Privacy policy

invade.lol and the Invade desktop app are run by Louis Leschevin, 1005 Haute Folie, 14200 Hérouville-Saint-Clair, France (louis.leschevin@gmail.com). We are the data controller under the GDPR.

What we process

League of Legends data from Riot Games. When someone looks up a player on invade.lol, we fetch public data from Riot Games’ API: Riot ID, PUUID, region, level, profile icon, ranks, champion mastery, match history and match timelines. We store it to show profiles and match pages.

What the desktop app sends, if you use it.

  • Your finished games: the League client’s data for the game and its timeline, reduced to the Riot IDs, PUUIDs and icons of the ten players, numeric statistics, and kills, objectives, buildings, items, skills and wards. It adds each player’s position as the app estimates it, and your LP change when it is certain.
  • Other players the client shows you: Riot ID, icon, level, profile privacy setting, Solo/Duo and Flex rank, and their 10 best champions by mastery. Never their match history, never hidden players, never enemies during ranked champion select.
  • Your device: a random device token and its signing secret, the app version and operating system, and a keyed hash of your IP address used against abuse. We never store the address itself.
  • The Riot accounts signed in on your computer, so their games reach their profiles.

Anonymous usage statistics. The app sends one event when it starts and one when it updates to Aptabase, on servers in the EU. These events carry no identifier that links them to you. Switch them off in Settings, Data.

Anonymous crash reports. When the app crashes, it sends us the app version, your operating system and its version, which part crashed, and the first line of the error with its place in the code, with user names, Riot IDs and identifiers removed. They are kept 90 days and never linked to your device or accounts. Switch them off in Settings, Data.

Website visits. We count page views, downloads and clicks on outside links with OpenPanel, which we run on our own server. It sets no cookies and doesn’t keep your IP address. The app’s device registrations and uploaded games are counted there too, under the device’s random id. Our servers keep technical logs (IP address, browser, page) for 14 days for security. invade.lol sets no cookies.

What never leaves your computer. The app’s database (your accounts, games, favorites and settings) and your recordings and clips.

Why, and on what legal basis

  • Showing League profiles and match statistics, and keeping them current through the app: our legitimate interest in running a statistics service for League of Legends players, with data Riot Games makes available for such services (GDPR article 6(1)(f)).
  • Syncing your own games when you use the app: the service you asked for (article 6(1)(b)).
  • Security, signed requests and rate limits: our legitimate interest in protecting the service.
  • Anonymous usage statistics: our legitimate interest in knowing how many people use the app. You can opt out.

Who receives it

  • Anyone visiting invade.lol sees public profiles and match pages.
  • Our service providers: OVH SAS for the servers, Cloudflare (R2 storage), Aptabase (usage statistics, EU) and GitHub (app downloads and updates).
  • We do not sell data and we show no ads.

How long we keep it

  • Profiles and matches: while the profile is shown on invade.lol, or until you ask us to remove it.
  • Device records: until the device has been inactive for 12 months.
  • Server logs: 14 days.

Your rights

You can ask to access, correct or erase your data, to restrict its use, to object to it, including to your profile being shown, and to receive it in a portable format. Write to louis.leschevin@gmail.com with your Riot ID. We answer within one month. You can also complain to the CNIL (cnil.fr).

If you don’t use Invade

Your profile can appear on invade.lol because someone looked you up or played a game with an Invade user. To have it removed, write to louis.leschevin@gmail.com with your Riot ID. We will ask you to prove the account is yours (for example by setting a short code we give you as your League client status) before removing it.

What the app sends, field by field

The exact contract between the app and invade.lol is public: docs/desktop-sync.md in the site’s source on GitHub.

Changes

We change the date at the top when this policy changes, and announce important changes on our Discord.

Invade isn’t endorsed by Riot Games and doesn’t reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games and all associated properties are trademarks or registered trademarks of Riot Games, Inc.