Privacy Policy
Wild Rift Pocket ("the site") is a personal, unofficial web reference and build planner for League of Legends: Wild Rift. This policy describes how data is handled across the site (https://wrpocket.app/) and the Android app version that delivers the same site content (planned distribution via Google Play Store, packaged using the Trusted Web Activity standard).
1. Data we collect
The site has no user accounts. Apart from the optional features described in 2-b to 2-d (popularity voting, device transfer, and push notifications), which you choose to use, no data is sent to our servers. Server-side, the hosting provider (Cloudflare) records standard access logs (IP addresses, request URLs, timestamps, User-Agent strings) retained briefly for operational purposes (incident response, abuse prevention). The site operator does not review or analyse these logs individually. Third-party services for analytics, advertising, and behavioural analysis are described in "4. Analytics, tracking, and advertising" below.
2. Data stored on your device (LocalStorage)
The site uses browser LocalStorage for: display language preference, scouter build state (selected champion, items / runes / spells, slot labels), catalog filter state, one-time UI dismissal flags, my collection (badges / match logs), and an anonymous UUID for popularity voting (generated via crypto.randomUUID, used as dedup key so the same browser can't vote twice for the same champion). This data is stored on your device only; it is not transmitted to any server, except the vote UUID (see 2-b), an encrypted blob when you explicitly initiate device-to-device transfer (see 2-c), and a push endpoint URL when you opt into notifications (see 2-d). Clearing site data via your browser settings deletes all of it permanently.
2-b. Data sent to server (popularity voting)
The popularity voting feature (added 2026-08-03) sends only the anonymous UUID (see previous section) and the champion slug being voted for to our API server (api.wrpocket.app, Cloudflare Workers + D1). IP addresses or browser information are not collected. The UUID contains no name, email, or other personal identifier — it is a random string used only to prevent the same browser from voting for the same champion multiple times. On the server side, only (UUID, champion slug, vote timestamp) are persisted in SQLite, used solely to aggregate total votes and return your own voted champions list.
2-c. Device-to-device transfer (password-protected, temporary)
The device transfer feature (added 2026-08-22) is only used when you explicitly set a password and generate a transfer code. In that case, your user data (builds / badges / match logs) is AES-GCM encrypted in your browser and the ciphertext is temporarily stored on our API server (Cloudflare Workers + KV). The server never holds the decryption key — your password never leaves your device, and the server cannot decrypt the blob (zero-knowledge). Stored data is limited to (encrypted blob, salt, IV, issue timestamp, download count) and is auto-deleted after 24 hours. Codes are random 6-char Base32, limited to 5 uploads per IP per day, and each code auto-expires after 3 downloads. Password recovery is impossible by design — if forgotten, the encrypted blob cannot be restored.
2-d. Push notifications (patch updates, opt-in)
The notification feature (added 2026-08-22) uses the browser Push API only when you explicitly opt in. Only the browser-issued anonymous push endpoint URL and two public keys (p256dh / auth) are sent to our server — these serve as an address for delivering notifications. Name, email, IP address, and other personally identifiable information are not collected. Notifications are limited to site-wide announcements (patch updates, etc.) — no individual user tracking. You can stop notifications any time via the "Stop notifications" button; the endpoint record is deleted from our server on unsubscribe. On iPhone / iPad, iOS requires that you first "Add to Home Screen" before notifications work.
3. Third-party services
The site uses these third-party services: Cloudflare Workers / Pages (hosting; standard server access logs apply — see Cloudflare's policy); Riot Games / Tencent CDN (icon images for champions / items / runes / spells are hot-linked from game.gtimg.cn); Google Fonts (UI fonts from fonts.googleapis.com). When your browser fetches these resources, request metadata (IP address, etc.) is visible to those providers.
4. Analytics, tracking, and advertising
The site and the Android app version use the following third-party services for service improvement. Each operates under its own provider policy (third-party cookies, IP-based metadata, behavioural data, etc.). Status and details (categories, opt-out paths, provider policy links) are documented in this section as services come online; significant changes are also announced on the release notes page.
Currently enabled:
- Microsoft Clarity (analytics / heatmap / session recording): aggregates anonymous interaction patterns (page views, clicks, scroll, mouse movement) to inform UI improvements. Collected data includes IP address (used for coarse geo-location, anonymised on Microsoft's side), device information (screen size, OS, browser), and session recordings (input fields are auto-masked). See Microsoft Privacy Statement / Clarity Terms of Use. To opt out, enable your browser's "Do Not Track" signal or adjust Microsoft account ad preferences.
Planned:
- Advertising: Google AdSense / Amazon Associates, etc. (interest-based ads served via third-party cookies)
5. Cookies
The site does not use first-party cookies. Settings and scouter build state are kept in browser LocalStorage (see section 2). Third-party cookies may be set by the services described in section 4 once they are introduced.
6. Children's use
The site is intended for users aged 13 and over (matching Wild Rift's own age guidance). The site does not collect personal information so does not directly trigger COPPA-style restrictions, but children under 13 should use the site under parental guidance.
7. About the Android app version (Google Play Store)
The Android app version (packaged using the Trusted Web Activity standard) does not introduce any additional data collection. All screens shown in the app are content from this site, so sections 1–5 above apply unchanged. The app requests only the following Android permission: internet access (to display web content).
8. Updates to this policy
When this policy is updated, the "Last updated" date at the top will be revised. Significant changes are also announced on the release notes page.
9. Contact
Questions about this policy can be sent to info@wrpocket.app.
10. Official / unofficial status
This product is not endorsed by Riot Games and does not reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties.
League of Legends and Riot Games are trademarks or registered trademarks of Riot Games, Inc.