Privacy Policy
Last updated: 2026-04-08
Overview
This policy explains what personal data Smithy collects, how we use it, and your rights. Smithy is operated from Japan and follows the Act on the Protection of Personal Information.
1. What We Collect
When you sign in with Riot Games, we receive your Riot PUUID (a stable anonymous identifier), your in-game name, and your tag line. We use these to create your Smithy account and to display your identity on content you publish.
2. What We Don't Collect
We do not collect your email address, password, payment information, real name, or location. Riot Games handles authentication — we never see your Riot credentials.
3. How We Use Data
We use your Riot identity to (a) let you sign in, (b) display your name alongside content you create, (c) enforce ownership and visibility rules on your tier lists and builds. We do not sell or share your data with advertisers or brokers.
4. Data Storage
Your account data is stored on infrastructure provided by Cloudflare, Inc. (United States), encrypted at rest. Because data is processed outside Japan, we rely on Cloudflare's security and compliance posture in accordance with Article 28 of the Act on the Protection of Personal Information.
5. Third-Party Services
We use Riot Games OAuth2 for authentication and Community Dragon CDN for League of Legends game assets. Both are bound by their own privacy policies.
6. Cookies
We use two cookies, both essential: (a) a session cookie (httpOnly, secure, sameSite) that keeps you signed in, and (b) a short-lived OAuth PKCE cookie during the Riot sign-in handshake. We do not use tracking or analytics cookies.
7. Data Retention
We keep your account data for as long as your account is active. You can request deletion at any time by contacting us — we will delete your user record and all content you own from D1.
8. Your Rights
You can request access to, correction of, or deletion of your personal data. You can also request a copy of your published content. Contact us to exercise any of these rights.
9. Children
Smithy is not intended for users under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it. Separately, Riot Games enforces its own age requirements for Riot accounts, which vary by region.
10. Governing Law
This privacy policy is governed by Japanese law, including the Act on the Protection of Personal Information.
11. Contact
Questions about this privacy policy? Email us at inquiry@sumoca.atlassian.net.