran the Windows companion (private beta) while signed in to your League client, or kept a Riot ID linked on the profile page — so a break from ranked does not erase your history here. The only thing written for it is the same salted handle: when a linked Riot ID refreshes, it records the date at most once a day, and those rows are deleted after a year. Once a day the server matches the handles against the player table and hands the training cluster that table’s own numeric ids for those players — never a Riot ID, a PUUID or a handle. Opting out takes you off the list, and so does an erasure request.

The arena is the one exception, and it is deliberate: if you enter an account in a draft room, a one-pick match or the queue, that room, match or ticket holds the Riot ID and its PUUID in memory for as long as it lives — at most an hour, and gone the moment the service restarts. Nothing about it is written to disk, to a log, or to the prediction log. In a draft room the names you typed are shown to the other player, because they entered theirs; in a one-pick match they are shown only when you both chose to show your accounts, and a hidden match shows the other person nothing but a level. The PUUIDs are never sent to either browser, and the computer and a past player see nothing at all. When a draft is graded, its report — the board, the lanes, how each pick scored and what kind of game it was — is kept, but with no name, Riot ID, PUUID or handle attached.

Linking a Riot ID on the profile page keeps it in your browser, so that other pages can fill it in, together with the result of its last lookup — rank and champion records, never a PUUID; while KayLoL is open, it repeats that lookup at most once an hour while the ID is linked. Looking up recent matches on My Drafts remembers the Riot ID and server you used. Drafts you save are kept in your browser too, and replaying one in the arena hands it to that tab, which forgets it as soon as it has read it. Choosing the summary or the full view of your private profile is remembered and is never sent to the server. None of this leaves your browser except when a page uses it: a linked Riot ID for its lookup, a saved draft when you replay, grade or summarize it. Unlinking, deleting a saved draft or clearing your site data removes them. The exact names of everything the site keeps in your browser are in the technical appendix at the end of this page.

The Desktop companion (beta) is a separate program, offered only to invited testers. It reads champion select from the League client on your own PC and sends kaylol.gg snapshots of the draft — champions, bans, lanes and the order of picks, with no name, Riot ID or PUUID — which are kept as research data about drafts. From your own pick onward its requests for a prediction carry your own account’s PUUID, handled like a Riot ID you type on the draft page: used for the prediction and never written to the prediction log. Everything it reads, sends and never does is on its page. During a game on Summoner’s Rift it also records, about your own champion only, your health, your mana or energy and the gold you are holding, every two seconds and more often while your health is falling; of the other nine players it records only which champion died and for how long. At the end of the game it sends that recording once, with your Riot ID and the game’s id, to build your post-game review. The recording is kept with the saved review, under the same salted handle as the prediction log and never under your Riot ID or PUUID, so the review can be rebuilt when its rules change. It is used for your review only: no model is trained on it. It has no automatic expiry. Deleting your private profile erases the saved reviews and recordings of every League account linked to it; without a profile, ask at the address below and they are erased. From version 0.4.3, after a recorded game it also sends your own Riot letter grade, server, game ID and champion ID directly, using your own Riot ID to check participation; no KayLoL profile link is needed. The server keeps the client-reported grade with your role, patch, queue and selected own completed-game statistics for grade research, under a salted player handle. These labels have no automatic expiry and are not win-prediction inputs. Anonymous runs send no grades, and from version 0.4.4 unticking Share my Riot grades in the tray menu stops grade uploads and drops any still queued. Profile deletion or an erasure request removes your stored labels.

Tester keys. While the Android app and the Windows companion are in private testing, each opens with a key we give a tester. With a key we keep: the name or note we filed it under, its end date if it has one, which versions of each app it has downloaded and when, and, for each app, a random number the install made for itself the first time it used the key, with that install’s version and the last day it opened. The number is not a hardware identifier and is gone when the app’s data is cleared; it is what holds a key to one install. We can cancel a key at any time, and we delete a key and everything kept with it when asked.

The model and the tier list are built from completed ranked games collected from Riot’s public Match API — the same games Riot already publishes to any client, and the same data every match-history site is built on. That corpus trains the model and produces the champion statistics, and it also holds each account’s record — games, results and champions — that pages read when someone enters that account’s Riot ID. Those pages show public match data for whichever account is entered, as other League stats sites do, and the site cannot check that the account belongs to the person typing it, so someone else can look up yours unless it has been opted out, as the opt-out page describes. The professional pages also use public professional-match data, whose sources are listed on the About page.

• Riot Games. The API the site calls. A Riot ID you enter is sent to Riot to look the account up — necessarily, because the lookup is the thing you asked for. Riot’s handling of it is covered by their own privacy notice.
• Riot’s Data Dragon CDN. Champion, item and rune pictures are Riot’s, from Data Dragon, but your browser asks this site for them and our server fetches them from ddragon.leagueoflegends.com. Riot sees our server’s request, not yours, and nothing about you is passed on.
• Google Cloud (Vertex AI). The short written explanations on some pages are generated by Google’s Gemini model through Vertex AI, which processes those requests for KayLoL in the United States. What it is sent is the text an explanation is written from: the champions, the probabilities and other numbers the site has already computed for the page, and, for an explanation about one player — a scouting summary, a head-to-head, a profile — the statistics that explanation summarizes. That text carries no Riot ID or PUUID, and the only player it ever names is a professional, by public stage name, when a daily board came from a professional game. The text of a post on the ideas board is also sent to it, for an automatic abuse check before the post appears — not the name you post under, and with any Riot ID in it replaced. These requests come from our server, not your browser, so Google does not see your address. Google’s handling of them is covered by the Google Cloud Privacy Notice.
• Hosting. The site runs on servers its operator manages on Jetstream2, U.S. research computing infrastructure provided through the National Science Foundation’s ACCESS program, and backups are kept on the Open Storage Network, allocated through the same program.
• Email. Messages to contact@kaylol.gg are received and kept by Zoho Mail, which hosts that address.
• No analytics, advertising or error reporting. No analytics provider, no advertising network, no error-reporting service, no embedded fonts or scripts from a third party, and nothing sold to anyone. The site, its API and the Data Dragon pictures all come from this one origin, so your browser sends nothing to anyone else.

KayLoL offers no account made with an email address and a password. There is no email sign-up or password sign-in screen, and the server refuses both requests. The only thing on the site that works like an account is the private drafting profile below: it needs no email and no password, you create it by choice, and you reach it from another browser or device with a one-time code or by signing in with Riot or proving your League account again.

A private drafting profile, only after you opt in. It has no email. The browser receives one random, Secure, HttpOnly, SameSite cookie; the server stores only its hash, your created date, rating movements and completed KayLoL draft events. It is owner-only, can be linked to more browsers or devices with a one-time code you generate from the profile page, and can be erased entirely — from every linked browser — from the profile page. It is not a public Riot profile.

A verified League account, only if you link one. Sign in on Riot’s own page, or use the profile-icon fallback: we name an icon, read the account’s current icon from Riot’s API and link it if it matches. Either method opens the same profile on another device and unlocks predictions logged for that account — to you and nobody else. We keep the Riot ID, server, verification method and time, the prediction log’s salted handle, and the opt-out list’s one-way key. The Riot token and PUUID are never written down. Verification lapses after 90 days; removing the account or erasing the profile deletes the link.

What the full profile reads for a proven account. When you open the full view of your profile, we read your proven account’s rank, champion mastery and recent ranked games from Riot’s API. Each time the rank has moved, or a few hours have passed, we keep one record of it (tier, division, LP, wins and losses) with your profile, so the ranked climb has something to draw; it is deleted with the account or the profile. Your recent games are read live and not stored: their kills, items and results are shown to you and are never used to predict anything. Players who shared at least two of those games with you are listed by Riot ID beside your own record against or with them — read live, never kept, and never shown for anyone who has opted out of KayLoL. Arena rooms and One pick matches you finish while your profile is open in that browser are kept with it, for your own side only; the other player is recorded as a person, the computer, a past player or a pro, never by name. The champion card is drawn only for you and is not published anywhere.

Friends and challenges, only between private profiles. Two private profiles become friends only when one person hands the other a friend code or link and the other confirms it; there is no search by name or Riot ID. With your profile we keep the name you choose for friends, which profiles are your friends and since when, your friend code as a one-way hash for up to 7 days, and the profiles you blocked. For a challenge we keep the five boards, each side’s five picks and the score; an unanswered challenge is deleted after 7 days and a finished one after 30. A friend sees the name you chose, the picks you made on a challenge’s boards and its score — never your League account, your history or your other friends. Removing a friend deletes the pair and its challenges for both of you, and erasing the profile deletes all of it. The Android app, if you turn the check on, asks the server every 15 minutes or so whether a challenge is waiting; there is no push service, and no device identifier is stored for it.

A private profile changes nothing else on this page. It does not change what a prediction stores or what is kept about one — those are keyed by a salted handle and know nothing about profiles — it makes no difference to the visit count or the launch funnel described above, and the daily board still runs on the name you type.

Riot Sign-On is the primary verification method. Riot vouches for the account on its own page; the profile-icon check remains available as a fallback. Neither method makes this site store a PUUID, Riot token or password, and neither needs a cookie beyond the private profile’s own.

The simplest control is the one built into the product: do not enter a Riot ID. Every prediction works without one; identity adds your rank and mastery to the estimate and is offered, never required. It does not stop someone else from entering yours: pages that take a Riot ID read public match data for whichever account they are given, unless that account has been opted out (below).

To have stored predictions associated with your handle deleted, email contact@kaylol.gg with the Riot ID you used. Deletion is performed by hand by the operator: those predictions are keyed by a salted handle rather than by a profile, so a self-serve button would have to ask you to prove the Riot ID is yours first. A private drafting profile needs no email: you can erase it yourself from the profile page, and that erases it from every browser it is linked to. There is no tool for removing one account’s games from the public match corpus described above; requests about it go to the same address.

If you are in a jurisdiction that grants rights of access, correction, deletion or objection over personal data — the UK and EU among them — those requests go to the same address. Stored predictions and private profiles can be deleted on request, and a League account can be opted out of the site (below); the ranked games collected from Riot's API cannot yet be removed for a single account, and a request that covers them is answered with exactly what can and cannot be done. Data is stored on a server in the United States.

If an account is yours, you can ask for it to be opted out: no page then shows it, a draft that names it scores that seat as an anonymous player, and training data exported from then on no longer carries its identity. It deletes nothing and does not stop collection: the games already collected, the training data already exported, archives and backups keep what they hold, and new games are still collected like any other. Everything it does and does not do, and how to ask, is on the opt-out page.