RankReps
RankReps
← Back to site
Legal

Privacy Policy

Last updated: 27 July 2026

Section 01

Who is responsible for your data

RankReps is built and run by an individual, not a company: Alistair John Dunbar, based in Spain. Under the GDPR this makes them the data controller — the person legally answerable for the data described here.

For anything in this policy — access, deletion, corrections, or just a question — contact support@rankreps.com.

Section 02

What we collect

Grouped by how it reaches us.

a · What you give us
Email address
Identifies your account and is how we contact you.
Password
Hashed and stored by Supabase, our auth provider. It is never visible to us in readable form.
Riot ID (name#tag)
Required at signup. It is how we find your matches — without it the product cannot work.
Payment details
Collected and processed entirely by Stripe. Card numbers never touch our servers. We store only Stripe’s customer and subscription IDs so we know whether your plan is active.
b · What we pull from Riot (via Henrik’s API)
Account identifiers
Your PUUID, region, and platform.
Rank data
Current rank, RR, peak rank, and your rank/elo history.
Match records
For your competitive games: map, agent, rounds, kills/deaths/assists, in-game positions, economy, weapons, and timestamps. We store the complete match record the API returns for each game, not just the parts we currently show you.

This data describes matches you played and comes from Riot’s own match API. We do not receive anything about your Riot account that Riot does not expose, we never ask for your Riot password, and we have no access to your Riot account itself.

c · What we create about you
Coaching letters
Written by Claude from your match data, and cached.
Derived insights
Your leaks, trends, and round-loss breakdowns — all computed from the raw match data above.
Referral data
Your referral code, who referred you, and any Pro time earned.
Share links
Only if you create one. Choosing to share a debrief makes that one page public to anyone with the link — your Riot ID, that match and its coaching — until you revoke it. We store the link, when you made it, and how many times it has been opened. Debriefs are private by default, links are per-match, and revoking one kills it permanently.
d · What is collected automatically
IP address
Stored briefly when the signup form looks up a Riot ID, purely to limit abuse of it. It expires within the hour. It is not linked to your account, not retained long-term, and never used to profile you.
Server logs
Our host keeps standard request logs (including IP) for security and debugging, per their own retention.
Product analytics
Which pages you open and which key steps you complete — signing up, linking a Riot ID, generating a debrief, starting an upgrade — so we can see where the product loses or confuses people. Handled by PostHog, in the EU. It runs without cookies: nothing is stored on your device for it, and it does not follow you to other sites. Once you are signed in, these events are linked to your account, along with your email and whether you are on Free or Pro.
Error reports
When something breaks, a technical report of the failure: the error and stack trace, which part of the app it happened in, and the browser or server it happened on. Handled by Sentry. Configured to leave out your IP address, request headers and request contents.
Nothing else
No advertising or behavioural tracking, no fingerprinting, no session recording or screen capture, no data brokers, no ad networks.
Section 03

Why we use it, and our legal basis

Under the GDPR every use of your data needs a lawful basis. Ours, in full:

Contract
Email, password, Riot ID, PUUID, match data, coaching letters, rank data, subscription state, referral rewards. These are what you signed up for; without them there is no service to deliver.
Legitimate interests
The IP-based rate limit, basic server logs, product analytics, and error reports — keeping the service up, stopping abuse, fixing what breaks, and understanding where the product confuses people. You can object to these; see section 08.
Legal obligation
Billing and tax records associated with a payment.

We do not carry out automated decision-making that produces legal or similarly significant effects. Claude writes coaching advice about a video game; nothing here decides anything about your rights.

Section 04

Who your data goes to

Seven providers process data on our behalf. This is the complete list — there is no eighth, and there are no advertisers or data brokers in it.

Supabase
Database and authentication. Holds your account and match records.
Anthropic (Claude)
Receives your match data to write your coaching letter. Under Anthropic’s commercial API terms, inputs and outputs are not used to train their models.
Henrik’s Dev API
Receives your Riot ID and PUUID in order to return your match data. It is a third-party community API and is not operated by or affiliated with Riot Games.
Stripe
Payment processing. Stripe is the controller of your card data under its own privacy policy.
Vercel
Hosting. Serves the app and keeps standard server logs.
PostHog
Product analytics, on their EU infrastructure. Receives the page views and product events described in section 02d, linked to your account once you sign in.
Sentry
Error monitoring. Receives a technical report when something in the app fails, without your IP address, headers or request contents.

We may also disclose data if we are legally required to (a valid court order, for example). If that ever happens we will tell you, unless we are legally barred from doing so.

We have never sold personal information and have no plans to. If that ever changed, we would need your explicit consent first, and this policy would say so plainly.

Section 05

Where your data goes (international transfers)

RankReps is available worldwide, and our providers are primarily US-based. If you are in the EEA, the UK, or Switzerland, that means your data is transferred outside your country. Those transfers rely on the Standard Contractual Clauses (or an equivalent safeguard) in each provider’s data processing agreement.

Wherever you live, we apply the standard in this policy to everyone. We do not run a weaker version of it for users in countries with weaker law.

Section 06

How long we keep it

Account + match data
Until you delete your account. We keep your match history because the product’s value is cross-game patterns — a single match cannot show you a habit.
Coaching letters
Until you delete your account.
Rate-limit IP records
Under an hour.
Billing records
Stripe retains these under its own policy, and tax law generally requires them to be kept for several years after a payment. This is the one category we cannot fully erase on request.
Section 07

Cookies and local storage

We use no tracking cookies. What we do use:

Authentication cookies
Set by Supabase to keep you signed in. Strictly necessary — the app cannot work without them, so they do not require consent.
Local storage
A small amount of cosmetic interface state — your layout preferences, and which matches you have already seen. It never leaves your device and is never sent to us.
Section 08

Your rights

Depending on where you live, you have some or all of the rights below. We apply them to everyone, regardless of location — it is simpler and fairer than checking your passport first.

Access
Get a copy of everything we hold about you.
Correction
Fix anything wrong. Your Riot ID is editable in Settings already.
Deletion
Have it all erased. See section 09.
Portability
Receive your data in a machine-readable format.
Objection / restriction
Object to, or ask us to pause, a use of your data that relies on legitimate interests.
Opt out of sale/sharing
A CCPA/CPRA right for California residents. Already moot — we do not sell or share personal information as those terms define it.
Non-discrimination
Exercising any of these will never get you a worse price or a degraded service.

To use any of them, email support@rankreps.com. We will respond within 30 days. These rights are free to exercise.

If you are in the EEA or UK and think we have mishandled your data, you can complain to your national data protection authority. We would rather you came to us first, but it is your right either way.

Section 09

Deleting your account

You can delete your account yourself, at any time, from Settings → Danger zone. It is immediate and permanent: it erases your profile, your stored matches, your coaching letters, and your referral records, and cancels any active Pro subscription. Nothing is left behind under a “deleted” flag, and there is no way to recover it.

If you can’t sign in, email support@rankreps.com from your account address and we will do it for you within 30 days.

The one exception is billing records held by Stripe, which tax law requires be retained (see section 06). If you only want to cancel Pro without deleting your account, you can do that from Settings too.

Section 10

Age

RankReps is not intended for anyone under 16, and you should not create an account if you are younger. We know Valorant has players below that age; we are not built to handle children’s data to the standard the law rightly demands, so we would rather say so than pretend otherwise.

If we learn that we hold data from someone under 16 without verified parental consent, we will delete it. If you are a parent or guardian and believe your child has signed up, email support@rankreps.com and we will remove the account.

Section 11

Security

Your password is hashed and we cannot read it. Your data is encrypted in transit, and access controls restrict each account’s records to that account. We keep the number of people and systems that can reach your data as small as the service allows.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your personal data we will notify you, and the relevant regulator within 72 hours, as the GDPR requires.

Section 12

Changes to this policy

If we change this policy we will update the date at the top. If a change is material — a new processor, a new category of data, a genuinely new use — we will email you about it rather than quietly editing this page.

Section 13

Contact

Questions, requests, or complaints: support@rankreps.com.

RankReps is an independent project. It is not endorsed by or affiliated with Riot Games, and Riot Games is not responsible for it.

← Back to RankReps