Privacy

Rift Rush (riftrush.gg) is run by:

Write to that address with any question about your data or to use any of your rights. Full company details are in the legal notice.

Rift Rush is a fan project. It isn’t endorsed by Riot Games, and Riot Games gets no data about you from us. Game data and images come from Riot’s Data Dragon and are stored on our server, so your browser never contacts Riot while you play.

Like every website, our server receives what your browser sends with each request: your IP address, the page you asked for, your browser and operating system (the user agent) and your language settings. We need that to deliver the page.

• Rate limits. Your IP address goes into short-lived counters in our server’s memory to stop abuse, like 30 sign-in attempts per 15 minutes. They are never written to disk.
• Server logs. For each request we log the time, method, path, status code and a random request ID. No IP addresses, no cookies.
• No third parties. Fonts, images, sounds and scripts all come from our own server. Your browser only talks to Discord if you choose to sign in with Discord.

Legal basis

Art. 6(1)(f) GDPR: our legitimate interest in delivering the site and keeping it secure and available.

How long

Rate-limit counters: one hour at most. Server logs: 14 days.

“Play as guest” creates a temporary account with a generated name (like Guest_7KQ2M9) and no email or password. We store its matches, Daily runs, rating and icon, plus a sign-in session (see Security and fair play). Guests don’t appear on the ladder, the Daily board, in player search or on public profiles.

If you create an account or sign in, the guest’s progress moves into that account and the guest is deleted.

Legal basis

Art. 6(1)(b) GDPR: needed to provide the game you asked to play.

How long

Until you leave guest mode, or 30 days after your last visit. The guest is then deleted automatically within an hour. Your opponents keep the match in their history under the guest name.

When you sign up we store:

• Username, shown to other players.
• Email address, to sign you in, confirm the address, reset your password and send account notices. Other players never see it.
• Password, only as an argon2id hash. Nobody can read it, us included.
• Champion icon, if you pick one.
• When you signed up and confirmed your email address.

Legal basis

Art. 6(1)(b) GDPR: needed to run your account.

How long

Until you delete your account.

Sign in with Discord

If you choose “Continue with Discord”, Discord sends us your Discord user ID, your Discord name and your email address. We store the ID and name to recognise you next time, and a new account uses the email address. We don’t store Discord access tokens and can’t read or post anything on Discord. On Discord’s pages, Discord’s privacy policy applies; Discord Inc. is based in the USA.

Legal basis

Art. 6(1)(b) GDPR, at your request.

How long

Until you disconnect Discord in Settings or delete your account.

Emails

We only send emails about your account: the confirmation link, password resets, confirming a new address (with a heads-up to the old one) and a notice when your password changes. No newsletters, no marketing. They go out through the mail servers of our host, IONOS SE (see Who else gets your data).

Legal basis

Art. 6(1)(b) GDPR: needed to run your account.

How long

We keep only a hash of each link. Links expire after 1 hour (password reset), 24 hours (new address) or 48 hours (confirmation) and are deleted 7 days later.

For every match we store the mode, the questions, each player’s answers and answer times, the score, the result and the rating change. From your answers in rated duels, our rating system estimates how much you know and how fast you are. Survival and Daily runs are stored the same way.

• Public. Your username, icon, rank, LP, record and recent matches show on your profile and the ladder; Daily scores show on the Daily board. Opponents see your name, icon and rank during a duel.
• Recorded runs. When nobody else is queueing, a player may duel a recorded run: the answers and answer times of an earlier match, replayed live. Your matches can be replayed to other players this way, under your name and icon.

Legal basis

Art. 6(1)(b) GDPR: matches, ratings and the ladder are the game.

How long

As long as your account exists. When you delete it, your name in past matches becomes “Deleted player” and the records stay in your opponents’ history without any link to you.

Monthly rewards

The best players on the ladder when a month ends win an RP gift card. We keep each month’s winners (name, place, rating and whether the card was sent) and use a winner’s email address to send the card.

Legal basis

Art. 6(1)(b) GDPR: needed to hand out the prize.

How long

The winners list stays as a record of the prizes. Deleting your account replaces your name in it with “Deleted player”.

• Sessions. When you sign in (or start as a guest) we store a hash of your session token, the IP address and browser the session started from, and when it was last used. The IP address helps us spot abuse and keeps throwaway guests from the same network out of your ranked matches, so nobody can farm wins off their own accounts.
• Anti-cheat. Our server times every answer and rejects answers that arrive too early or too late.
• Protection. Everything runs over HTTPS. Passwords are hashed with argon2id; session tokens and email links are stored only as hashes.

You can sign out on all devices in Settings.

Legal basis

Art. 6(1)(f) GDPR: our legitimate interest in secure accounts and fair rankings.

How long

A session ends when you sign out, or 30 days after your last visit, and is deleted within an hour after that.

We want to know whether Rift Rush works: how many people play, whether they come back, which questions are too hard. We do this without cookies, without storing anything in your browser and without outside services.

Game statistics

While you’re signed in (as a guest too), we note once a day that you were active, whether you’re a guest, the site’s language, your device type (phone, tablet or desktop, read from the user agent) and how many matches you finished. We also record some game events: joining or leaving the queue, invites, sign-ups and leaving a match early. The admin dashboard shows this as totals and charts, plus a list of the most active players.

Legal basis

Art. 6(1)(f) GDPR: our legitimate interest in improving the game.

How long

400 days. When you delete your account, the events lose their link to you and the daily rows keep only a number that no longer belongs to anyone.

Web traffic

Page views and a few actions (such as starting a match, creating an invite or signing up) go to our own server, which forwards them to Umami, an analytics tool we run ourselves on the same servers. Before forwarding, we strip everything after the “?” in addresses (except campaign tags like utm_source), hide invite codes and cut referrers down to the site and page. Umami receives your IP address and user agent only to work out your country, browser, operating system and a visitor ID that’s re-salted every month; it doesn’t store your IP address. It also stores the page, the referring site, your screen size and your language.

Legal basis

Art. 6(1)(f) GDPR: our legitimate interest in knowing how people find and use the site.

How long

Umami keeps the page views, but because the visitor ID changes every month they can’t be linked to you once that month is over.

Your right to object. If your browser sends a Global Privacy Control or Do Not Track signal, we don’t record your page views at all. To object to the game statistics, write to info@komplify.de.

We only use what the site needs to work, which is why there’s no cookie banner.

On riftrush.gg the cookie names start with “__Host-” (rr_session) or “__Secure-” (rr_oauth), browser security features that only let them travel over HTTPS.

Legal basis

§ 25(2) no. 2 TDDDG: strictly necessary for a service you asked for, so no consent is needed. Using the data: Art. 6(1)(b) and (f) GDPR.

How long

As listed in the table.

• Hosting and email. IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, runs our servers in the EU and sends our emails, on our behalf (data processing agreement under Art. 28 GDPR).
• Discord, only if you use Discord sign-in. To complete it, our server exchanges a one-time code with Discord in the USA (see Your account).
• Other players see what’s public: your profile, the ladder and your side of a duel.

We don’t sell your data, don’t share it with advertisers and don’t use it for ads. Apart from Discord sign-in, your data stays in the EU. We only hand data to authorities when the law obliges us to.

Under the GDPR you can:

• find out what data we hold about you and get a copy (Art. 15)
• have it corrected (Art. 16)
• have it deleted (Art. 17)
• restrict how we use it (Art. 18)
• get it in a machine-readable format (Art. 20)
• object to anything we do based on legitimate interest (Art. 21)

A lot of this you can do yourself in Settings: change your email, password and icon, disconnect Discord, sign out everywhere or delete your account. For anything else, write to info@komplify.de. We answer within a month.

You can also complain to a data protection authority, for example the one where you live, or the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

Matchmaking and ratings are calculated automatically, but they only decide who you play and what rank you have. We make no automated decisions with legal or similarly significant effects on you.

Rift Rush is for players aged 16 and over. If you’re younger, ask a parent or guardian before you create an account.

When we change how we handle data, we update this page and the date at the top. If a change affects your account in a meaningful way, we’ll tell you on the site.