Questo documento è per ora disponibile solo in inglese. La traduzione italiana è in lavorazione.
DuelChamp Privacy Policy
Last updated: 19 August 2026
This notice explains what personal data DuelChamp processes, why, on what legal basis, and what you can do about it. It is written to satisfy Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, for players in the United Kingdom, the UK GDPR.
It is deliberately specific. Where we do something unusual — keeping raw data we received from Riot Games, holding a record for a person who never signed up, refusing to delete a competitive history — this notice says so plainly rather than hiding it behind a general clause.
1. Who is responsible for your data
DuelChamp is operated by an individual, not a company.
| Data controller | Carmine Ilario |
| Postal address | Via Roma 16, 80053 Castellammare di Stabia (NA), Italy |
| Email for privacy matters | privacy@duelchamp.com |
| Data Protection Officer | None appointed — see below |
We have not appointed a Data Protection Officer. Article 37 GDPR requires one only where processing involves regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special category data. DuelChamp does neither: it processes ordinary competitive data for a limited number of players, and processes no special category data at all. We keep this assessment under review and will appoint a DPO if the service grows past that threshold.
DuelChamp is established in the European Union and has no establishment in the United Kingdom. Players in the United Kingdom are within scope of this notice and their rights under the UK GDPR are respected in full.
2. Who this notice covers
Two groups, and the difference matters.
People who use DuelChamp. You created an account, or you signed in with your Riot account. Everything in this notice applies to you.
People who have never used DuelChamp. If you played a League of Legends match that was created through a DuelChamp tournament code — for example because a friend invited you into a lobby — Riot Games returns your Riot PUUID to us as part of the match result, and we store it. You may never have visited this site. Section 6 is written for you, and you have the same rights as everybody else.
3. What DuelChamp is, in data terms
DuelChamp is a companion platform for League of Legends. It does not control, modify or observe the game itself. It generates a tournament code, you paste that code into your own League of Legends client, you play the match, and afterwards DuelChamp asks Riot Games for the result.
This shapes everything below. We never see your gameplay. We do not run software on your computer. What we know about a match is what Riot Games tells us after it has finished.
4. What we process, why, and on what legal basis
4.1 Account and sign-in data
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Display name | You | Identifying you inside the product | Contract, Art. 6(1)(b) |
| Email address | You, or Google | Sign-in, service messages | Contract, Art. 6(1)(b) |
Google account identifier (sub), email, verified-email flag | Google, if you sign in with Google | Recognising you on return | Contract, Art. 6(1)(b) |
| Age declaration and its timestamp | You | Confirming you meet the minimum age | Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f) |
| Interface language | You or your browser | Showing the site in a language you read | Contract, Art. 6(1)(b) |
| Public visibility choice and its timestamp | You | Deciding whether your name is shown publicly | Consent, Art. 6(1)(a) |
We never set or store a password. DuelChamp has no passwords at all. The three ways in are Google, a one-time email link, and Riot Sign On.
We do not keep the tokens we receive from Google or Riot Games. We read the identity out of them and discard them. We never request offline access and cannot act on your behalf on either platform.
4.2 Riot account data
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Riot PUUID | Riot Sign On, or a Riot match result | Identifying the player across matches | Contract, Art. 6(1)(b); legitimate interests for non-users, Art. 6(1)(f) |
| Riot ID (game name and tag line) | Riot Games API | Displaying who played, subject to your visibility choice | Contract, Art. 6(1)(b) |
| Region / platform | Riot Sign On (cpid scope), Riot Games API | Routing API calls, enforcing region rules | Contract, Art. 6(1)(b) |
The PUUID is an opaque technical identifier issued by Riot Games. It is personal data because it distinguishes one player from another, but it carries no name, no email and no readable information about you.
4.3 Competitive activity
Lobbies you join, teams you belong to, tournaments you enter, ready-check confirmations, the tournament codes generated for your matches, the resulting match records, and who won.
Purpose: running the service you asked for. Legal basis: contract, Art. 6(1)(b).
Match records reference your Riot account by internal identifier only. We deliberately do not copy your Riot ID into them. Your name is resolved when a page is displayed, and only if your visibility choice allows it. This is a design decision, not an accident: it means withdrawing consent takes effect everywhere at once, with nothing left behind in older records.
4.4 Data we receive from Riot Games about your matches
When a match created through DuelChamp finishes, Riot Games notifies us and we then request the result over an authenticated connection. We receive:
- the identifiers of the match and the tournament code;
- the PUUIDs of the players on the winning and losing sides;
- match detail from the Riot match API, including whether the game ended in an early surrender (a "remake"), which decides whether the match counts towards the leaderboard.
We store the raw responses as we received them, in addition to the structured records derived from them. Purpose: being able to reconstruct what happened when a result is disputed, when Riot's data changes, or when a defect in our own processing needs to be traced. Legal basis: legitimate interests, Art. 6(1)(f) — the integrity of competitive results, which the players themselves rely on. Section 9 explains how long we keep them and where that commitment is currently weakest.
4.5 Security, abuse prevention and moderation
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, transiently | Rate limiting sign-in links, access codes and lobby creation | Legitimate interests, Art. 6(1)(f) |
| Hashed session tokens | Keeping you signed in; detecting stolen sessions | Contract, Art. 6(1)(b) |
| Hashed sign-in link tokens | One-time email sign-in | Contract, Art. 6(1)(b) |
| Records of moderator actions, with a mandatory stated reason | Accountability for every arbitration decision | Legitimate interests, Art. 6(1)(f) |
| Records of reported misconduct and any suspension | Keeping competition fair | Legitimate interests, Art. 6(1)(f) |
| Internal alerts about anomalies | Detecting defects and abuse | Legitimate interests, Art. 6(1)(f) |
We store the hash of every session token and every email sign-in link, never the token itself. An attacker reading our database cannot use them to sign in as you.
IP addresses are used for rate limiting and are held only for as long as the relevant limit window, in an in-memory store. They are not written to our database and are not part of your account record. Our CDN provider processes IP addresses separately, as described in section 7.
4.6 What we deliberately do not process
Stating this positively is part of the notice, because each of these is something a service like ours could plausibly do and we have chosen not to:
- No special category data. No health, biometric, political, religious, ethnic or sexual-orientation data, in any form.
- No passwords, from any provider.
- No stored access or refresh tokens for Google or Riot Games.
- No skill rating of our own. DuelChamp does not calculate, estimate or publish MMR, ELO or any equivalent measure of your ability. The leaderboard counts wins, nothing more.
- No tracking or advertising. No analytics cookies, no advertising identifiers, no third-party trackers, no profiling for marketing.
- No player names inside match result records, as explained in 4.3.
5. Automated decision-making
There is none within the meaning of Article 22 GDPR. No decision that produces legal effects concerning you, or similarly significantly affects you, is taken solely by automated means.
Specifically: no strike, suspension, or other sanction is ever applied automatically. Where our systems detect that something went wrong in a match, they record evidence and raise it for a human to look at. A person decides, and their decision is recorded with a reason.
We are explicit about this because it would have been easy to build the opposite. When a match fails because a player did not show up, our systems cannot tell which player was missing — Riot's data does not identify them. Any automatic penalty would therefore have punished the players who did turn up. We chose not to have one.
6. If you have never used DuelChamp
This section is the Article 14 notice for players whose data reaches us from Riot Games rather than from themselves.
What we hold about you. Your Riot PUUID, your Riot ID (game name and tag line) if we have been able to read it, your region, and the fact that you participated in a specific match and were on the winning or losing side.
Where it came from. The Riot Games API, when a match played with a DuelChamp tournament code finished. Not a public source, not a data broker, and not purchased.
Why we hold it. A match result is only meaningful if it records who played. If we discarded the participants we did not recognise, we could not determine the outcome of the match for the players who are our users, and we could not detect a match in which somebody took part who should not have been able to. Legal basis: legitimate interests, Art. 6(1)(f).
Why we did not contact you. Article 14(3) normally requires us to inform you within one month. We hold no way of reaching you: a PUUID is an opaque identifier, and Riot Games does not give us your email address or any other contact detail. Contacting you would require us to collect more of your data than we hold, which would be worse for you, not better. We therefore rely on Article 14(5)(b) — disproportionate effort — and, as that provision requires, we publish this information rather than sending it.
Your rights are unaffected. You can ask us what we hold about you and ask us to erase it, at privacy@duelchamp.com. Because a PUUID is not something you can easily prove ownership of by email, we will normally ask you to sign in once with Riot Sign On so we can match you to the record — that sign-in proves the account is yours and nothing else, and we discard the tokens afterwards.
You are never shown publicly. Your name is never displayed on DuelChamp. Public display requires a consent choice that only an account holder can make, and you do not have an account.
7. Who your data is shared with
We do not sell personal data, and we do not share it for anyone else's marketing.
Riot Games. When a match is about to start, we send Riot Games the PUUIDs of the confirmed participants so that Riot can create the tournament code. Riot Games acts as an independent controller for the data it holds about you as a League of Legends player; its own privacy notice governs that. This exchange is inherent to the service — without it there is no match to play.
Cloudflare. Our CDN and web application firewall. Cloudflare processes connection data, including your IP address, in order to serve pages and block attacks. It acts as our processor.
Infrastructure providers. Our servers, database and file storage run on infrastructure operated by providers located in the European Union, acting as our processors under Article 28 contracts. Our transactional email provider sends sign-in links and service notifications, and therefore processes your email address.
We name Cloudflare because it is a settled part of how the Service is built. The others we describe by category rather than by name, because a supplier can change and a notice that names one would quietly become wrong the day it did. If you want to know which specific providers we are using right now, write to privacy@duelchamp.com and we will tell you. That is a commitment, not a formula: we will answer with names.
Nobody else. In particular, no advertising network, no analytics vendor, and no data broker.
8. International transfers
Our own infrastructure is located within the European Economic Area, and your data does not leave it as part of normal operation.
Two exceptions, both disclosed rather than buried:
Riot Games is established in the United States. Sending the PUUIDs of confirmed participants to Riot is necessary in order to create the tournament code that lets you play the match you asked to play. We rely on Article 49(1)(b) GDPR — a transfer necessary for the performance of a contract with you at your request. There is no version of this service in which that transfer does not happen.
Cloudflare operates a global network, and a request from your browser may be handled by a server outside the EEA. Cloudflare's data processing terms include the European Commission's Standard Contractual Clauses.
9. How long we keep things
| Data | Retention |
|---|---|
| Account record | Until you delete your account, then retained in pseudonymised form (see section 10) |
| Sign-in identities (Google, email) | Until you delete your account, then deleted outright |
| Email sign-in link | About 15 minutes, then unusable; deleted on account deletion |
| Session tokens | 30 days from issue at most; deleted on account deletion |
| Riot account record | Indefinitely, pseudonymised on deletion (see section 10) |
| Lobby and tournament activity | For the life of the lobby or tournament, then as part of the competitive record |
| Match results | Indefinitely, referencing internal identifiers only |
| Moderation records and suspensions | Indefinitely |
| Raw data received from Riot Games | Currently indefinite — see below |
| IP addresses used for rate limiting | Minutes; never written to the database |
On the raw Riot data, we would rather be honest than reassuring. We have not yet set a retention period for the raw responses described in 4.4. They are kept because a competitive result that cannot be reconstructed cannot be defended, and because the service is new and its own processing is what most needs to be auditable. But "indefinite" is not a period, and Article 5(1)(e) expects one. We have this under active review and will set a defined period before it can affect a meaningful number of players. If you want yours removed sooner, ask us: we will assess the request on its merits rather than pointing at this paragraph.
Moderation records are also kept without a fixed expiry, because a record of an arbitration decision that disappears is a record that cannot be appealed against. There is no automatic escalation based on their age.
10. What happens when you delete your account
Deletion is immediate, irreversible, and has no recovery window. There is no queue, no grace period, and no way for us to undo it.
Destroyed permanently:
- your display name and email address, overwritten;
- your Google or email sign-in identity, deleted;
- your Riot ID (game name and tag line), overwritten;
- all your active sessions and any outstanding sign-in links.
Retained:
- your account row itself, emptied of identifying content and marked deleted, so that records referring to it do not break;
- your Riot PUUID and region, which are opaque technical identifiers;
- match results, which reference the above and carry no name;
- moderation records, if any;
- the raw data we received from Riot Games (section 9).
Why we do not delete more. A competitive result is a record about several people. Erasing one participant would rewrite the history of a match that others played, and would make a tournament bracket unreconstructible. We therefore pseudonymise rather than erase: after deletion, nothing in the retained data identifies you by name, and nothing we hold can be used to contact you. This is a balance struck under Article 17(3), and if you think we have struck it wrongly in your case, say so — section 11 explains how.
One consequence to be aware of. After deletion, signing in again with the same Riot account creates a new, empty account. It does not restore the old one, because there is nothing left to restore.
When deletion is refused. We will not delete your account while you have live obligations to other players: you are entered in a tournament that has not finished, or you are in a lobby whose match has already been created. This is a short-lived block, not a permanent refusal — come back when the tournament ends. It does not apply to a deletion request forwarded to us by Riot Games, which we always act on.
11. Your rights
Under the GDPR (and the UK GDPR, if you are in the United Kingdom) you have the right to:
- access the personal data we hold about you;
- rectify it if it is wrong;
- erase it, subject to section 10;
- restrict our processing of it while a dispute is resolved;
- object to processing based on our legitimate interests;
- portability — receive the data you gave us in a machine-readable form;
- withdraw consent to public visibility at any time.
Withdrawing your visibility consent takes effect immediately, and is as easy to do as giving it — the same screen, the same number of clicks. Your name stops being displayed at once; publicly cached pages catch up within about a minute. Withdrawal does not affect the lawfulness of what we displayed while consent was in place, and it does not remove your results from anyone's match history — it removes your name from them.
Consent is a real choice, not a formality. When you create an account we ask you to choose whether your name may be shown publicly. Neither option is pre-selected, neither is visually favoured, and we do not let you skip it. You can change it later, in either direction. Note that this also applies to private leaderboards among friends: a player who has not consented appears there anonymously too.
To exercise any of these rights, write to privacy@duelchamp.com. We answer within one month, and will tell you if we need longer and why.
If we get it wrong, you can complain to a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). In the United Kingdom it is the Information Commissioner's Office (ico.org.uk). You can also complain to the authority where you live or work.
12. Minimum age
DuelChamp is not for children. You must declare that you are at least 16 years old to create an account.
We are straightforward about what this is: a declaration, checked by asking you. We do not verify documents and we do not estimate your age from your behaviour or your face. If we learn that an account belongs to somebody under 16, we delete it.
13. Cookies and local storage
DuelChamp uses no tracking cookies, no analytics cookies and no advertising cookies. There is no cookie banner because there is nothing to consent to.
What we do use:
- One strictly necessary cookie that keeps you signed in. It is
httpOnly— script on the page cannot read it — and is sent only to the single address that renews your session. - Your browser's memory, which holds a short-lived sign-in token that is discarded when you close the tab. It is never written to disk.
- Cloudflare's security cookies, set to distinguish you from automated traffic.
All of these are exempt from consent under Article 5(3) of the ePrivacy Directive because they are strictly necessary to provide the service you asked for.
14. Security
No passwords to steal, no third-party tokens to leak, every session token and sign-in link stored only as a hash, everything served over HTTPS, behind a web application firewall. Reusing a session token invalidates the entire chain of sessions it came from, so a stolen session cannot be used quietly alongside yours.
If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, tell you directly.
15. Changes to this notice
We will update this page when what we do changes. Material changes are announced in the product before they take effect, and the date at the top tells you which version you are reading. We do not make changes retroactive and we do not reinterpret consent you gave under an older version.
16. Contact
Carmine Ilario Via Roma 16 80053 Castellammare di Stabia (NA) Italy privacy@duelchamp.com
DuelChamp isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games, and all associated properties are trademarks or registered trademarks of Riot Games, Inc.