Privacy Policy

Last updated 7 September 2026

What the site collects

A draft, when you build one

The champions you place on the board, the rank tier you selected, and the probability and rankings the model returned. These are stored so the model's published accuracy can be measured against predictions that were made before the games were played rather than reconstructed afterwards — that is the whole argument of the metrics page, and it is not possible without keeping them.

A per-draft token

Your browser mints a random opaque string per draft and sends it with each update, so that a sequence of boards can be recognised as one champion select rather than several people drafting at once. It contains nothing and is derived from nothing about you, it is hashed before it reaches disk, it lives in sessionStorage rather than a cookie, and it is discarded when you close the tab.

A per-tab token, so visits can be counted as people

The site needs to know roughly how many people use it, and it has no account, no cookie and no analytics to tell it. So your browser mints a second random opaque string — one per tab, in sessionStorage, discarded when you close the tab — and sends it with the one request each page load already makes. The server uses it to recognise that six page loads were one visit rather than six people, and then throws it away: it is folded into a counting sketch that keeps no identifiers and cannot be asked whether a particular token has been seen.

A daily count of visitors, derived and immediately discarded

To count visitors that never run JavaScript, the same sketch is fed a one-way hash of the connecting address and browser user-agent. That hash is never written down, and the key it is made with changes every day, so the same visitor is an unrelated value tomorrow and two days' counts cannot be added together into a person. What is stored is a fixed-size array of small integers — how many distinct visitors there were, and nothing about any of them.

A Riot ID, only if you type one

Identity is optional on every page that offers it. When you provide a Riot ID, the server resolves it to a PUUID through Riot's API in order to read that account's rank, champion mastery, or current game — on head-to-head, for both of the two accounts you name, and there only to find the games they played together — and then:

• the PUUID is never sent to your browser. A page that resolved a Riot ID to a PUUID in the client would be a public de-anonymisation endpoint wearing a win-predictor costume, and it would hand every visitor a key for looking that player up elsewhere;
• the Riot ID and the PUUID are never written to the prediction log. What is recorded is a salted handle — a one-way hash that lets one player's predictions be matched to their own game results and nothing else.

A raw PUUID exists briefly in a short-lived, non-public queue while a prediction is waiting to be matched against the game you actually played, and is dropped once it is.

What is kept, and for how long

The values below are the shape of the policy. The current settings of the running service are printed under “What we keep” on the metrics page, read from the service itself, so they cannot drift from what the software actually does.

Kept

The draft as submitted, the predicted probability, the ranking returned, the outcome once it is known, and a salted handle when a Riot ID was given.

Expires

The identifier naming the game a prediction was matched to, after the window shown on the metrics page.

Never stored

A Riot ID. A raw PUUID, outside the short-lived resolution queue described above. An IP address — the API does not log one, and the visitor count described above derives a daily hash from it in memory without ever writing the address or the hash. No cookie, no advertising identifier, and nothing that survives closing the tab.

Pseudonymous is not anonymous. A salted handle attached to a stored draft is not identifying on its own, but someone holding a large corpus of match data could in principle link it back to an account. Saying “anonymised” would overstate it, so this page does not.

Separately: the public match data behind the model

The model and the tier list are built from completed ranked games collected from Riot's public Match API — the same games Riot already publishes to any client, and the same data every match-history site is built on. That corpus is used in aggregate to train and to compute champion statistics. Nothing on the site exposes an individual player's match history, and no page will tell you anything about a player other than the visitor who typed their own name in.

Who else is involved

• Riot Games. The API the site calls, and the only party any of your data is shared with — necessarily, because the lookup is the thing you asked for. Riot's handling of it is covered by their own privacy notice.
• Riot's Data Dragon CDN. Champion icons load in your browser directly from ddragon.leagueoflegends.com, which means Riot's CDN sees the request the way any image host would. It sets no cookie for us and we receive nothing back from it.
• Nobody else. No analytics provider, no advertising network, no error-reporting service, no embedded fonts or scripts from a third party, and no sale or sharing of anything to anyone. The site is served from a single origin, which is also why it needs no cross-site requests at all.

Your choices

The simplest control is the one built into the product: do not enter a Riot ID. Every prediction works without one; identity adds your rank and mastery to the estimate and is offered, never required.

To have stored predictions associated with your handle deleted, email contact@kaylol.gg with the Riot ID you used. Deletion is performed by hand by the operator: because the site stores no account and no raw identifier, it cannot offer a self-serve delete button without first asking you to prove the account is yours, which would mean collecting more about you rather than less.

If you are in a jurisdiction that grants rights of access, correction, deletion or objection over personal data — the UK and EU among them — those requests go to the same address and are honoured. Data is stored on a server in the United States.

Children

KayLoL is not directed at children under 13, collects no age information, and has no account system. It should be used in line with Riot's own age requirements for League of Legends.

Changes and contact

The date at the top is the date of the last change. If what is stored ever expands, this page changes before the collection starts, not after.

Anything at all: contact@kaylol.gg. See also the Terms of Service.