Privacy policy

1. What CoachToMVP does

CoachToMVP reads your League of Legends matches through Riot Games' official API, calculates gameplay metrics and uses OpenAI to generate coaching reports and advice. Comparisons account for your role and, where available, your current rank or target tier. References may come from real match samples, estimates or static fallback values; their provenance is indicated in the app. Your account and match data remain linked to your profile; aggregate comparison statistics are not presented as individual players' identities.

2. What data we collect

• Account: email, password hash (never your plain-text password), display name if set, language, terms acceptance date and email verification status. We also store technical data needed to manage sessions, email verification and password recovery.
• Linked Riot ID: player name and tag (e.g. NomeGioco#EUW), used to resolve your stable Riot identifier (PUUID).
• Match history: statistics from supported matches, including Normal, Solo/Duo and Flex: match identifiers and dates, champions, roles, outcomes, KDA, damage, gold, items, events, timeline data and derived metrics. Where available, we also store scoreboard and participant data received from Riot, lane opponent information, rank and role and queue preferences.
• Generated content: reports, priorities, insights, individual match reviews, training plans, goals and progress checks. We also store prompts and AI responses needed for history and error diagnosis, any feedback you submit and technical service usage data. If you request audio, we also store the narration text, recording generated with an AI voice and generation counts. Recordings are deleted with their report or account; period usage counts remain until the account is deleted.

3. Who we share data with

We do not sell your data or share it for advertising. The app does not integrate advertising trackers. We use the following providers to deliver the service:

• Riot Games: receives the identifiers needed to look up accounts and matches and supplies gameplay and rank data through its official API.
• OpenAI: receives the context needed to generate reports, insights, reviews, training proposals and translations. This may include your Riot ID (name and tag), match identifiers and dates, role, queue, champions, statistics, events and gameplay details, benchmarks, previous reports, active plan and progress checks. These data are therefore not fully anonymous. The app does not insert your CoachToMVP account email, password or access tokens into prompts. Personal data you add to text used for coaching may be included in the context sent. When configured as the speech provider, it also receives text extracted from the report in the selected language. We do not record or send your voice.
• ElevenLabs: when configured as the speech provider, receives text extracted from the report in the selected language to generate an AI voice recording. We do not record or send your voice, or send your CoachToMVP account email, password or access tokens.
• Hosting and database providers: host the application, API and data needed to run the service.
• Email provider: processes the recipient address and the content of email verification, password recovery and password change confirmation messages, including the codes or links needed for those actions.

4. Cookies

The app uses three cookies: coachtomvp_refresh maintains login for up to 30 days, renewed during use; coachtomvp_signup associates email verification with the browser used to sign up for up to 24 hours; NEXT_LOCALE remembers your language for one year. The first two are HttpOnly and cannot be read by page JavaScript. We also store logout and pending onboarding indicators in browser localStorage. These tools support authentication and app preferences; they are not used for advertising or advertising profiling.

5. How long we keep your data

We keep your data for as long as your account stays active. You can request the deletion of your account and all linked data (matches, reports, goals) by writing to the contact address at the bottom of this page: the request is handled within 30 days.

6. Your rights

Where applicable and subject to the conditions set out in the GDPR, you can request access to your data, rectification, erasure, restriction of processing and a copy in a portable format, or object to processing. To exercise these rights, write to the contact address at the bottom of this page. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or the competent supervisory authority.

7. Security

Passwords are stored as scrypt hashes, never in plain text. Access uses short-lived tokens and HttpOnly renewal cookies; in production these cookies are sent with the Secure attribute. Anomalous reuse of a renewal token may revoke the associated session. Password recovery revokes all previous sessions. The contents of queued authentication emails are encrypted.

8. Changes to this document

If we make substantial changes to how we handle your data, we will notify you in the app before the change takes effect.