Privacy Policy

1. What this covers

This explains what Flexorant actually collects, why, and what we do (and don't do) with it. We've written it to describe the real, current behavior of the product — not a generic template — so it should stay accurate to what's actually running.

2. Data we collect

Account data you give us directly: your email address and a hashed password, when you sign up for Flexorant itself. We never see or store your Riot Games password — every account-linking method authenticates you directly with Riot, in your own browser.

Riot credentials, encrypted: depending on how you link an account, we store either nothing durable at all (a one-time login token that expires on its own within about an hour and is never saved), or a session cookie ("ssid") that lets an account self-refresh later without you relogging in. That cookie is encrypted at rest and is never logged, ever shown back to you or anyone else, or used for anything except re-verifying that specific account's data with Riot. It's deleted immediately and permanently when you unlink the account.

Riot account data: once linked, we fetch and cache the account's PUUID, region, Riot ID, Riot login username (shown only to you, never on a public page), rank, wallet balance, owned skins/agents/ sprays/cards/titles/buddies, current storefront, and recent match history from a third-party match-history API. That API also receives the account's Riot ID when we look up its account level. Some accounts also expose phone/email verification status and registration date, which we show only if you choose to.

Usage data: standard web server logs (IP address, browser type, pages requested, timestamps) for security and abuse prevention. We don't run third-party analytics or advertising trackers.

Site analytics, first-party only: which pages you visit, what referred you here, and a few key moments (starting a signup, completing one, linking your first account) — tied to a random, anonymous identifier stored in your browser, not to your name or email unless and until you actually create an account. This also includes your IP address and the country/city it resolves to, so we can tell a repeat visit from the same person apart from a new one even if that anonymous identifier gets reset (a cleared cookie, a private window). We also group your page views into a visit ("this sitting"), so we can tell how far people get before leaving. When you're signed in, site analytics also covers which features you use. To resolve an IP address to a country and city (and whether it belongs to a hosting provider or VPN), we send the IP address to a third-party geolocation service; we also use that country to route account refreshes through a proxy in your region. The result of that lookup is stored against the IP address so the same address is never sent for lookup twice. This data is never sold, and is used only to run and improve the product and to prevent abuse.

3. Cookies

A session cookie that keeps you logged in, a CSRF token that protects you from cross-site request forgery, and two more: a random, anonymous visitor identifier (no personal data in it) and a short-lived one that marks a single visit, both of which power the first-party analytics described above. We don't use advertising cookies, third-party trackers, or cross-site behavioral tracking of any kind — nothing here follows you anywhere off this site.

4. Why we collect it

Solely to provide the service: authenticating you, linking and re-verifying Riot accounts you've asked us to, rendering your showcase page, enforcing plan limits, and keeping the service secure and abuse-free. We don't sell your data, rent it out, or use it for advertising — there isn't a business model here that involves any of that.

5. Who else sees it

Riot Games necessarily sees requests we make on your behalf when re-verifying a linked account, the same way your own browser or the VALORANT client would. These service providers process data for us:

• A cloud hosting provider — runs the application and its database.
• Resend — sends our emails, so it receives your email address and each message.
• Patreon — handles subscriptions and tells us which email and tier a pledge belongs to.
• A residential proxy provider — account refresh requests to Riot pass through it, encrypted end to end.
• A third-party VALORANT stats API — match history and account level, looked up by Riot ID.
• An IP geolocation provider — IP address geolocation, as described above.
• Cloudflare — DNS and email routing for our domain.
• Discord — private alerts to our own staff channel, including the email address and IP address used in a failed sign-in.
• Google Fonts — web fonts; your browser requests them from Google, which sees your IP address.

None of them are given your Flexorant password, and any Riot credential that passes through them is encrypted in transit. We don't disclose an account's data to another user beyond exactly what that account's own showcase page has been configured to show.

6. How long we keep it

Your account data and linked accounts are kept for as long as they exist. For each linked account we keep only its two most recent data snapshots. Individual page-view records (including IP addresses) are deleted after 60 days, and records of refresh attempts and sent emails after 30 days or less. We keep daily totals — counts only, with no IP address, no page history and nothing identifying a person — for as long as the site runs, because that is how we understand traffic over time without keeping the detail. The anonymous visitor record itself keeps a country, but its IP address is erased on the same 60-day schedule, and the record is deleted outright after 400 days without a visit. Unlinking a Riot account deletes its stored credential and cached data immediately. Deleting your Flexorant account deletes everything associated with it, including its site analytics and that visitor record. Deleted data can survive in encrypted database backups for a short time before those backups expire.

7. Your rights

You can review, change, unlink, or delete any linked account at any time from your dashboard, with no need to contact us first. If you'd like a copy of what we hold about you, or want your Flexorant account deleted entirely, email support@flexorant.space or message us on Discord and we'll handle it directly.

8. Security

Riot session credentials are encrypted at rest and never appear in logs or error messages. All traffic to the site is served over HTTPS. That said, no method of transmission or storage is 100% secure, and we can't guarantee absolute security — if we ever become aware of a breach affecting your data, we'll tell you.

9. Children's privacy

Flexorant is intended for use by people old enough to hold a Riot Games account under Riot's own eligibility rules. We don't knowingly collect data from anyone younger than that.

10. Changes to this policy

If we change what we collect or how we use it, we'll update the "Last updated" date above and, for anything material, make a reasonable effort to let existing users know.

11. Contact

Questions about this policy, or a request about your data? Email support@flexorant.space or reach us on our Discord server.