Privacy Policy
Wild Rift Pocket ("the site") is a personal, unofficial web reference and build planner for League of Legends: Wild Rift. This policy describes how data is handled across the site (https://wrpocket.app/) and the Android app version that delivers the same site content (planned distribution via Google Play Store, packaged using the Trusted Web Activity standard).
1. Data we collect
The site has no user accounts. Apart from the optional features described in 2-b to 2-d (popularity voting, device transfer, and push notifications), which you choose to use, no data is sent to our servers. The one exception: when a page opens, it asks our API (wrpocket.app/api/region) whether to load the analytics service in section 4 (Microsoft Clarity). The region is decided from the country Cloudflare derives from your IP address; neither the result nor the country is stored. Server-side, the hosting provider (Cloudflare) records standard access logs (IP addresses, request URLs, timestamps, User-Agent strings) retained briefly for operational purposes (incident response, abuse prevention). The site operator does not review or analyse these logs individually. Third-party services for analytics, advertising, and behavioural analysis are described in "4. Analytics, tracking, and advertising" below.
2. Data stored on your device (LocalStorage)
The site uses browser LocalStorage for: display language preference, scouter build state (selected champion, items / runes / spells, slot labels), catalog filter state, one-time UI dismissal flags, my collection (digital trading cards / match logs), and an anonymous UUID for popularity voting (generated via crypto.randomUUID, used as dedup key so the same browser can't vote twice for the same champion). This data is stored on your device only; it is not transmitted to any server, except the vote UUID (see 2-b), an encrypted blob when you explicitly initiate device-to-device transfer (see 2-c), and a push endpoint URL with its keys when you opt into notifications (see 2-d). Clearing site data via your browser settings deletes all of it permanently.
2-b. Data sent to server (popularity voting)
The popularity voting feature (added 2026-08-03) sends only the anonymous UUID (see previous section) and the champion slug being voted for to our API server (api.wrpocket.app, Cloudflare Workers + D1). IP addresses or browser information are not stored (to prevent bursts of votes, Cloudflare's rate-limiting feature briefly counts requests per IP address, but these counts are not kept as records). The UUID contains no name, email, or other personal identifier — it is a random string used only to prevent the same browser from voting for the same champion multiple times. On the server side, only (UUID, champion slug, vote timestamp) are persisted in SQLite, used solely to aggregate total votes and return your own voted champions list.
2-c. Device-to-device transfer (password-protected, temporary)
The device transfer feature (added 2026-08-22) is only used when you explicitly set a password and generate a transfer code. In that case, your user data (builds / cards / match logs) is AES-GCM encrypted in your browser and the ciphertext is temporarily stored on our API server (Cloudflare Workers + KV). The server never holds the decryption key — your password never leaves your device, and the server cannot decrypt the blob (zero-knowledge). Stored data is limited to (encrypted blob, salt, IV, issue timestamp, download count) and is auto-deleted after 24 hours. Codes are random 6-char Base32, limited to 5 uploads per IP per day, and each code auto-expires after 3 downloads. To count uploads, a SHA-256 hash of your IP address is kept for 24 hours (the IP address itself is not stored). To prevent code guessing, downloads are also rate-limited per IP address over short periods (Cloudflare's rate-limiting feature counts them briefly; nothing is stored). Password recovery is impossible by design — if forgotten, the encrypted blob cannot be restored.
2-d. Push notifications (patch updates, opt-in)
The notification feature (added 2026-08-22) uses the browser Push API only when you explicitly opt in. Only the browser-issued anonymous push endpoint URL, two keys for encrypting the notification content (the p256dh public key and the auth secret), and your browser's User-Agent string (up to 256 characters) are sent to our server. The endpoint URL is the address for delivering notifications, the keys are used only to encrypt them, and the User-Agent string is consulted only when investigating delivery problems. Only endpoint URLs from the push services of major browsers are accepted. This data is automatically deleted after a 180-day retention period, which is extended to 180 days from that point when you register again or when a notification is delivered to you (at most once every 30 days). Registrations are rate-limited by Cloudflare's rate-limiting feature, which briefly counts requests per IP address (nothing is stored). Name, email, IP address, and other personally identifiable information are not stored. Notifications are limited to site-wide announcements (patch updates, etc.) — no individual user tracking. You can stop notifications any time via the "Stop notifications" button; the endpoint record is deleted from our server on unsubscribe. On iPhone / iPad, iOS requires that you first "Add to Home Screen" before notifications work.
3. Third-party services
The site uses these third-party services: Cloudflare Workers / Pages (hosting; standard server access logs apply — see Cloudflare's policy); Riot Games / Tencent CDN (icon images for champions / items / runes / spells are hot-linked from game.gtimg.cn). When your browser fetches these resources, request metadata (IP address, etc.) is visible to those providers. UI fonts (Chakra Petch / JetBrains Mono / Noto Sans JP / Orbitron, all under the SIL Open Font License 1.1) are served from our own server; the site does not connect to Google Fonts.
4. Analytics, tracking, and advertising
The site and the Android app version use the following third-party services for service improvement. Each operates under its own provider policy (third-party cookies, IP-based metadata, behavioural data, etc.). Status and details (categories, opt-out paths, provider policy links) are documented in this section as services come online; significant changes are also announced on the release notes page.
Currently enabled:
- Microsoft Clarity (Microsoft Corporation; analytics / heatmap / session recording)
- Purpose: to understand how pages are used and improve the site, through replayable session recordings and aggregated heatmaps (where people tap or click).
- Data sent: your interactions (taps and clicks, finger and mouse movement, scrolling, screen changes) and how the page is drawn, the page URL, where you came from (referrer), device / browser / OS type, IP address (used to estimate a rough location), an identifier Clarity assigns to each device, and labels the site adds (page language, the Build Lab screen type, and action names such as "match log saved").
- Masked before sending: numbers and email addresses on screen, the contents of input fields, and text you write such as match log notes. The site never sends information that identifies you as a label.
- Cookies: Clarity sets "_clck" (to recognise the same visitor) and "_clsk" (to group consecutive page views into one visit) on this site's domain. Cookies on Microsoft's domains (such as MUID) may also be used; Microsoft states that MUID is also used for advertising, analytics and other purposes (Clarity cookies).
- Retention: Microsoft deletes recordings after 30 days and heatmap data after 9 months (recordings the operator marks, and a random sample selected by Microsoft, are kept for up to 9 months).
- Microsoft's use: Microsoft may also use the data it receives for its own purposes, including advertising. See the Microsoft Privacy Statement / Clarity Terms of Use.
- Clarity is not loaded for visitors from the European Economic Area (EEA), the United Kingdom or Switzerland (no data is sent and no cookies are set). The region is decided from the country Cloudflare derives from your IP address, and the country is not stored. If the region cannot be determined, Clarity is not loaded either. The result is remembered on your device (sessionStorage) only while the tab is open.
- To opt out: if you block cookies in your browser settings, Clarity does not set cookies. Clarity does not respond to the browser's "Do Not Track" signal.
Planned:
- Advertising: Google AdSense / Amazon Associates, etc. (interest-based ads served via third-party cookies)
5. Cookies
The site itself does not use cookies. Settings and scouter build state are kept in browser LocalStorage (see section 2). However, Microsoft Clarity (section 4) sets cookies ("_clck" and "_clsk") on this site's domain, and cookies on Microsoft's domains (such as MUID) may be used. They are not set for visitors from the European Economic Area (EEA), the United Kingdom or Switzerland.
6. Children's use
The site is intended for users aged 13 and over (matching Wild Rift's own age guidance). The site does not collect personal information so does not directly trigger COPPA-style restrictions, but children under 13 should use the site under parental guidance.
7. About the Android app version (Google Play Store)
The Android app version (packaged using the Trusted Web Activity standard) does not introduce any additional data collection. All screens shown in the app are content from this site, so sections 1–5 above apply unchanged. The app requests only the following Android permission: internet access (to display web content).
8. Updates to this policy
When this policy is updated, the "Last updated" date at the top will be revised. Significant changes are also announced on the site changelog page.
9. Contact
Questions about this policy can be sent to info@wrpocket.app.
10. Official / unofficial status
Wild Rift Pocket was created under Riot Games' "Legal Jibber Jabber" policy using assets owned by Riot Games. Riot Games does not endorse or sponsor this project.
League of Legends and Riot Games are trademarks or registered trademarks of Riot Games, Inc.