CarryForge
Legal

Privacy Policy

Applies to carryforge.net and the CarryForge Windows beta · Controller: Ziya, independent developer of CarryForge · Last updated: 15 October 2026

Summary. CarryForge is in a closed beta; there is no public download. The current desktop app (version 0.2.x) needs a CarryForge account and reads statistics and player data from CarryForge’s own service; the app itself never calls the Riot API. It reads the League Client and Riot’s Live Client Data on your PC and sends the service only what a feature needs: the Riot ID of your own League account (for your Home page and profile), Riot IDs you search or open, the match you just played (for the post-game report) and, only if you switch the loading-screen panel on, the visible Riot IDs of the players in your game (section 3). Bug reports and their diagnostic logs are sent only when you submit a report (section 7b). Recordings stay on your PC and are never uploaded. There is no advertising SDK and no third-party analytics, and CarryForge does not sell personal data. Separately, the CarryForge service keeps Riot match data on its servers, including data about players who do not use CarryForge, encrypted and indexed by pseudonyms; section 4 explains what is kept and what you can ask us to do. Earlier app versions (0.1.x) offered the features described in sections 5b and 6; data they sent is kept and can be deleted as described there.

Private loading cards. Once a day, the server prepares bounded summaries from already stored Ranked Solo/Duo matches for known sampled accounts. These summaries include 60-day observed match and champion counts, measured solo kills and champion damage where at least 30 matches record that field, and the predominant observed role only after 30 classified games and a strict majority. Recent results are described as a consecutive sequence only when the canonical match-history page chain and accepted matches prove that interval complete. A low-level/high-win-rate candidate describes only a recorded account level and a complete 30-game sample; it does not identify another account or a person. Snapshot identifiers and source-match references stay private. Loading requests use only an exact stored public name and never collect additional Riot data; hidden names, opted-out players, withdrawn source matches, and expired snapshots are not returned. A snapshot may be displayed for at most 48 hours; rank and account-level observations show their original time and are omitted after 7 days. Daily refresh replaces the previous per-account snapshot; access and erasure requests apply to this derived record as well.

1. Who controls the data

CarryForge is operated by Ziya, an independent developer. Privacy and deletion questions can be sent to [email protected].

2. Website data

carryforge.net does not set marketing cookies and does not embed a third-party video player; the product walkthrough is served from the same site. The web host and Cloudflare network may process standard connection information such as IP address, date/time, requested URL, response status, user agent and security signals to deliver the site, prevent abuse and troubleshoot faults. Their own infrastructure and legal retention rules also apply. The desktop app’s updater (on by default, can be switched off in Settings) requests latest.yml, the installer and its .blockmap from https://carryforge.net/updates/preview/ at start-up and every four hours; these requests carry the same standard connection information and no account or player identifier.

Private account workspace. The separately restricted development workspace uses a secure, HttpOnly session cookie shared across its pages. Its Companion Premium and Academy video rights are independent. The private coaching service stores chosen services, reservation times, quoted amounts, provider references, payment/refund/dispute and coach payout status; live payments are not configured yet. Coaches see only the notes and match identifiers you explicitly share for a booked session, not your whole archive. Both participants must confirm a finished paid session before its learner can review it; approved review text and rating may be shown on the coach profile. Academy progress stores the lesson, playback position and completion. Licensed video playback requires server-authorized temporary access. Device-bound account access stores a hash of a random installation/browser credential, not a hardware fingerprint; credentials remain on the device. The coaching, Academy and payment features are not part of the desktop app, which has no payment function.

3. The desktop app and your CarryForge account (version 0.2.x)

Account and sign-in. The app needs a CarryForge account. Signing in happens in your browser on carryforge.net; the browser hands a one-time code back to the app (carryforge:// link), which exchanges it for a session. The account stores a username, a display name, your email address (verified with a one-time code when you register; the code is kept only in server memory for 15 minutes) and your password only as a salted scrypt digest. Registration and verification emails are sent through our email provider (Resend). An account whose email is never verified is deleted after 7 days. On the server a session is kept only as a SHA-256 digest of its token, lasts 30 days and is renewed while you use the app; signing out deletes it.

One device per account. On first start the app creates a random installation secret (not a hardware fingerprint). It is sent with every request to our service, and the service keeps only a one-way digest of it, combined with your account id, and the time the device was bound. Requests from another device are refused. There is no self-service device change yet; email us to move an account to another PC.

On your PC. The session token and the installation secret are stored encrypted with Windows’ own data protection (DPAPI) in the app’s data folder; they are never written to logs.

What the app sends to the CarryForge service (always over HTTPS, with your session):

Apart from the loading-screen Riot IDs, Live Client Data (your in-game stats, items and events) is used only on your PC. League Client lockfile credentials are read locally and never sent to us. The service answers from its stored copies and its encrypted Riot response cache and asks Riot only through its own rate-limited server key; the app contains no Riot API key.

4. Server-side match store and aggregate statistics

To calculate aggregate champion, build, matchup and trend statistics, the CarryForge service keeps a server-side match store. Its data comes from two sources: matches sampled from players listed on Riot’s public ranked ladders (Ranked Solo/Duo and, where enabled, other matchmade queues such as ARAM, ARAM Mayhem and Arena), and match data fetched when CarryForge users look up players or matches as described in section 3. Sampled players do not need to use CarryForge.

Aggregate statistics contain no PUUID, Riot ID or other player identifier. Where the public player archive is enabled, a separate index links current public Riot IDs to encrypted match records and time-stamped ranked observations. Requested profiles show stored match history and observed rank; OTP lists and the champion page’s OTP / high-ELO showcase rows show public Riot IDs, official rank, champion participation, observed builds and KDA on that champion. Ranked ladder rows may add, from the same stored snapshot of a player’s last 30 observed ranked games, the profile icon seen in the newest game, the most played role and its share, the most played champions and KDA; below 10 observed games these statistics are not shown. Since 13 October 2026 a ladder row may also carry a label for an account that a reviewed public source names: a professional player (public handle, team and league, from the same roster as the tracked Pro builds below) or a streamer who declared the account (Twitch channel name); the ladder page may also show how many of the listed players have each role as their most played role (counts only). A player on the opt-out list is shown on Riot’s ladder without a name, statistics or label, and every profile, OTP list and label read drops opted-out accounts. Requested profiles may page through every stored queue of the player, newest first, with up to 90 days of dated Solo/Duo and Flex rank observations and the highest rank observed in that window. These lists cover tracked players and verified history windows, not every player or an entire season. Previous Riot IDs are not provided as a name-history feature. The index and derived player snapshots persist across service restarts and currently have no automatic deletion period. They are separate from anonymous community contributions and are not linked to a CarryForge account record.

Ranks of other players in your loading screen (since 30 September 2026; in the current app only while the loading-screen panel is on, see section 3). When a game loads, the app may ask our service for the current Ranked Solo/Duo entry of up to ten players in that match, including you, once per player, using the Riot ID the League client shows. Players who hide their name in-game (streamer mode, hidden or masked names) and bots are never looked up. For each answer the service stores a dated observation — tier, division, league points, wins and losses, and the time it was observed — under a keyed-HMAC pseudonym of the account, and next to it that player’s public Riot ID (game name and tag) exactly as Riot’s own account service returned it, with the time it was last seen. The Riot ID is a label, not the key: a renamed player keeps one history and the newer name replaces the old one; previous names are not kept. A name is never invented — if Riot returns none, the observation is stored without a name. We keep these observations to build rank and LP history for rank and lobby insights (legal basis: our legitimate interest in accurate rank information); the dated ranks also feed the anonymous rank statistics above, and the names are not currently shown to other users. They are deleted after 90 days by the same daily job as every dated rank observation, and the stored name is deleted with them. Since 6 October 2026 the app sends the visible players of one loading screen in a single request, and the service answers each of them from its stored copy first: the latest answer for that Riot ID is also kept in the encrypted Riot API response cache (section 4) for up to three hours, under a keyed HMAC of the region and Riot ID rather than the name itself, so another loading screen with the same player in that time is answered without asking Riot again and shows the time the rank was observed. For players on the stored apex ladder, the ladder’s own copy may answer instead. A player is asked from Riot at most once per game, and two app users in the same game share one request. Any player can ask for these records to be removed by emailing [email protected] with their Riot ID and region: the account is placed on the same opt-out list used for tracked builds (below), its stored observations and name are deleted at once, its cached loading-screen copy is replaced at once by a marker that only says “not stored”, and no new observation is stored or shown for it.

Match history from visible loading-screen players. In the current app, a successful rank lookup for a visible, named, non-bot lobby seat can register that player with the same server-side canonical Match-V5 crawler used for other tracked accounts. The desktop does not fan out Match-V5 requests for each seat. The paced server worker retrieves history through the shared Riot rate limiter; accepted match records are encrypted and handled under the retention, withdrawal and aggregate-statistics rules above. Hidden or masked names and bots are not seeded by the loading-screen flow. Cached Riot responses are reused without another Riot API request. Where the operator enables it (since 13 October 2026), such a player’s history is collected once: one request for their newest Ranked Solo/Duo matches (at most 30, from the last 60 days), queued as ordinary background work of the same crawler, never for a player on the opt-out list, and not at all when we already store 30 such matches for them; matches we already hold are not downloaded again. To do this once only, the service keeps a request record under the account’s keyed-HMAC pseudonym (its state, the crawl cycle, the number of match IDs found and the times), and the player’s PUUID, visible Riot ID and server are added to the private sampling registry so the request survives a restart; from then on the account is crawled like other registry accounts. The loading screen then shows the stored record of that player’s newest 30 matches (overall and on the picked champion) and says when collection is still running. Where champion mastery is enabled for the loading screen, the answer for that player and champion is kept in the encrypted Riot API response cache for up to six hours under a keyed HMAC, so a later game in that window does not ask Riot again.

Tracked Pro and one-trick (OTP) builds. Since 28 September 2026 the service also publishes, once a day, the most recent build that tracked players played on each champion, shown in the app’s draft screen (build sets “Pro” and “OTP”) and on the champion page. Two groups are tracked: (a) professional players taken from public sources the operator has reviewed: an official league roster, or Leaguepedia’s public player and team tables (a community wiki under CC BY-SA 3.0, read through its public API), which list active players who state a current team, or a team they left within the last year, and their Riot IDs with region and tag (a full Riot ID the page gives without a region is kept only on a platform of the player’s stated residency where Riot’s own ranked data shows that account; where the page gives a name on EUW, KR or NA without its tag, we try only the default tag Riot assigned in that region when summoner names became Riot IDs, and keep the account only if Riot’s own ranked data shows it at Master tier or above in that region); for them we store a keyed-HMAC pseudonym of the account (resolved from the public Riot ID with Riot’s own API, the PUUID and Riot ID are not stored in this list; a separate private file on our server remembers which account each listed Riot ID resolved to and when, so that an account renamed after the page was written keeps its entry while Riot still knows that account and at most 180 days after the ID last matched it; that file entry is deleted 60 days after the page stops listing the ID, and its account is removed from it at once on opt-out), the public professional handle, team and league, the validity period and the SHA-256 of the operator’s private proof note; and (b) one-trick players detected automatically from the ladder accounts we already sample, when more than half of their last 30 Ranked Solo/Duo games (at least 10, within 60 days) are on one champion. No other website or pro list is read or scraped, and a professional is linked only to the accounts that source states; no account is linked by co-play statistics or by matching similar names, and apart from the default-tag check above no tag is guessed. Each published entry holds one observed game: its date, patch, role and result, the completed items in purchase order, boots, starting items, rune page, summoner spells and skill order, plus the player’s number of games on that champion. The stored publication contains no name or identifier; names are attached when the app reads it: the professional handle for professional players, and for others their current public Riot ID only where the public player archive is enabled (otherwise the entry reads “OTP 1”, “OTP 2”…). A player who hides their name in-game is not named in the in-game overlay; lists inside the app show public Riot IDs as described above. Tracked accounts are also polled first by our match crawler (within the same Riot rate limits). The legal basis is our legitimate interest in showing how experienced players build a champion; a publication is kept for up to 7 days and the roster until the operator removes it; an entry taken from Leaguepedia is checked daily, re-confirmed with Riot and renewed weekly, and lapses 14 days after the page stops listing the player. Any player can ask to be removed (see below): the account is then placed on an opt-out list, its entries are deleted from every stored publication at once, it is no longer detected or named, and a professional entry is revoked. Player photos and team logos: the app shows a player photo or team logo from Leaguepedia or the official LoL Esports API, matching the reviewed public professional handle and team; each stored image records its actual source. Once a week our server reads the reviewed source through its public API and keeps a small thumbnail (at most 96 pixels wide) with its source and checksum. Leaguepedia reads require the operator’s authenticated bot session; an unavailable source does not trigger an anonymous retry. When a photo cannot be verified or downloaded, the app uses a monogram. A thumbnail is deleted the week after Leaguepedia no longer lists the player with that team, and a removed or opted-out player’s entries are never shown, so their photo is not shown either. Image rights belong to their respective owners; a Leaguepedia image retains its file-page attribution.

Roster evidence and name updates (3 October 2026). The private roster audit also records whether an account tag was explicitly declared, completed with a regional default, or unknown; the source reference, revision, observation date, license reference, review status and source person identifier when available. These fields remain unknown for older records unless separately reviewed. Riot account checks can refresh a tracked account’s name; the private sampling registry keeps at most 20 previous names and the last verification time. A name change does not establish who owns the account. Audit records remain until the operator changes or removes them; rename backups are private and are not individually erased automatically.

Streamer match videos. When the operator enables it, the service also indexes games that streamers played while broadcasting on Twitch, so the app can link a matchup (for example “Jinx against Caitlyn”) to the moment that game starts in the streamer’s public past broadcast. The roster is written by hand by the operator: a Twitch channel and the Riot accounts the streamer has declared publicly (on their channel, in a stream command, or on a public page such as Leaguepedia that the operator reviewed). No account is ever linked to a streamer by guessing, co-play statistics, stream titles, chat or screen reading. For each channel we store the Twitch login, user id and display name, the stream delay the operator calibrated, and the source of each account link with the SHA-256 of the operator’s private proof note; accounts are stored only as the keyed-HMAC pseudonym used by our match store (the PUUID and Riot ID are not kept in this list). From Twitch’s public API we read whether the channel is live and the list of its past broadcasts (video id, start time, length and muted parts; never the video, chat or viewers). For each game of a declared account we store the champion, role, lane opponent’s champion, result, K/D/A, patch, start time and the position inside the video. Where our canonical match summary and timeline provide evidence, the index also stores the same game’s observed item purchase order, starting items, boots, rune page, summoner spells, skill order and measured event timestamps. These facts are never filled from another player or game. The Twitch player loads only after you choose a video or a moment; loading it connects your browser or app directly to Twitch, which receives normal connection information such as your IP address and the embedding hostname and applies its own privacy policy. Opening a video externally likewise connects you to Twitch. The app shows only the Twitch channel, the video link and those game facts; no Riot ID, match id or account pseudonym is sent to the app. While a listed streamer is live in League of Legends, their accounts are read sooner by our match crawler (within the same Riot rate limits). The legal basis is our legitimate interest in letting players learn a matchup from public broadcasts. Index rows of a video that Twitch no longer lists are deleted 7 days after it disappears, and “no video found” decisions after 90 days. A streamer can ask to be removed (see below): the channel stops being shown at once, its index rows are deleted, and an account opt-out also removes that account’s link and rows.

Your requests. Whether or not you use CarryForge, you can email [email protected] to object to this processing. We can then stop sampling your account, withdraw the matches you appear in from published statistics and the public player archive, and delete your dated rank observations and stored Riot ID. Encrypted match records and backups are not individually erased at present; see section 10.

An older interim sample, still used where the store above is not available, removes direct player identifiers before disk storage, is capped per server and patch, and expires after 30 days by default (the server permits a 1–90 day setting).

5. Data kept on your device

The app keeps its data in its Windows user-data folder: preferences (language, theme, sounds, updates, draft and post-game choices), overlay and recording settings, the remembered League accounts described in section 3, cached copies of statistics tables and Riot’s public game data, a post-game session log (summaries of your games of the last three days and the latest full report, which lists the Riot IDs and PUUIDs of that game’s players as the League client reports them) and cached copies of matches you opened (Riot’s match records, which contain all ten players’ Riot IDs and PUUIDs). These files stay on your PC until you clear the app’s data or uninstall; the match cache currently has no automatic clean-up. Diagnostic logs are described in section 7b.

Local recording is off by default and starts only after you enable it and accept its consent text; adding microphone or system audio needs its own consent. When enabled, the Windows app captures video of the verified League of Legends.exe game window and the audio rendered by that game process (process-scoped loopback, which needs Windows build 20348 or newer); that audio can include in-game voice chat. There is no silent fallback to another audio source. Captured pixels can include anything League displays, including chat and visible player names. You can keep clips, whole games or both; a whole game is kept until its clips are made, for 1 or 7 days, or until you delete it, and favourites are kept. A disk budget (20 GiB by default) limits the folder. Recordings and clips are never uploaded to CarryForge or anywhere else.

The app does not collect keystrokes, read game or process memory, or inspect network packets. Screen capture happens only through local recording and, if you choose it, the one screenshot of the CarryForge window in a bug report (section 7b).

Earlier versions (0.1.x): local and server match archives

Versions before 0.2 kept a local match archive, LP log, suggestion log, death-review notes and achievements in %LOCALAPPDATA%\CarryForge, and a server-connected build could store a private match archive under a CarryForge account. The current app does not create or upload these. Local copies stay until you delete that folder; for a server archive created by an earlier build, email [email protected] to have it deleted.

5b. Earlier account features (versions 0.1.x)

The current account and sign-in are described in section 3; the current app offers none of the features below (custom sets, linked Riot accounts, skin sync, server LP history, Duo Finder). If you created an account or used them in an earlier version, you can ask for the account and everything stored under it to be deleted by email at [email protected]; include your username. The rest of this section describes what that account stores.

The account is optional. Local custom sets and curated sets do not require an account. The server-connected private match archive requires sign-in and current personal-storage permission.

What an account itself stores. A username you choose, a display name, and a password that is never stored in readable form — only a salted scrypt digest. Session tokens are stored as SHA-256 digests, not in the clear, and expire after 30 days or when you sign out. We do not ask for or store an email address, so account recovery by email is not available.

Nothing personal is stored until you say yes, separately. Creating an account is not consent to store your data. The app shows a separate permission screen listing exactly what would be stored, with an unchecked box you must tick yourself. Until that permission is recorded on the server, every personal endpoint refuses the request and writes nothing.

What is stored once you give permission:

What is never stored under your account: your local match archive, your League Client credentials, an email address, an IP-based profile, or any advertising identifier. Community statistics remain anonymous and are not linked to your account; the server rejects any anonymous row that carries a PUUID or other identifier.

Permission is versioned and withdrawable. If this text changes materially the permission version changes and you are asked again, because you cannot be said to have agreed to text you never saw. Withdrawing permission in versions that offer the account screen (Account → “Withdraw permission and delete my data”), or asking us by email, deletes your custom sets, linked Riot accounts, skin collection and any Duo Finder listing from the server immediately. Removing the linked accounts also removes the only record connecting your CarryForge account to their LP observations: the observations themselves are keyed by the account pseudonym, are not linked to you afterwards and are deleted when they reach 90 days. If you want them removed sooner, email us with the Riot ID. Records on your own device are not touched by that action; deleting those is a separate button in Settings. This permission text is version 2 (29 September 2026, adding server LP history); a permission given to version 1 is no longer valid and you are asked again.

Roles. Ordinary accounts can read and write only their own data. An elevated “developer” role, used to publish the server-wide curated sets, cannot be requested or granted through the app or any network endpoint; it is set directly on the server by the operator.

6. Optional sharing and cloud backup (earlier versions)

The current app sends no community tallies, preference backups or usage statistics. The descriptions below explain what earlier versions sent and how that data is kept.

Anonymous community build tallies (on by default in those versions). In those versions this feature was enabled by default because the recommendation quality every user receives depends on the size of a shared, mutual pool. You can disable it at any moment with “Contribute anonymous community data” in Settings, and disabling it stops all future contributions immediately. While it is enabled, the app sends identity-free build records derived from your local match archive: champion name, role, game patch, queue type, the full rune page (trees, selected runes, stat shards), the first three completed legendary items, the boots, the skill-max order, and whether the game was won. A record is sent for every player in the match, not only for you — this is what makes the aggregate large enough to be useful, and it is exactly the same identity-free shape in both cases. The same setting also contributes one team-composition record per match — the champion names of the winning five and the losing five, each with the lane that champion played (top, jungle, mid, bot or support), plus patch and queue — which is what duo-synergy ratings and lane-matchup win rates are computed from. The lane is a property of the match, not of a person: it is what makes it possible to tell which two of the ten champions actually faced each other, and without it a “lane matchup” figure would be guesswork. It contains no player identifier of any kind and no match id; the pairs themselves are derived on the server. No PUUID, Riot ID, summoner name, match ID or any other identifier is included, and the server additionally rejects any record that carries an identity field. These records are merged into aggregate build statistics served to all users; champions with fewer than 20 contributed games are not served at all. Because records are anonymous by construction, they cannot be attributed back to you afterwards and therefore cannot be individually retrieved or deleted; turning the toggle off stops all future contributions immediately.

Cloud backup of app preferences (opt-in). If you enable “Cloud sync” in Settings, the app can back up your application preferences (region, recommendation profile and weighting, HUD and overlay settings) and your starred champion pool to CarryForge servers, and restore them on demand. The backup is keyed to a random installation identifier generated on first run — not to your Riot account. It never contains your PUUID, linked Riot accounts, match archive, learned build history or any match data, and the server rejects payloads carrying such fields. Backups are kept until overwritten by a newer backup; you can request deletion at [email protected] (include the wish to delete cloud preferences; no account details are needed because none are stored).

Anonymous usage statistics (opt-in). If you enable “Send anonymous usage data” in Settings, the app reports which of its screens you open and for how long, plus error category codes from a fixed list (for example “stats service unavailable”). Screen names come from a fixed allowlist; free-form text, error messages, champion names and identifiers are never sent, and the server drops anything outside the allowlist. Events are merged into day-level totals that are not stored per user or per installation, so they cannot be attributed to you. Turning the toggle off stops reporting and discards any queued events.

7. League Client actions and Live Client Data

The app writes to the League Client only on your click: a ban, a pick with lock-in on your own turn, and the rune page, item set and summoner spells you choose. A separate Settings option, off by default, writes the chosen build once after you have locked a champion in a Summoner’s Rift 5v5 lobby; it never picks, bans or locks a champion. Overlays are separate windows that read Riot’s Live Client Data on your PC and remain read-only; their positions and choices are stored locally.

7b. Bug reports and diagnostic logs

Local logs. The app writes diagnostic logs to its data folder. The main app and window logs (at most 25 MB and 3 MB) are encrypted on your PC to a key that only CarryForge holds, so they cannot be read on the PC. Smaller recording and sign-in logs are kept as plain text without credentials. Logs never leave your PC on their own.

Sending a report. Only when you open the report dialog and press send does the app upload a report to our service: a category, your description, the app version and Windows version, optionally one screenshot of the CarryForge window taken when the dialog opened, and, if “diagnostic logs” stays ticked, a diagnostics bundle: system details (Windows, graphics card and driver, displays, League install folder, recording capabilities), a summary of your app settings, recent warnings and errors, the newest app logs, the end of the recording and sign-in logs, and copies of League’s own log files of your last three games (r3dlog, netlog, netstats). Before sending, the app removes tokens, passwords, cookies, API keys, League Client credentials, email addresses, query strings and your Windows user name from paths; PUUIDs and other players’ Riot IDs are replaced by keyed hashes, while your own Riot ID stays readable. The bundle is compressed and encrypted on your PC (RSA-3072 and AES-256-GCM) to a key the PC does not hold; the description and screenshot travel over HTTPS and are sealed with the same kind of encryption, together with your account id, before they are stored. Reports are limited in size (8 MiB) and number.

Who reads them and how long they are kept. Only the operator can decrypt reports, to fix the problem described. Reports are deleted automatically 180 days after they arrive; you can ask for an earlier deletion of your report by email at [email protected].

8. Service security and rate limiting

The service uses HTTPS, a server-side Riot API key, origin restrictions, bearer access controls and short-lived per-IP rate-limit state. Riot API keys are never included in the desktop binary. Stored match records are encrypted at rest, player pseudonyms are computed with a secret key held only on the server, and server backups are encrypted to a key that is not kept on the server. Operational logs may be reviewed only for security, reliability and abuse prevention.

9. Recipients and international processing

Data is processed only as needed by the following categories of recipient: Riot Games for Riot API requests, the cloud host and Cloudflare for delivery, security and encrypted object storage, our email provider (Resend) for account emails, and, when the app loads game images, Riot’s Data Dragon CDN and the Community Dragon CDN, which receive standard connection information. When a champion page shows a streamer video, the embedded Twitch player connects to Twitch, as described in section 4. These providers may process data in other countries under their own terms and safeguards.

10. Retention and deletion

Server-side account data is kept until you withdraw permission or ask for the account to be removed; withdrawing permission, or asking us by email, deletes your stored custom sets, linked Riot accounts and skin collection right away; LP observations of formerly linked accounts are no longer connected to you and expire after 90 days (section 5b). Ownership-verification challenges live only in server memory and expire after 5 minutes. A Duo Finder listing stops being shown after 14 days without a refresh and is deleted after 30 days, or at once when you remove it, withdraw permission or unlink its Riot account (section 5b). Unlinking removes the account link from your device; it does not call Riot to delete Riot’s own records. For access, correction or deletion questions about data controlled by CarryForge, email [email protected] with enough information to identify the request. Identity may need to be verified before a request is completed.

11. Legal basis and your choices

Where data-protection law applies, optional Riot ID processing is based on your request/consent and providing the feature; security and aggregate service operation, including the server-side match store in section 4, rely on legitimate interests in running a safe, useful product; players who do not use CarryForge can object as described in section 4. You can keep local recording disabled, delete recordings and clips, turn off HUD modules and post-lock sync, or stop using the app; the loading-screen panel and diagnostic logs in bug reports are optional, and the current app sends none of the data described in section 6. Depending on your location, you may have rights to access, correct, erase, restrict or object to processing, and to complain to a regulator.

12. Children and changes

CarryForge is not directed to children under 13 and does not knowingly collect personal data from them. This policy will be updated before any materially different processing starts; the date above shows the current version.

13. Riot Games

Riot’s own privacy notice applies to data Riot controls: Riot Games Privacy Notice.