Privacy Policy

ko.lol is run by KOLOL LLC, 8 The Green # 10335, Dover, DE 19901, USA. KOLOL LLC decides how your personal data is used, which makes it the "controller" under EU and UK law. You can reach us about anything in this policy at [email protected]. We have not appointed a representative in the EU or the UK, so write to that address from anywhere.

This policy covers the website at ko.lol in every language, the public player, match and lobby pages, the desktop app, your ko.lol account, the trial and Premium, and our Discord server and its bot. The forum at forum.ko.lol runs on separate software with its own sign-up: it keeps the email and user name you register with, and what you post there is public. Riot Games, Google, Facebook, Discord, Stripe and our advertising partner each have their own privacy policy for what they collect themselves.

Every ko.lol account starts with Riot sign-in. Riot shows its own sign-in page, so we never see your Riot password. Riot gives us your account's player id (the PUUID), your Riot ID (name and tag) and the region your account plays on, and we keep all three. If you connect more than one Riot account, we keep each of them. To keep your Riot sign-in working, we also keep a sign-in token that Riot gives us. It is stored encrypted, and we delete it after 30 days without use or as soon as Riot refuses it.

We ask for an email address to finish signing in, and the app needs one to score matches. If you sign in with Google or Facebook and they tell us your email is verified, we save that one. We use your email for account emails: a welcome when your trial starts, reminders before your trial or Premium ends, a note when it has ended, a note when you have used your free matches, and later messages asking you to come back. These emails are on by default, and you get at most one a day. You can turn them off with the link at the bottom of every email or on your account page, and we keep a record of which emails we sent you. We send no newsletters, and we never give your email to anyone for their own marketing. If you pay by card, Stripe receives it (see below).

You can add your full name, from 2 to 60 characters. Only you and our staff see it: everywhere else ko.lol shows your Riot ID. If your full name is empty when you connect Google or Facebook, we fill it in with the name they give us. You can change it or remove it on your account page.

You can connect Google or Facebook to sign in with them, and Discord to get your roles in our Discord server. From Google we receive your email, whether Google has verified it, your full, first and last name, your profile picture, your language and, for a Google Workspace account, its domain. From Facebook we receive your email and your public profile: your first, middle, last and short name, and your profile picture. From Discord we receive your Discord user id, user name and display name, your avatar, your language, whether two-step login is on and which Nitro plan you have. Discord does not give us your email. We keep these details with your account, refresh them each time you sign in, and show them only to you and our staff. You can disconnect Google, Facebook or Discord on your account page at any time.

You can add up to ten links to your player page: Twitch, YouTube, Kick, Discord, X, TikTok, Instagram, Bluesky, Reddit and a website. They are public, so anyone who opens your player page sees them, and they stay until you remove them.

If you buy Premium by card or with a wallet, Stripe takes the payment and keeps your card details, and we never see your card number. We send Stripe your Riot ID as the customer name, your email, your ko.lol account id and your Riot player id, and we keep Stripe's customer and subscription ids for you, your plan, its status and the dates it runs. If you pay with crypto, we keep the order: the plan, the price, the coin, the amount quoted, the address we asked you to pay to, the order's status and dates and, for Ethereum tokens, the wallet address you paid from. We also keep the record of your trial and of each free match you used.

Our Discord server has a bot. It does not read messages. When you join the server, we record your Discord user id, when you joined and which invite you used, so that we can credit the person who invited you. If you connected Discord to ko.lol, the bot reads your plan and your rank to give you matching roles, which other members of the server can see. For invite rewards we keep the ko.lol account and the Riot player ids of each person who joined through an invite, so that nobody is credited twice. We keep that record even if a reward is later taken back.

On the website we set our own cookie, ko_did, holding a random id. It lasts a year and is renewed on every visit. With it we record which pages you open, how long each page is visible on your screen, and what you type into the search box at the top of the site and submit. These records leave out which site you came from, your screen size, and anything you type anywhere else. Google Analytics, described next, records the first two. Before the id is stored, our server replaces it with a salted hash. We record this for every visitor, signed in or not.

Every page also loads a small counter image from our server. It records the page, your country as Cloudflare reports it, the kind of device (computer or phone), and a visitor code made from your IP address and browser that changes every day. Your IP address and browser themselves are not stored. We use it to count visits and downloads.

The website also uses Google Analytics, a service from Google. In the EEA, the UK and Switzerland, Google's consent tool asks you first, and the same answer covers ads. Until you agree there, or if the tool cannot load, Google Analytics sets no cookies and Google may receive only cookieless pings that carry no id, such as that a page was viewed; if you refuse, it receives nothing. Elsewhere it loads on every visit. Where the consent tool applies, Cookie settings at the bottom of every page opens it again. When it is on, it records the pages you open, the site you came from, your browser, device and screen size, your approximate location, and these actions: pressing a download button, opening the Premium page, starting a checkout, signing in, searching, opening a player profile (only its region is sent), following our Discord or forum links or a link on a player profile, and connecting the app. We take player names and lobby codes out of every address before it is sent, and a search that contains # or @, like a Riot ID or an email, is sent only as "(riot id)" or "(email)". Other searches are sent as you type them. When it is on, our server also tells it when you start a trial, buy Premium or cancel, with the plan and the price and nothing that names you. When you are signed in, it also receives a coded id for your account, which is not your account number and is the same on every device, and your plan: free, trial or Premium.

In the app, the setting Share usage statistics is on when you install it. While it is on, the app creates a random id for your install, which we store as a salted hash, and sends us: when you open and close the app, how long its windows are in focus, which screens and tools you use, which overlays you show and for how long, how often you hold Tab, the phases of each game, which suggestions it showed you and whether you followed them, errors and updates, and what you type into the champion search. It sends this in batches every 15 minutes and never during a game.

For each game you play with the app running, it also records the match id, the region, the queue, your champion and role, when the game started, how long it lasted, whether you won, your kills, deaths and assists, how long each overlay was on screen, and how many of the suggested items you bought.

With each batch the app describes your PC: the app version, your Windows version, build and edition (for example Windows 11 Pro), the processor model, how many cores and threads it has, your graphics card and its driver version, how much memory you have, how many screens you use and each screen's resolution, scale and refresh rate, your time zone, the app's language, your League client's language and region, and the day you installed the app. It never sends your computer's name, your Windows user name, your files or file paths, a list of your other programs, or your network card's hardware address.

When the app crashes, freezes or hits an error, it sends a short report: what went wrong, the app version, the game phase, your operating system, and how busy the processor and memory were. Names, Riot ids, file paths and network addresses are removed before the report is stored. Reports are sent only while Share usage statistics is on.

You can turn Share usage statistics off in the app's Settings. That stops everything in the last four paragraphs, deletes what is waiting to be sent, and deletes the install id on your PC. If you turn it on again, you get a new id. Turning it off does not delete what we have already received. For that, write to us.

To give you answers, the app sends our server what it reads from your game: your champion, role, runes, items, gold, level and stats, the game time, and the champions, items, levels and runes of the other players. In champion select and at the start of a game it also sends the Riot IDs, champions and roles of the other nine players (see the next section). When you open your own profile or a finished game in the app, it sends your Riot ID and player id. The first time it runs, it registers with our server using a key it creates and your Riot player id.

On your computer, the app reads only what Riot's League client and the game report through the local interfaces Riot made for this, plus the game's own settings file. It finds the League client by asking Windows which programs are running and reading the client's start-up line. To show its window while you hold Tab, it watches your keyboard and mouse across your whole computer while a game is running. It does not keep or send what you type. An optional feature, Screen check, looks at the League window during a game: it is off until you turn it on, and it neither keeps nor sends what it sees. The app never reads game memory.

By default, at the start of champion select the app opens a live page of your draft and posts its link in your champion select chat. The page shows champions, roles, bans and the draft phase. It shows no names, Riot IDs or player ids. Anyone with the link can open it, and search engines are told not to list it. It closes 25 minutes after its last update, or after 3 hours at most, and is then deleted. The page counts its viewers with a random id kept in each viewer's browser, which we store as a hash. You can turn it off in the app's Settings with Post a build link in champion select.

When you are signed in, everything in this section is tied to your account: on the website through your sign-in cookie, in the app through the account you connected. Once a browser or an install sends us anything while you are signed in, the records it sent before you signed in are tied to your account as well.

When you are signed in, we keep the IP address of each sign-in, of the website's records and of the app's batches, with the country Cloudflare reports for it, when we first and last saw it, and how many times. For sign-ins and the website we also keep your browser's identification string, which names your browser, its version and your operating system. Separately, our web server logs every request, signed in or not: the IP address, the page and the browser. Those logs are overwritten as they fill up, which today takes about a week. Cloudflare, which carries all traffic to ko.lol, also handles your IP address.

Cookies and storage. Besides ko_did, the website uses ko_session, which keeps you signed in for 180 days from your last visit; ko_who, which holds your Riot ID so that pages can show it at once, also for 180 days; ko_lang, which remembers the language you picked, for a year; and cookies that protect each sign-in with Riot, Google or Facebook and last 10 minutes. The app keeps your sign-in on your PC, encrypted with Windows' own protection. The lobby page keeps its viewer id in your browser. On the free plan, our advertising partner's code and the ads it shows may set their own cookies and identifiers (see "Who else receives your data"). When Google Analytics is on, Google sets _ga and _ga_G26DBKTGXW, which hold a random id for 13 months. Google's consent tool keeps your choices in its own cookies, and ko_ga_consent keeps your measurement answer for 12 months so our server can respect it. In the EEA, the UK and Switzerland the consent tool asks before Google's or our advertising partner's cookies are set; the other cookies here are set when you visit. You can block or delete any of these cookies in your browser, which signs you out and makes you a new visitor to us.

Most of ko.lol is built from match data that Riot Games publishes through its official API: the games played in every region we cover, with each player's Riot ID, champion, role, items, runes, damage, gold, wards and the rest of the match record, and each player's rank. We collect this for players who have never used ko.lol, and we use it to work out every statistic on the site and in the app.

From it we build public pages: one for each match we have, and a player page for the players in those matches, with their Riot ID, region, rank, main role, best champions, match list and statistics, plus the profile links they added if they have a ko.lol account. Player pages with at least 5 games in the period we show can be found through search engines. When a player changes their Riot ID, we keep the old address and send visitors on to the new one.

In champion select and at the start of a game, the app sends us the Riot IDs, champions and roles of the other players in your game, so that it can tell you what we know about them: recent form, whether they are a one-trick, whether they are autofilled, and whether they are likely on a second account. If we do not know a player yet, we look them up through Riot's API, store their player id and Riot ID, and read their recent matches. That can give them a player page on ko.lol.

We do this because Riot publishes this data for services like ours and because statistics about League of Legends are what ko.lol is. Under EU law our basis is our legitimate interest, and that of our readers, in those statistics. If you want your player page taken down or your data deleted, write to [email protected] from any address with your Riot ID and region. We take down your player page and stop showing your Riot ID on our pages. The games you played still count in our statistics, without your name.

We use personal data to run ko.lol and give you its answers; to sign you in and keep your account; to run the trial, count your free matches and provide Premium; to take payments and keep records of them; to send you account emails; to show ads on the free plan and keep them off Premium; to understand how ko.lol is used and make it better, for example which overlays people use, whether they follow the suggestions and whether they win; to find and fix crashes; to keep ko.lol safe and stop abuse, such as extra accounts made for more trial days, shared accounts or attacks on our servers; to answer you when you write to us; to give Discord roles and credit invites; and to meet our legal duties, such as keeping tax and payment records.

We make no decisions about you by automated means that have legal or similarly serious effects. The app's suggestions and the notes it shows about other players are worked out automatically, but they only inform the player who sees them and decide nothing about anyone.

If you are in the EU, the UK or a country with similar law, these are our legal bases. For your account, the app's answers, the trial, Premium and payments, it is our contract with you. For usage records, game records, PC details, crash reports, IP addresses, security and abuse prevention, the public match and player pages, looking up the players in your game, and account emails to our own users, it is our legitimate interests in running, improving, protecting and promoting ko.lol, which we have weighed against your interests. You can object to any of these (see "Your rights and choices"). When you connect Google, Facebook or Discord or add profile links, you choose to give us that data. For tax and payment records, it is our legal duty.

In the EEA, the UK and Switzerland, our basis for Google Analytics and for ads that use cookies is your consent, given in Google's consent tool. You can withdraw it at any time with Cookie settings; withdrawing does not undo what was recorded before. Elsewhere it is our legitimate interest in understanding how ko.lol is used.

We do not sell your personal data for money. These are the others who receive some of it, and why.

Cloudflare carries all traffic to ko.lol and protects it from attacks, so it sees your IP address and every request. Servereasy, in Italy, rents us the server where all our data is stored: our databases, our email server and our crypto payment server run on it, and we run them ourselves. Stripe processes card and wallet payments as the seller of record and receives the payment details you enter plus the account details listed above; Stripe's own privacy policy covers what it collects. Riot Games handles your sign-in on its own page and answers our requests to its API, which include the player ids we look up. Google, Facebook and Discord know that you signed in with them or connected them. Our Discord bot gives you roles for your plan and rank in our server, where other members can see them.

Google receives the Google Analytics records described above and processes them for us under Google's data processing terms. We keep them in Google Analytics for 14 months. Google may also use them to measure ads we run on Google. Google also runs the consent tool: in the EEA, the UK and Switzerland it passes your answer, as a standard IAB TCF consent signal, to our advertising partner and the ad companies it works with.

On the free plan, the website and the app show ads from our advertising partner, RevIQ. Our server decides whether you see ads, and Premium and trial accounts never load RevIQ's code. We send RevIQ nothing about you except which section of the site an ad is on. Its code runs in your browser, or in a separate panel inside the app, and RevIQ and the ad companies it works with may set cookies, read identifiers, and see your IP address and browser, and use them to choose, measure and bill for ads, as their own privacy policies describe. Under some US state laws this can count as "sharing" personal data for targeted advertising. To avoid it, use Premium, block third-party cookies or ad scripts in your browser, or use your opt-out rights below.

We may also disclose data when the law requires it, to answer a valid legal request, to protect the rights, property or safety of ko.lol, our players or others, or as part of a sale or merger of the business, in which case this policy keeps applying to your data.

Inside KOLOL LLC, only the staff who run ko.lol can see account data, through an admin area that needs a sign-in link sent to an approved address. They can see everything this policy lists for an account, including its usage, searches, game records, PC details and IP addresses, and they use it to run ko.lol, help you and stop abuse.

KOLOL LLC is a US company and our server is in the EU, in Italy. Cloudflare, Stripe, our advertising partner, Google, Facebook, Discord and Riot Games process data in the US and in other countries. When personal data from the EU, the UK or Switzerland goes to a country the EU has not found to protect it adequately, we rely on the safeguards the law allows, such as the standard contractual clauses in our providers' terms, or on the transfer being needed to give you the service you asked for.

Usage records from the website and the app, and per-game records: 180 days. Daily summaries of usage: two years. Daily totals per app install, kept under the hashed install id: no fixed end date. Crash reports: 30 days, while summaries of each kind of error are kept with no fixed end date. Visit counter records: 180 days. Web server logs: about a week. Lobby pages: deleted when they close, after 3 hours at most. Sign-in requests: 10 minutes. Sessions: 180 days after you last used them. Riot sign-in tokens: 30 days without use.

Your account details, connected sign-ins, profile links, the IP addresses tied to your account, the app's registration, the links between your browsers or installs and your account, and your trial, free match and email records stay until you ask us to delete your account. Payment and order records stay for as long as tax and accounting law requires, which is usually seven years, even after your account is deleted.

Public match data stays while it is useful for statistics. Parts of it expire on fixed schedules between 75 days and one year, such as rank history (one year), and the core records of matches, players and player pages have no fixed end date. Our databases are backed up once a week and the last two backups are kept, so deleted data can stay in a backup for up to two more weeks.

All traffic to ko.lol is encrypted. Session tokens, the app's sign-in codes and sign-in requests are stored only as hashes, and Riot sign-in tokens are encrypted. Website and app ids are stored as salted hashes. IP addresses tied to accounts are stored as they are, in our own database, and only staff can see them. The admin area needs a sign-in link sent to an approved address, and its sessions last 8 hours. No system is perfectly secure. If a breach puts your data at risk, we tell you and the authorities as the law requires.

Wherever you live, you can ask us for a copy of the personal data we hold about you, ask us to correct it, and ask us to delete your account and everything tied to it. You can also turn off Share usage statistics in the app, turn off account emails, remove your email, full name or profile links, disconnect Google, Facebook or Discord on your account page, and block or delete our cookies in your browser. There is no delete button yet: write to [email protected] from the email on your account, or tell us your Riot ID. We may ask you to prove the account is yours, for example by signing in, and we answer within 30 days. Deleting your account deletes your account details and the IP addresses, usage, game records and PC details tied to it, and takes your profile links down. Payment records we must keep for tax stay for the time the law requires.

If you are in the EU, the European Economic Area, the UK or Switzerland, data protection law also gives you the right to restrict how we use your data, to receive the data you gave us in a machine-readable form, to object at any time to any use based on our legitimate interests, including all use for direct marketing, and to withdraw any consent you gave, without affecting what was done before. You have the right to complain to the data protection authority where you live or work. Please write to us as well, so that we can try to fix it.

If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use and disclose, to get a copy of it, to have it deleted or corrected, to opt out of its sale or sharing, and to limit the use of sensitive personal information, and we will not treat you worse for using these rights. In the last 12 months we collected identifiers (Riot ID, player id, email, account id, IP address, cookie and install ids), commercial information (your plan and purchases), internet activity (pages, searches and use of the app), country-level location from your IP address, device information (your PC details), inferences (your rank, your main role and the notes the app shows), and your name if you gave it. We collected it from you, from your devices, from Riot Games and from the sign-in services you connected, for the purposes in this policy, and we disclosed it to the companies named above. We do not sell personal information for money. Our advertising partner's code on the free plan may count as sharing for cross-context behavioural advertising. To opt out, write to us with "Do not sell or share", or use Premium. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide ko.lol. An authorised agent can make a request for you with your written permission.

If you live in another US state with a privacy law, such as Virginia, Colorado, Connecticut, Utah, Texas or Oregon, you have similar rights: to access, correct and delete your data, to get a copy of it, and to opt out of targeted advertising. If we turn down your request, you can appeal by writing to us again with the word "Appeal". If we still refuse, you can complain to your state's attorney general.

If you are in Brazil, the LGPD gives you the right to confirm that we process your data, to access, correct, anonymise, block or delete it, to take it with you, to know whom we share it with, and to withdraw consent, and the right to complain to the ANPD. People in other countries with privacy laws have the rights those laws give them, and we handle their requests the same way.

ko.lol is not for children under 13. Where the law sets a higher age for using an online service without a parent's consent (up to 16 in some EU countries), it is not for anyone under that age without that consent. We do not knowingly collect data from children under 13. Public match data from Riot can include players of any age Riot allows to play, and we cannot see a player's age. If you believe a child has given us personal data, write to [email protected] and we will delete it.

We change this policy when ko.lol changes. The date at the top shows when it last changed. If a change affects what we collect or who receives it in a way that matters to you, we say so on the website, in the app or by email before it takes effect.

Questions, requests and complaints about your data: [email protected]. By post: KOLOL LLC, 8 The Green # 10335, Dover, DE 19901, USA. Our Terms of Service set out the rest of the agreement between you and us.