Privacy Policy
1. Data controller
The controller for the processing described below is Charles LINDECKER, publisher of League Of Data Base (see the legal notice). Contact for any personal-data matter: charles.lindecker@outlook.fr or charles.lindecker@outlook.fr.
League Of Data Base is an encyclopedia you can browse without an account. Data collection is kept to the strict minimum: no profiling, no sale of data, no advertising, no third-party trackers. The service does not target minors and collects no special-category ("sensitive") data.
2. Processing activities
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| User account account creation and management | Email address, summoner name (pseudonym), password (stored only as a hash), favorites, public/private profile preference | Performance of a contract (art. 6(1)(b) GDPR) | Until account deletion (the "Delete my account" button on the profile page). An account whose email address is not confirmed within 7 days of its creation is deleted automatically |
| User content champion builds and configurations | Build content, name, chosen visibility (private, public or link sharing), link to the author's account | Performance of a contract (art. 6(1)(b) GDPR) | Until deleted by the author, or until account deletion (which also deletes the builds) |
| Audience measurement traffic statistics, without cookies | See section 3 for the details (page viewed in a reduced form, origin of the referring site, language, screen, country and city derived from the IP address without keeping it…) | Legitimate interest (art. 6(1)(f) GDPR): understanding and improving how the site is used. A measure exempt from consent (article 82 of the French Data Protection Act), which you can object to in one click (section 3) | Umami: 25 months at most. In-house measure: events deleted after 13 months, daily aggregates kept without a time limit; neither stores the IP address or the User-Agent |
| Access log security and operation of the hosting | IP address, User-Agent, requested address (path and parameters), page the request comes from (referrer), response status, city derived from the IP address | Legitimate interest (art. 6(1)(f) GDPR): protecting the site against abuse and diagnosing outages | 90 days |
| Donations voluntary support via Stripe | Payment is handled entirely by Stripe: we never receive or store any card data. We only keep the technical confirmation of the donation (status, amount) | Performance of the donation contract (art. 6(1)(b)) and legitimate interest for bookkeeping | Confirmations kept for the duration of applicable accounting obligations; receipts are issued and kept by Stripe |
| Session and preferences first-party cookies | Session cookie (kept for 30 days with "keep me signed in"), security cookies, opt-in language/version and theme preferences | Legitimate interest / consent depending on the cookie | Full details in the cookie policy |
3. Audience measurement in detail
Traffic is measured without cookies, by tools the publisher hosts on the site's own server. No third-party tool (Google Analytics or similar) is used, no data is sold or shared with anyone, and the statistics are accessible to the publisher only. Two measures currently run side by side, while we check that the new one counts like the old one, which will then be removed.
Umami
For every page you open, the site itself sends, from your browser and to its own address, a record to Umami, an open-source audience measurement tool the publisher hosts on this server. No Umami script is ever loaded in the pages. A record contains:
- the page's address, reduced before it is sent: the path of the catalogue's lists and detail pages, with the Data Dragon language and version; for any other page, its template only (for example
/en/u/:usernameor/b/:token), without any pseudonym, token or identifier. Never a list's searches and filters, and nothing at all from the account and administration pages; - the page's title, for the lists and detail pages only;
- on the first page of a visit, the origin of the site that brought you here (for example
https://www.google.com), without any path or parameter; - your browser's language, your screen size, the platform (website), the site's language and the version viewed;
- three events without content: a page not found or failing, a search started in a list (never its text), a build's link copied.
Like any server, Umami also receives your IP address and your User-Agent. It derives from them the browser, the operating system, the device type, the country, the region and the city, and a hashed session identifier whose key changes every month: it counts visitors without recognising them from one month to the next, and keeps neither the IP address nor the User-Agent. No account identifier is ever sent to it. These records are kept for 25 months at most.
In-house measure
The server also counts the views of the public pages (home page, lists and detail pages for champions, items, runes and summoner spells). For each page view it records the timestamp (UTC), the page (route and path), the resource and entity displayed, the HTTP status, the Data Dragon version and language and the interface language; the browser, operating system, device type and a "bot" flag, derived from the User-Agent; the referring site (host and category: direct, internal, search engine, social network, other); a pseudonymous visitor identifier, a truncated HMAC-SHA256 fingerprint of the IP address and the User-Agent computed with a key known only to the server; and, when a GeoLite2 geolocation database is installed on the server, the country, resolved locally, with no request to any external service.
The IP address and the User-Agent serve these computations at the time of the visit and are not stored; those of visits before 11 October 2026 are erased 30 days after the visit. Events are deleted after 13 months. The daily aggregates drawn from them (counters, and the fingerprints of the day's visitors) contain neither IP addresses nor User-Agent strings and are kept without a time limit.
Hosting access log
The front server that receives every request sent to the site logs each of them: IP address, User-Agent, requested address (path and parameters), page the request comes from (referrer), response status and the city derived from the IP address. This log serves security and operations (spotting abuse, diagnosing an outage), on the basis of legitimate interest; it is kept for 90 days and is accessible to the publisher only.
Objecting to the measure
This choice applies to this browser, which keeps it in its local storage without sending it anywhere. It stops everything your browser sends, to Umami and to the in-house measure alike. A browser that sends the Global Privacy Control signal is never measured. The server cannot read this choice: the in-house measure still counts the first page of each visit until it is removed. To object to it or to the access log, write to us (section 4).
4. Your rights
Under the GDPR you have the following rights:
- Access — obtain a copy of the data held about you;
- Rectification — correct inaccurate data (email, summoner name…);
- Erasure — the "Delete my account" button on the profile page immediately deletes your account and all your builds; you may also request erasure by email;
- Portability — receive the data you provided in a structured, machine-readable format;
- Objection — object to processing based on legitimate interest, including audience measurement;
- Restriction — request the temporary freezing of a processing activity.
To exercise these rights: charles.lindecker@outlook.fr or charles.lindecker@outlook.fr. You will receive an answer within one month. If you believe your rights are not respected, you may lodge a complaint with your supervisory authority — in France, the CNIL: www.cnil.fr.
5. Recipients and processors
Data is never sold, rented or shared for advertising purposes. It is accessible only to the site publisher and to the strictly necessary technical processors:
- Hostinger — HOSTINGER operations, UAB — hosting of the site and its data, audience measurement included: Umami is installed by the publisher on that same server;
- Stripe — donation processing (see the Stripe privacy policy).
No profiling and no fully automated decision producing legal effects is carried out.
6. Transfers outside the EU
The site's data is hosted by Hostinger — HOSTINGER operations, UAB. The only transfer that may occur outside the European Union concerns donations: Stripe (Stripe Payments Europe Ltd, and Stripe, Inc. in the United States) may process payment data outside the EU. Those transfers are governed by the European Commission's Standard Contractual Clauses and Stripe's compliance mechanisms.
7. Security
- TLS (HTTPS) encryption of all communications;
- passwords stored only as hashes produced by a modern algorithm — never in clear text;
- signed, HttpOnly and Secure cookies (see the cookie policy);
- access to logs and to the administration interface restricted to the publisher.
8. Changes to this policy
This policy may evolve together with the site's features. The effective date shown at the top of the page is updated on every substantial change; for any major change affecting your rights, a visible notice will be displayed on the site.