Privacy

Last changed 7 October 2026.

Before you sign in

Without signing in you see only the entrance page. Nothing is collected there beyond what serving any page involves, which is described under "Other people's computers" below.

Signing in with Google

Using the site requires signing in. Signing in gives this site, through Neon Auth, the Google account identifier, email address, display name and profile picture URL that Google returns for your account. That is the whole of it: no contacts, no calendar, no Drive, nothing else.

Once signed in, your deck list is parsed and matched inside your browser. Matching alone uploads nothing, logs nothing and stores nothing. The only request that leaves your browser on your behalf while matching is the one that loads a public Piltover Archive deck: the link you paste is sent to this site's own server, which fetches that page and caches the result for ten minutes. Nothing about you is attached to it.

Pressing Save in My decks — Update once the list has been saved before — stores one row: the deck list exactly as you typed it, the name you gave it, which format you were matching against, and the times the row was created and last changed. Choosing a display name under Change name stores that name in one more row; clearing the field erases it. Nothing derived from it is stored — the combos are recomputed in your browser each time you load a list, so a deck saved today is matched against tomorrow's catalogue rather than kept as a stale answer.

Only you can read your rows. That is enforced in the database itself by row-level security, which checks the signed-in account against the owner of every row on every read, insert, change and delete.

What is never collected

No advertising, no donations, no analytics, no tracking pixels, no play-rate or win-rate data, no profiling, and nothing sold or shared with anybody. There is no third-party script on any page of this site.

Other people's computers

Sign-in and the saved decks run on Neon, in a Postgres database hosted in the United States. The pages themselves are served by Vercel. Sign-in itself goes through Google. The Inter typeface is served from this site too, so loading a page sends no request to Google; Google is involved only when you choose to sign in.

Cookies

This site sets no cookies of its own. When you sign in, the sign-in service (Neon Auth) sets one cookie that keeps you signed in between visits. It holds a session identifier and nothing else, it is readable only by the sign-in service and only while you are on this site (a partitioned cookie, so no other site can use it to recognise you), and signing out or deleting your account ends the session it points to.

Getting rid of it

Delete, on a deck you have open in My decks, deletes that row. Delete account, under Account at the foot of the deck panel in Combos, deletes the account, every deck and the display name attached to it, at once and for good; there is no copy kept and no waiting period. Each of them asks once and then does it. You do not have to write to anybody to make either happen.

One exception, for decks saved before RiftCombo moved databases on 25 September 2026. Those decks were copied into a holding table and move into your account the first time you sign in; until then they sit there under your Google account id and nobody can read them. The operator also keeps one offline copy of that move, readable only by them. The offline copy is deleted on 2 October 2026, together with the old database, and any deck still unclaimed in the holding table is deleted on 31 December 2026.

Asking about any of this

Open an issue at github.com/GermanAbuArab/RiftCombo.