UNIIVERSE

Privacy

UNIIVERSE is a private app for one League of Legends team. Administrators create every account; there is no public sign-up. This notice explains what it stores about members, why, who can see it, how long it stays, and how to reach us about it.

Updated 29 October 2026

Contact us about your privacy

You can request access to, correction of, or permanent removal of your personal information stored by UNIIVERSE.

Privacy contact: Discord —@ascend1999

You don't need an active UNIIVERSE account or membership in our Discord server to make a request. If we're not already connected on Discord, send a friend request to ascend1999. Once accepted, you can privately message the team owner.

We may need to verify your identity before processing requests involving personal information. Never share passwords or authentication credentials. All privacy requests are handled privately.

A Discord username on its own does not show who someone is. To check that a request comes from the person it is about, we may ask you to write from the Discord account linked to your profile, to confirm details of your account, or to change your League of Legends profile icon to one we name for a few minutes. We never ask for a password, sign-in link or code. Requests are taken on Discord only, so someone without a usable Discord account cannot make one this way.

What is stored

Your account: username, display name, access level, last sign-in, and your password as a scrypt hash (never the password itself)
Why
Signing in and deciding what you may do
Who sees it
Team members see your display name; administrators see accounts
Kept
Until an administrator deletes the account or removes your personal information
Sign-in sessions: a hash of the session token, your browser's name and version, and when the session started and was last used
Why
Keeping you signed in for 24 hours
Who sees it
Nobody in the app
Kept
Signing out deletes it at once. Otherwise a session ends 24 hours after signing in and is deleted automatically about a week later (by the daily clean-up)
Failed sign-ins: a one-way hash of the username and network address tried, and the time
Why
Slowing down password guessing
Who sees it
Nobody
Kept
Used for 15 minutes, then deleted with the next failed attempt or by the daily clean-up, so within about a day
Riot data: your Riot IDs and their PUUIDs, ranks, champion mastery and the list of your games with your figures in each
Why
Profiles, statistics and Match History
Who sees it
Team members
Kept
While the profile exists. When an account is deleted, an administrator archives the profile with its history or deletes it too; permanent removal takes all of it (below)
Match records: for each stored game, the record Riot publishes (all ten players' in-game names, PUUIDs, champions, items, runes and results) and its timeline (what each player bought, their skill order, their gold, experience and CS minute by minute and when they took part in a kill, and the objectives each team took), kept once per game
Why
Match details, Matchups, Played Together and Encounters
Who sees it
Team members, for games in a profile's history
Kept
Not deleted automatically: a game stays stored after the profiles that played it are deleted, but is no longer shown. Permanent removal takes the person out of every stored game (below)
Other players' ranks: the Ranked Solo/Duo and Flex rank (tier, division and points) of a player in a stored game, and when it was read. It is read from Riot once a member's game with that player is collected (games of the last 7 days), and when a member opens one of that player's games and the stored one is missing or over 3 days old
Why
Shown beside a match's players in Match History (in the scoreboard, and on each game's card) as their rank around the time of that game, or marked as read later (Riot's game records have no rank from the time of the game)
Who sees it
Team members
Kept
Until the next reading replaces it; not deleted automatically. Permanent removal deletes the person's own, and no rank is read for them again
Clash scouts saved before Clash Scout was retired: the opposing team's name and its players' names, ranks, champions and mastery as read from Clash's scouting screenshots, and the Riot ID and PUUID of each opponent a member had checked with Riot. Never the screenshots, which were read on the member's device and never uploaded (see Clash Scout)
Why
None any more: Clash Scout was retired, and nothing reads them or adds to them
Who sees it
Nobody in the app: no page shows them
Kept
Until a planned database clean-up deletes all of them, once a recent backup has been checked. Permanent removal already empties a removed person's entries in them
What you add: roles, champion pools, card designs and your profile picture
Why
Your profile and the team pages
Who sees it
Team members; the public team page shows some of it (below)
Kept
Until you change it, or the profile is deleted or your personal information removed
Social links, only if you add them: a YouTube or Twitch channel address and a Discord username
Why
So teammates, or visitors if you choose, can find you there
Who sees it
Whoever you choose for each one: only you, team members, or also the public team page
Kept
Until you clear them; removed when your account is deleted
Ranked Development records saved before Ranked Development was retired: your objectives, If–Then plans, sessions, game reviews and notes (and the Solo Queue Blocks journal they grew from)
Why
None any more: Ranked Development was retired, and nothing reads them or adds to them
Who sees it
Nobody in the app: no page shows them
Kept
Until a planned database clean-up deletes all of them, once a recent backup has been checked. Deleting your profile or permanently removing your personal information already deletes yours; your Riot match history is never part of them
Admin activity: which account or setting an administrator changed, and when, with names as they were then
Why
A record of administration
Who sees it
Administrators
Kept
Not deleted automatically. Permanent removal replaces the person's name in it with “Erased member”
Background job records: when the app's data jobs ran and how they went, with their last log lines (older lines can name team members' Riot IDs; newer ones name an account by a short number instead)
Why
Seeing whether syncing with Riot and the housekeeping work
Who sees it
Administrators
Kept
Not deleted automatically. Permanent removal takes the person's Riot IDs out of them
Page speed counts: how fast a signed-in page loaded and responded in your browser, rounded to a range, counted with only the page's section (such as Players) and the screen size class (phone, tablet or desktop). Nothing identifies you, your account or what you opened
Why
Seeing whether the app is fast enough on members' own devices
Who sees it
Administrators, as totals per day
Kept
35 days
Removal records: for each permanent removal, a reference and one-way codes of the removed account, profile, Riot accounts and Riot IDs, made with the app's secret key. Never a name, Riot ID or PUUID
Why
Keeping the person out of games stored later, stopping their Riot accounts being linked again by mistake, and removing them again if a backup is ever restored
Who sees it
Administrators see each record's reference and date
Kept
Not deleted automatically. If the person asks to come back, an administrator releases it

"Team members" means accounts on the team. A personal-use account, not on the team, is seen only by its own player and the administrators.

The public team page

Anyone can open the team page without an account. It shows the lineup and substitutes: display names, profile pictures, card designs, roles and champion pools, and a social link only where its owner chose to show it there. It never shows usernames, Riot IDs, ranks or statistics.

Clash Scout

Clash Scout, a team-only page that read the opposing team's Clash scouting screenshots, has been retired. It no longer reads screenshots, asks Riot about anyone or stores anything.

The scouts the team saved before then are still in the database, where no page shows them. They will be deleted in a database clean-up once a recent backup has been checked.
Until then, permanent removal still empties a removed person's entries in them.
Screenshots were always read on the member's own device; none was ever uploaded or stored.
Browser storage that earlier versions left behind (an unsaved scout, and the text-recognition files' cache) is deleted the next time UNIIVERSE opens in that browser.

Permanent removal of personal information

Members may request permanent removal of their personal information by contacting a UNIIVERSE administrator. This process removes their account, profile, linked Riot identities and associated personal information. Shared gameplay records may be preserved only where the information can be sufficiently de-identified. Records that cannot be safely retained without identifying the person will be deleted.

Previously created encrypted backups may temporarily retain information after deletion. Backup retention, offline copies and restoration procedures are managed to prevent previously erased information from being inadvertently restored.

What a removal covers

The account and its sign-in sessions; the profile with its roles, champion pools, card design, picture and social links; the records kept from the retired Ranked Development (objectives, plans, sessions and reviews); and every linked Riot account with its Riot IDs, PUUIDs, ranks, champion mastery and statistics.
Games: a stored game that no other member's history or team record uses is deleted. In any other, the person's place becomes “Removed player”: only the side they played on and the result stay, never their name, Riot ID, champion, items or figures, and their part of the game's timeline is deleted.
Team records, Clash scouts and notes: their name is replaced (“Former member” in drafts and match records, “[removed]” in notes), and their entries in Clash scouts are emptied.
Logs: their name becomes “Erased member” in the admin activity log, and their Riot IDs are taken out of the background job records.
A removal record (see What is stored) keeps games stored later from including them and stops their Riot accounts being linked again by mistake. It holds no name or Riot ID.

Removal cannot be undone. It is not the same as deactivating an account (sign-in stops and nothing is deleted), deleting an account (the profile is archived, or deleted with its own history, while shared records stay) or archiving a profile (it is hidden and its history kept).

Riot Games still publishes every game it hosts, so anyone who looks up a shared game elsewhere, on Riot's services or sites such as OP.GG, can still see everyone who played it; UNIIVERSE itself no longer keeps or shows who the removed player was. Copies held by the services below, such as their short-lived logs, follow those services' own retention, so they may not be deleted at once.

Backups

An encrypted database backup is scheduled weekly. Each successful backup is tested by restoring it into a temporary database and is retained for 28 days as a private GitHub Actions artifact. Information removed from the live database may remain in existing encrypted backups until those backups expire.

GitHub deletes each backup automatically when its 28 days are up. The team owner may also download a backup to keep offline, in case GitHub's copies are ever lost; such a copy stays encrypted, but GitHub's 28 days do not apply to it. Restoring any backup follows a written procedure that applies every removal made since the backup was taken before the app is used again, so erased information is not brought back.

Where it is kept

The app runs on Vercel and its database on Supabase, in the regions chosen when the app was set up. Each keeps its own short-lived request logs under its own policy.
Game data comes from Riot Games' API. Champion and item pictures load from Riot's image servers, which see your browser's address as any website does.
On Resources, your browser loads each listed site's small icon from that site, which sees your browser's address in the same way (without the address of the page you are on).
The encrypted backups are kept by GitHub, in the project's private repository (see Backups).
Privacy requests are made on Discord, which handles the messages under its own policy.
Nothing is sold, and nothing is shared beyond these services.

Cookies and your browser

Cookies: one keeps you signed in; one holds a short fingerprint of the signed-in account, so an open tab notices when you sign in as someone else; and two remember layout choices (Player or Admin Mode, and the sidebar). There are no advertising, analytics or tracking cookies.
Your browser's own storage keeps the champions you picked recently, the resources you marked as favourites and whether Card Studio shows its preview.
The app keeps one offline page in your browser, shown when a page cannot load for lack of a connection.
No email address or phone number is asked for or stored, and the app sends no email. There is no analytics, advertising or tracking: the only measurement is the anonymous page speed counts above.

Your choices

Change your display name, username, password, picture and social links in Settings. To see what is stored about you, to have something else corrected, or to have your personal information permanently removed, contact us on Discord.