Privacy policy

1.Who is responsible for your data

The data controller is Pietro Castaoro, Calle Ermitagana 22 1A, Pamplona, Spain. You can reach the controller for anything concerning your personal data at pcastaoro@gmail.com.

For the player, opponent and match data that a team's staff enters or imports into Ward Master, the organization using the service decides what to record and why; Ward Master processes that data on its behalf to provide the service (see why we process it).

2.Which data we process

Ward Master only processes the data needed to run the service. There is no profiling, no advertising and no sale of data.

• Your account and how you sign in. You sign in with Discord, with Google (when this sign-in is enabled) or with email and password. For every account we keep the email, name, language, sign-up date, date of the last sign-in and the access status (no request, pending, approved, rejected, suspended). With Discord we receive your user id, username, display name and verified email and we keep the id and the username; if you create the account with Discord, the display name and email also become the account's name and email. With Google we receive the account id, name and verified email and we keep the id and the email; if you create the account with Google, the name becomes the account's name. We don't keep avatars, profile pictures, friends, servers or contacts. Your password, if you set one, is stored only as a bcrypt hash. If you turn on two-step verification we keep the secret key that generates the codes and the recovery codes (these only as hashes).
• Your access request. The role, team, organization, league, links and contact you write in the form, with the decision taken on it. The details are in the section The access request.
• Discord for whoever runs an organization. During the test phase, owners and admins of an organization must link a Discord account to use the app, so the controller knows who is behind each organization (except in the controller's own organization). From Discord we only keep the data listed above (id and username). Invited players and staff don't have to link it.
• The emails we send you. When email is enabled we send invitations, links to confirm your email address or reset your password, and the notice that your request was approved. The links are single-use, we keep only their hash and they expire after 1 hour (password) or 2 days (email confirmation).
• Your organization and team. Organization and team names, your role in them (owner, admin, coach, analyst, player), the splits, the language you prefer, the active team.
• Players entered by the staff. For each player on the roster: in-game name, optionally the real name, position, Riot IDs and summoner names used to match replays, links to public profiles (op.gg, lolpros), active or substitute status, champion pool, focus points, availability and notes written by the staff.
• Opponents entered by the staff. Team name, players' in-game names, positions, Riot IDs, links to public profiles and scouting notes. Opponents' drafts may also be imported from Leaguepedia (lol.fandom.com), a public wiki of competitive matches.
• Match data from replays and other sources. Games come from replay files (.rofl) uploaded by the staff or by the companion, from Leaguepedia, from CSV files or are typed by hand. Depending on the source they include: game ids, dates, duration, side, result, picks and bans, per-player statistics (champion, kills, deaths, assists, gold, damage, vision, items) and the in-game names of the ten participants, including the opposing team.
• Match data from replay files. Replay files (.rofl) uploaded by the staff, or sent automatically by the optional companion program from the Replays folder, are read in memory to extract the same statistics as above. The replay file itself is never stored: only the game metadata and the per-player statistics are kept.
• Your work in the app. Draft plans, draft log, strategy map boards, lessons (including the photos you paste in, stored in the database), VOD review notes (a YouTube, Twitch or local file link plus timestamped notes), calendar events, the feedback messages you send us from the app, public share links and API tokens for the companion (stored only as SHA-256 hashes).
• Technical data. Session identifiers (see the cookie policy), the time of your last activity, the organization's activity log (who did what, with the name and email of the person acting, visible to owners and admins) and the server logs of our hosting provider (IP address, requested URL, date, user agent), kept for a short time for security and diagnostics.

3.The access request

During the test phase Ward Master is access on request: after the first sign-in, whoever wants to create an organization fills in a form and waits for the controller to approve it. Whoever joins through an invitation link doesn't need to make a request.

• What the form asks: your role (coach, manager, analyst or other), the name of the team and of the organization, the league (an ERL or a tournament), 1 to 3 links that show who you are (for example an op.gg profile or the team's page) or the choice "I don't have a link", and a Discord or Twitter/X contact (optional if you signed in with Discord).
• Who reads it: only the controller, as platform administrator, on the administration page, together with your account data (name, email, sign-in method, sign-up date, last sign-in). Other organizations and other users don't see it.
• The notice to the staff: each new request sends a short message to a staff-only channel of the Ward Master Discord server, with the role, team and organization name, league, number of links and the country the request comes from (derived by the hosting provider from the IP address). The message contains no email, names of people, contacts or links. In the same way, when a new organization is created, the channel receives its name, country and language.
• The decision: the controller approves or rejects the request and can add an internal note, which is never shown to you. With the decision we keep the date and the name of whoever decided. The decision is always made by a person, never by an automated system. If the request is approved we send you an email in your language (when email is enabled); if it is rejected we don't write to you and you see it the next time you sign in. Each account can send only one request.
• Suspension: the controller can suspend an account, for example if it breaks the terms of service. Suspension immediately ends the sessions, revokes the API tokens and invitation links created by that account and prevents signing in with any method and making a new request. The account's organizations and their other members are not touched. A suspended account can be reactivated.
• The log: decisions and suspensions are recorded in an internal log with the date, the name of whoever decided and the name of the account.

You can write to the controller at any time, even if you have no link to give: the Discord and X contacts are on the request page, and the email pcastaoro@gmail.com always works.

4.Applying to a tryout from a link

A team can publish a link to its tryouts. You can apply without an account: you write your name, the role and your Discord name; a player adds the Riot ID and, if they want to, links to Twitter/X, Leaguepedia or Liquipedia and a stats site; staff add a link to their work and, if they want to, to Twitter/X. A league or team and a message are optional. These details go to the staff of that team and to nobody else: they are not shown to other teams or on public pages. The team decides what to do with them, as for its other candidates.

• Linked account. If you are signed in when you apply, the application stays linked to your account and you find it in Settings → Profile.
• One application per person. The same Discord, Riot ID or account can apply only once to the same tryout.
• Limit on submissions. To stop spam we keep a hash of your IP address, tied to that tryout, for at most 24 hours; nothing else about your connection.
• Deleting. When you apply you get a personal link that deletes the application and what the staff wrote about it; with an account you can also do it from Settings → Profile. The staff can delete a candidate at any time. Otherwise the application stays until the team deletes it.

5.The public page "Who's with us"

On Who's with us Ward Master thanks the teams that use it and the communities and partners that make it known. Each entry is a public name, a logo if there is one, a country if they want, and a link. We add an entry only after a written yes from whoever appears there (a team's or community's manager, an organizer, a coach or a creator with the public name they choose), and we write down when and where they said yes. That note is never shown.

• Nothing is paid, in either direction, to be on the page.
• What is published: only the name, the logo, the country, the kind of partner and the link they agreed to. Never an email, a real name they didn't choose or data of the app's teams.
• Leaving the page: ask on Discord or by email and the entry is hidden or removed at once, logo included. You can withdraw your yes at any time.

6.Why we process it and on which legal basis

• To provide the service you asked for (creating and maintaining your account, signing you in, showing your team's data, importing matches, sending share links and service emails): performance of a contract, Art. 6(1)(b) GDPR.
• To keep the service secure (sessions, access control per team, hashed tokens, logs, abuse prevention): our legitimate interest in a safe service, art. 6(1)(f) GDPR.
• To decide who gets in during the test phase (access request and its notice to the staff, the Discord requirement for whoever runs an organization, account suspension): our legitimate interest in knowing who uses a service still in testing and in protecting it from abuse and from people who want to copy it, Art. 6(1)(f) GDPR.
• To record players, opponents and match data chosen by the staff: the organization using Ward Master decides this processing for its legitimate interest in preparing and analysing its own competitive activity, art. 6(1)(f) GDPR; most of this data concerns public competitive games. The organization is responsible for informing its players.
• To know how many visits the site gets (visits, page views and referring site, only as daily totals, without cookies and without storing IPs or other visitor data): our legitimate interest in understanding whether the service is used, Art. 6(1)(f) GDPR.
• To show who is with Ward Master on the public page (name, logo, country and link of whoever said yes): your consent, art. 6(1)(a) GDPR, which you can withdraw at any time.
• To answer your requests and comply with the law (requests about your rights, legal obligations): art. 6(1)(c) and (f) GDPR.

We never process your data for marketing, profiling or automated decisions with legal effects.

7.Who receives your data

The application and the database are in the European Union. The following providers process data on our behalf or receive it to deliver part of the service; some are based outside the EU:

• Vercel Inc. (hosting and application servers, region Frankfurt, Germany): runs the application and keeps the technical logs. Vercel acts as a processor under its Data Processing Addendum; transfers outside the EU are covered by the EU standard contractual clauses and the EU-US Data Privacy Framework.
• Neon Inc. (PostgreSQL database, region Frankfurt, Germany): stores all application data. Neon acts as a processor under its Data Processing Agreement.
• Discord Inc. (sign-in and notices): when you sign in or link Discord, Discord tells us who you are; we only receive the data listed in the section Which data we process. We also use Discord for the notice of new access requests and organizations on the Ward Master server (see The access request) and, only if your team's staff sets it up, to send messages to the team's Discord server (event reminders, imported games, shared reviews). Discord processes your Discord account under its own privacy policy as an independent controller.
• Google LLC (sign-in, when enabled): when you sign in or link Google, Google tells us who you are; we only receive the id, name and verified email. Google processes your Google account under its own privacy policy as an independent controller.
• Resend (sending emails, when email is enabled): receives the recipient's address and the text of the email to deliver it, and acts as a processor.
• Riot Games (Data Dragon): champion and item icons are loaded by your browser directly from Riot Games' public servers (ddragon.leagueoflegends.com), which therefore receive your IP address as with any image taken from another site. Ward Master doesn't use the Riot Games API and sends Riot no data about your account.
• op.gg (public profiles): the "Open on op.gg" links open op.gg in a new tab with that player's Name#TAG. Nothing is sent until someone clicks; from then on op.gg's own terms and privacy policy apply.
• Leaguepedia / Fandom (public scouting data): read-only queries of public match data; no personal data about you is sent.
• YouTube and Twitch (videos): embedded VOD players load from their servers only on the pages where the staff added a video; from there their own terms and privacy apply.

We do not sell or rent personal data and we do not share it with anyone else, except where the law requires it.

8.How long we keep it

• Account data: as long as your account exists. You can ask for its deletion at any time (section Your rights).
• Access request (form, decision, internal note): as long as your account exists; it is deleted together with the account. Today the code has no automatic deletion after a set time, not even for rejected requests: if you want us to delete it sooner, write to us (section Your rights).
• Log of decisions and suspensions and organizations' activity log: today the code sets no automatic deletion period. An organization's log is deleted together with the organization; if your account is deleted, the log keeps the name you had at the time of the action. You can ask for it to be deleted (section Your rights).
• Notices on the Ward Master Discord server: they stay in the staff channel until deleted by hand; there is no automatic deletion.
• Sessions: 30 days from sign-in, or until you sign out. The temporary cookies of the Discord or Google sign-in and of the second step of two-step verification last 10 minutes.
• Team data (players, opponents, matches, plans, notes): as long as the team or the organization exists, or until the staff deletes it. Deleting an organization deletes all its teams and their data.
• Share links: until they expire or are revoked by the staff.
• Entries of the page "Who's with us" (name, logo, link, date and place of the yes): until you ask us to remove them; removing an entry deletes its logo too.
• Server logs: a few days, according to the hosting provider's default retention.
• Backups: database backups are kept for a limited time by the database provider and then overwritten; deleted data disappears from them within that window.

9.Your rights and how to exercise them

Under articles 15 to 22 GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• rectify inaccurate data (your name and language can be changed in Settings → Profile; the rest on request);
• erase your data ("right to be forgotten"), unless we must keep it by law;
• restrict the processing while a request is being examined;
• receive your data in a portable format;
• object to processing based on our legitimate interest;
• lodge a complaint with a supervisory authority, in particular the one of the EU country where you live or work (Spain: see the national authority's website).

To exercise any of these rights write to pcastaoro@gmail.com from the e-mail address of your account, or ask the owner of your organization. We answer within one month. Export and deletion of an organization's data directly from the app are planned; until then they are handled by e-mail.

If you are a player whose data was entered by your team's staff, you can also contact the organization, which decides what is recorded about you; we help it to answer.

10.How we protect your data

• All traffic is encrypted (HTTPS).
• Session cookies are httpOnly, same-site and secure; sessions are random 32-byte identifiers that expire after 30 days.
• Passwords are stored only as bcrypt hashes; owners and admins of an organization can turn on two-step verification (codes from an authenticator app).
• Every piece of data belongs to a team: each request checks that you are a member of that team before reading or writing.
• API tokens for the companion are stored only as hashes; replay files are read in memory and never saved.
• Secrets live only in the hosting provider's environment variables, never in the code.
• For support, the controller, as platform administrator, can open the app as another user for at most 2 hours ("View as"), for example to reproduce a problem; a bar shows it the whole time.

11.Minors

Ward Master is a tool for team staff and is not meant for children. We don't ask for your age; whoever signs in with Discord or Google is also subject to the minimum age those services require, and every access request is read by a person before it is approved. Staff can record players of any age in the roster; the organization is responsible for having the right to do so and for informing the players and, where needed, their parents.

12.Changes to this policy

We may update this policy when the service changes. The date at the top always shows the current version; significant changes will be announced in the app. This page is a draft that is still being reviewed by the controller.

13.Contact

Pietro Castaoro · Calle Ermitagana 22 1A, Pamplona, Spain · pcastaoro@gmail.com