Privacy Policy

Who we are

League of Building is a web application for theorycrafting League of Legends builds, available at https://lobb.dev. It is operated by Omnixenon Ltd (“we”, “us”), a company registered in England and Wales. Omnixenon Ltd is the data controller.

For any privacy question, or to exercise a right below, contact us at privacy@lobb.dev.

The short version

• We only collect what the product needs to work: your Google account basics (so you can sign in), the builds and preferences you create, and, if you tell us something, the feedback you send.
• Our analytics are cookieless, and we do not store your IP address in our application database. Our CDN keeps standard access logs, which include IP addresses, for 90 days.
• We host in the EU (Ireland).
• We never sell your data.
• You can delete everything by deleting your account in the app, which erases your data from our database.

What we collect and why

Account data (when you sign in)

We use Google to sign you in. When you do, Google gives us, and we store: your name, your email address, your profile image URL, and a Google account identifier used to link your sign-ins. We store this so we can identify your account, show you as signed in, and contact you about the service. We do not receive your Google password.

To keep you signed in we also store a session record containing a session token and the browser user-agent string for that session. We do not store the IP address of your sessions.

Lawful basis: performance of a contract (providing your account).

When you create an account we also note your browser's preferred language (for example "en-GB"), taken from the language setting your browser sends with every request. We use it only to decide which languages to translate the site into. Lawful basis: legitimate interests (knowing which languages our users read).

Build content and preferences

The builds you create, your saved preferences, and any builds you choose to publish or share are stored so the product can save and sync your work across devices. Published or link-shared builds are, by design, viewable by anyone with the link or on the public build page. Do not put anything private in a build you publish.

Lawful basis: performance of a contract.

Feedback you send us

If you use the in-app “Send feedback” or “Report a bug” feature, we store the message you write and a small, fixed set of technical context to help us act on it: the app version, the game data patch, the page path you were on, your platform (e.g. “web”), and your viewport size. We attach your account identifier so we can follow up. We deliberately do not collect your IP address, cookies, authentication tokens, error messages, stack traces, or anything you did not type. The context is a strict allow-list enforced on our server. New feedback is emailed to our team via Amazon SES (part of AWS, in the EU); the email contains your message and account identifier, never your email address or IP.

Lawful basis: legitimate interests (improving the service and responding to you).

Payment data (if and when you subscribe)

If you take out a paid subscription, payments are processed by Stripe. Stripe collects and holds your card details directly. We never see or store your full card number. We store a Stripe customer/subscription identifier and your subscription status so we know what plan you are on.

Lawful basis: performance of a contract.

Analytics

We count how the app is used with our own simple event log, not a third-party tool. When you open the builder, pick a champion, add items or finish the tour, your browser sends a short note of that to our server. Each note carries only the action, a detail such as the champion or panel, whether you were signed in, and whether you were on a phone or a computer. It is linked to a random number that exists only while that browser tab is open, so we can follow one visit from start to finish but cannot tell who you are or recognise you on a later visit. We do not store your account, email, IP address or browser details with it, we set no cookie and store nothing on your device for it, and we delete these notes after 180 days. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is sent.

Lawful basis: legitimate interests (understanding aggregate usage).

Crash and error reporting

When the app or our API hits a fault, we send a report to Sentry so we can find and fix it. A report contains the error and its technical stack trace, the page it happened on, and (if you are signed in) your account identifier, so we can tell whether several people hit the same fault. It does not contain your email address, your IP address, or the cookies from the request; we turn those off and strip them before the report is sent.

Lawful basis: legitimate interests (keeping the service working and diagnosing faults that affect you).

Server logs

Our content delivery network keeps a standard access log of the requests it serves. Each line records what was requested, when, from which country’s edge location, the browser that asked, and the requesting IP address. We use it to see how much traffic the site gets and to investigate outages and abuse. It is not linked to your account, it is never used to profile you, and it is stored in the EU and deleted automatically after 90 days.

Lawful basis: legitimate interests (running a service that stays up and is not abused).

Cookies and local storage

We use a small number of essential cookies to keep you signed in: a session cookie and a short-lived signed cache of your session, plus transient cookies set only during the Google sign-in redirect. We do not use advertising or cross-site tracking cookies, and our analytics are cookieless. We also use your browser’s local storage to remember your in-app preferences and cache your work on your device. This stays on your device.

What we do NOT collect

• We do not store IP addresses in our application database. Our CDN’s access logs do record them for 90 days; see Server logs above.
• We do not fingerprint your device or build advertising profiles.
• We do not sell or rent your personal data to anyone.

Who we share it with (our processors)

We share data only with the service providers we need to run League of Building:

Each of these acts as a processor on our behalf under an appropriate data processing agreement, or is an independent controller for the limited data it receives (e.g. Google for sign-in, Stripe for payments).

International transfers

Our own storage and email sending are in the EU (Ireland). Some processors (e.g. Google and Stripe) may process data outside the UK/EEA. Where they do, transfers are covered by appropriate safeguards such as the UK International Data Transfer Agreement / EU Standard Contractual Clauses and, where applicable, adequacy decisions.

How long we keep it

• Account data, builds, and preferences: until you delete your account.
• Feedback: we delete feedback older than 24 months.
• Deleting your account cascades: your builds, preferences, shared snapshots, subscription record, and feedback are deleted from our database along with it.

Your rights

If you are in the UK or EEA, you have the right to: access your data, correct it, delete it (“right to be forgotten”), restrict or object to processing, and data portability. To exercise any of these, email privacy@lobb.dev. You can delete your data yourself by deleting your account in the app.

You also have the right to complain to a supervisory authority. In the UK, that is the Information Commissioner’s Office (ico.org.uk).

Children

League of Building is not directed at children under 13, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. If we make a material change, we will update the “Last updated” date and, where appropriate, notify you in the app.

Contact

Omnixenon Ltd · privacy@lobb.dev

Questions about your data are answered by a person, not a bot. Email us and we will get back to you.