Privacy Policy

1. Data Controller

The controller of your personal data is RiftPick. You can contact us at contact@riftpick.com for privacy, account, or data protection questions.

2. Personal Data We Collect

Depending on how you use RiftPick, we may process account identifiers, username, display name, email address, profile image, authentication provider identifiers, connected account metadata, selected league, fantasy team data, lineup data, card collection data, pack openings, coins, shards, rewards, referrals, leaderboard entries, gameplay activity, preferences, and technical logs.

When you connect or authenticate through Google, Discord, or Twitch, we may receive data made available by that provider, such as your provider account ID, email address, display name, profile image, and connection status. The exact data depends on the provider and your provider settings.

3. Data We Do Not Collect

RiftPick does not currently process payments, payment cards, billing information, real-money purchases, or real-money gambling data. RiftPick does not currently use Google Analytics, Vercel Analytics, PostHog, or similar analytics services.

4. How We Use Personal Data

We use personal data to create and manage accounts, authenticate users, provide fantasy gameplay, maintain card collections and lineups, calculate scores and rewards, operate leaderboards, process referrals, prevent abuse, troubleshoot bugs, maintain security, communicate important service information, and comply with legal obligations.

5. Legal Bases Under GDPR

We process account, authentication, and gameplay data mainly because it is necessary to provide RiftPick to you under our Terms of Service. We may process technical, security, and abuse-prevention data based on our legitimate interests in operating and protecting the service. We may process data where necessary to comply with legal obligations. Where consent is required, such as for optional provider connections or certain communications, we rely on your consent and you may withdraw it where applicable.

6. Cookies and Local Storage

RiftPick may use cookies or similar storage for authentication, session management, security, referral attribution, and user preferences. These technologies are used to make the service function properly and are not used for advertising analytics.

7. Service Providers and Processors

RiftPick uses third-party service providers to operate the platform. These may include Vercel for hosting and deployment, database infrastructure providers, authentication providers, and OAuth providers such as Google, Discord, and Twitch. These providers process data according to their own terms, policies, and data processing commitments where applicable.

We only share personal data with service providers when needed to operate, secure, or maintain RiftPick.

8. International Transfers

Some service providers may process personal data outside your country or outside the European Economic Area. Where required, such transfers are protected by appropriate safeguards, such as adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms.

9. Data Retention

We keep personal data for as long as necessary to provide RiftPick, maintain your account, preserve gameplay history, enforce our Terms, prevent abuse, resolve disputes, and comply with legal obligations. If your account is deleted, we will delete or anonymize personal data unless retention is required for legal, security, fraud-prevention, or legitimate operational reasons.

10. Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. No online service can guarantee perfect security, and you are responsible for keeping your account credentials secure.

11. Your GDPR Rights

Subject to applicable law, you may have the right to access your personal data, correct inaccurate data, request deletion, request restriction of processing, object to processing, request data portability, and withdraw consent where processing is based on consent.

To exercise these rights, contact contact@riftpick.com. We may need to verify your identity before responding.

12. Complaints

If you believe your data protection rights have been violated, you may contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with a supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).

13. Children and Minors

RiftPick is not intended for children under 13. If we learn that we have collected personal data from a child under 13 without appropriate permission, we will take reasonable steps to delete it. If you believe this has happened, contact us at contact@riftpick.com.

14. Third-Party Links and Services

RiftPick may link to or integrate with third-party websites, APIs, data sources, or authentication providers. We are not responsible for the privacy practices of third parties. Review their policies before using their services.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify users through the service or other appropriate means. The updated policy will indicate its effective date.

16. Contact

For privacy questions or data requests, contact contact@riftpick.com.