1.1 Information You Provide

Account Information

If you choose to create an account, we collect:

• Username
• Email address
• Password (securely hashed via Firebase Authentication)
• Or you may choose to sign in with Riot Sign-On (RSO); in that case we receive a Firebase custom token and store your RSO subject ID.

Your email and authentication credentials are stored in Firebase Authentication. We also maintain a reference to your account in our PostgreSQL database, which includes your username, user ID, Firebase ID, email address, email verification status, and account creation/update timestamps. If you sign in with RSO, the only personal identifier stored is your Riot subject ID. RSO access, refresh, and identity tokens are stored server-side and are used strictly for authentication and optional future features. These tokens are not exposed in browser-facing API responses.

Billing Information

If you purchase a paid subscription, we store limited billing and subscription records, including:

• Selected plan and billing interval
• Stripe customer ID and Stripe subscription ID
• Subscription status and relevant billing-period timestamps
• Limited Stripe metadata used to associate a subscription with your ValoMapper account

Payment card details are collected and processed directly by Stripe. ValoMapper does not store full payment card numbers or card security codes.

Strategy Content

When you create strategies in lobbies, we store:

• Images (uploaded images are stored in Tigris, an S3-compatible object storage service)
• Text annotations
• Drawings
• Any other content added to the strategy canvas

Lobby Sharing

Lobbies are accessible via unique URLs. Anyone with a lobby URL can view and edit the strategies within that lobby. If you share a lobby URL, the content becomes accessible to anyone who has the link.

1.2 Information Collected Automatically

When you visit ValoMapper, we may automatically collect basic technical information, including:

• Browser type and version
• Device information
• IP address (used temporarily for rate limiting and security purposes, not stored long-term)
• General usage data
• Error logs (e.g., failed API calls, server errors)

We use this information to maintain, secure, and improve the website. We do not currently use Google Analytics or similar third-party analytics services.

Public Lobbies

Strategies created in lobbies are accessible to anyone with the lobby URL. By sharing a lobby link, you are making that content publicly accessible.

Stack Plan Members

If you purchase a Premium Stack plan, you may invite other ValoMapper users to share your subscription. When you send or accept a stack invitation, your ValoMapper username and email address become visible to the stack owner and to other active members of that stack. This information is used solely to identify members within the shared plan and is not shared beyond the stack group.

Service Providers

We use trusted third-party services to operate ValoMapper:

• Firebase Authentication (Google) - for user authentication and account management
• Stripe - for payment processing and subscription management
• PostgreSQL Database (Fly.io Postgres) - for storing user references, lobby metadata, and strategy data (excluding images)
• Tigris - S3-compatible object storage for user-uploaded images (e.g., lineup screenshots added to strategy canvases)
• Fly.io - for website hosting and infrastructure

These providers have access only to information necessary to perform their services and are obligated to protect your data.

When you start checkout, billing information is submitted directly to Stripe and handled under Stripe's own privacy terms.

Legal Requirements

We may disclose information if required by law, such as to comply with a subpoena, court order, or other legal process, or to protect the rights, property, or safety of ValoMapper, our users, or others.

Active Accounts

We retain your account information and associated lobbies for as long as your account remains active.

Account Deletion

You can delete your account at any time through your account settings. When you delete your account:

• Your account information will be permanently removed from our systems
• Lobbies you created will become "unclaimed" and will persist temporarily but may be deleted during routine cleanup (approximately every 12 hours)
• Other users can save unclaimed lobbies to preserve them
• Lobbies you shared remain accessible via their URLs until they are deleted or expire

Lobby Cleanup

Unclaimed lobbies (those without an associated active account) are subject to periodic cleanup and may be automatically deleted during maintenance sweeps.