Privacy Policy

1. Who we are

Flaro is made by Ciprian Tironeac, Romania (“we”, “us”, “our”). For the personal data that we process, as described below, we are the controller under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and Romanian law.

You can reach us about anything in this policy at [email protected], or with a request on the support page. We have not appointed a data protection officer; we are not required to.

2. What this policy covers

This policy covers the Flaro desktop app for Windows, Flaro accounts and the accounts server behind them (api.flaro.gg), support requests, and this website, flaro.gg. It does not cover Riot Games' own services (the League client, the game and Riot's API), which Riot runs under its own privacy notice, nor Google's or Discord's, which you use under their own policies if you sign in with them.

3. What stays on your PC

Flaro keeps its data in one folder on your computer, %APPDATA%\Flaro. We never receive any of it. You hold all of it, you can open the folder from Settings › Your data, and you can delete it at any time.

Test versions of Flaro, such as the one we give Riot's reviewers, can also keep an account only on the PC: a display name, an email address and a scrypt hash of a password, in a file encrypted by Windows. That account never reaches us.

Uninstalling Flaro keeps the folder in case you reinstall; delete the folder too if you want everything gone. You can export your recorded games as JSON or CSV from Settings › Your data.

4. What Flaro reads from League on your PC

Only after you switch on “Connect to League”, and only over 127.0.0.1 on your own computer:

• The League client's local API: your summoner profile (Riot ID, level, region, icon), your rank and LP, your own match history and the records and timelines of your own games, champion select, and your rune pages.
• The game's Live Client Data API: your own numbers during a game (CS, gold, KDA, level, vision), at most once a second, and once a game the runes and summoner spells you took.

To connect, Flaro asks Windows for the League client's process and reads the local port and one-time password from its command line. It never reads files in Riot's folders and never opens the game's process. The only thing Flaro changes in the client is a rune page, when you click Import. All of this stays on your PC.

5. Your Flaro account

An account is optional: Flaro works without one. You create it on your account page, and it lives on our accounts server. It holds:

No passwords exist, so there are none to leak. We never see your fingerprint, face or PIN either: a passkey stays on your device and only proves itself to us.

Encrypted at rest. Your email address, nickname, the IDs, names and picture addresses of linked accounts, and your support messages are stored encrypted (AES-256-GCM) with keys that are kept apart from the database. Sign-in codes, links and tokens are stored only as hashes. Your IP address is not stored: to limit abuse, the server keeps a tag of it that changes every day and can no longer be linked to the address after two days.

What we email you: the sign-in code or link you ask for; a notice when a new PC signs in to your account or a passkey is added; the replies to your support requests; and one last message when you delete the account. No newsletters and no marketing.

Download or delete it yourself. On your account page, “Download my data” gives you everything the account holds as a file, and “Delete my account” removes it at once, with its sign-ins and support requests. After that the security log (section 15) holds only a random number that no longer leads to you.

6. How you sign in

• Email code or link: we email you a 6-digit code (valid for 10 minutes, once) and a link that works only in the browser that asked for it.
• Google or Discord: you are sent to Google or Discord, which tell us your account's ID with them, its email address, its name and its picture, and nothing else (Google: your basic profile and email address; Discord: your identity and email address). An account created this way uses that email address. We never see your Google or Discord password, and Google or Discord know that you signed in to Flaro, under their own privacy policies. If the email address already belongs to a Flaro account, we first send a code to it, so nobody can join your account just by using your address somewhere else.
• A passkey: Windows Hello, your phone or a security key signs you in with a key that never leaves it.
• Riot Sign On, later: once Riot approves Flaro, you will be able to link your Riot account. We would then keep its ID (PUUID) and your Riot ID; Riot doesn't share your email address. This section will say more before it starts.

In the app, Flaro never asks for a password. It opens your browser, you sign in there and allow the app, and the app gets a sign-in for that PC only: a token for 15 minutes, kept in memory, and one that renews it, encrypted by Windows, which ends after 30 days without use and 180 days in all. You can sign any PC out on your account page.

Creating an account asks you to accept the Terms and to confirm that you are 16 or older.

7. Support requests

You can ask for help on the support page or in the app: signed in, or without an account, with an email address that you confirm with a code.

• What we keep: the request's subject and category, the messages, where it came from (the website or the app), its status and dates, and, for a request without an account, the email address. The messages and addresses are stored encrypted.
• Where it goes: requests stay on our accounts server. The person who answers reads them in a staff inbox that needs a staff account and a passkey. We email you a confirmation and our replies; the notice that tells us a new message arrived doesn't contain your message. Notes we write for ourselves are never sent to you.
• How long: a closed request is deleted two years after its last message. The requests of an account are deleted with the account.

8. Player search (arriving with Riot's approval)

Player search isn't in Flaro yet. It will arrive once Riot approves Flaro and gives it a production key, and it will then work through our server: you type a Riot ID and pick a region, and our server asks Riot's API for that player's public profile. Flaro doesn't take or use a Riot API key of your own. Before player search starts, this section will say exactly what is processed and how long it is kept.

9. Other players

Flaro never stores other players' names, Riot IDs or account IDs. In champion select, players outside your party appear as “Ally 1–4” and as the champions they pick, and Flaro never looks them up; reviews show champions, not people. Players who hide with Riot's Streamer Mode stay hidden everywhere.

When player search arrives, it will show public data only for a Riot ID that you type, never filled in from a lobby, champion select or a game in progress, with no MMR and no name history; a profile Riot keeps private stays private.

10. What leaves your PC

The app sends nothing to us on its own: it has no analytics, no telemetry and no automatic crash reports. It connects to the internet for:

• game images from Riot's Data Dragon (ddragon.leagueoflegends.com) and from Community Dragon (raw.communitydragon.org, a community project), with no personal data in the request;
• our accounts server (api.flaro.gg), only if you sign in to your Flaro account in the app or send a support request from it (sections 5 to 7).

Like any website, these servers see your IP address when your PC connects to them, under their own policies (ours: section 5). The League client's own connections are Riot's, not Flaro's.

11. Logs and crash reports

Flaro writes a log file on your PC, in %APPDATA%\Flaro\logs, to help find problems. It records what the app did, for example that it connected to the client or imported a rune page, and never passwords, keys, tokens or other players' names. Flaro never sends it anywhere by itself.

If you choose to email us a log file or a description of a crash to get help, we use it only to find and fix the problem, and we delete it at the latest 90 days after the problem is solved.

12. This website and cookies

The website sets no cookies of its own, runs no analytics or advertising, and loads nothing from other companies' servers: its files come from our host, and the account, support and staff pages talk only to our accounts server. Pictures of linked Google or Discord accounts are fetched by our server and passed on, so your browser doesn't contact Google or Discord for them.

Cookies of the accounts server. When you use the account, support or staff pages, api.flaro.gg sets the cookies below. They work only for that address (no other site or subdomain can read them), page scripts can't read them, and they are deleted when they expire or when you sign out. They are strictly necessary for what you ask for, so we don't ask for consent to them. There are no other cookies.

The site and the accounts server are hosted by Cloudflare, Inc. (privacy policy), which processes technical data about each visit (IP address, browser, the address requested and the time) to deliver the pages and protect them from attacks. We have not turned on any visitor statistics, and we don't use this data to identify anyone.

13. When you email us

If you email [email protected], we receive your email address, your name if you include it, and whatever you write, and we use them to answer you. The email passes through the services we use to receive and store it (section 16).

14. Legal bases

Under Article 6 of the GDPR, we rely on:

• the performance of a contract (Art. 6(1)(b)): your Flaro account and signing in, the messages the account needs, support for account holders, and paid plans when they come;
• our legitimate interests (Art. 6(1)(f)): keeping Flaro, your account and this website secure and available (rate limits, the security log and the daily network tag), answering people who write to us or ask for support without an account, and fixing Flaro;
• a legal obligation (Art. 6(1)(c)): keeping the record of your agreement and age confirmation where the law requires it, handling requests about your rights, and keeping the records the law will require once payments start;
• your consent (Art. 6(1)(a)): for optional features that ask for it before they start (section 21).

Where we rely on legitimate interests, you can object at any time (section 18). You never have to give us personal data to use Flaro: the app works without an account. To create an account we need your email address, and to answer you, a way to reach you.

15. How long data is kept

16. Who else is involved

Companies that process data for us, under contract and only on our instructions:

• Cloudflare, Inc. hosts this website, runs our accounts server, and stores its database in the European Union. It also passes on the email you send to [email protected].
• Scaleway SAS (Paris, France) sends our emails: sign-in codes and links, account notices and replies to support requests.
• Our email provider receives and stores the email you send us.
• A payment company, once paid plans start: a merchant of record that takes the payment and handles invoices and tax. We will name it here before then, and we will never see your full card details.

Services you choose to use, under their own policies:

• Google and Discord, only if you sign in with them (section 6).
• Riot Games, Inc.: the League client and the game on your PC, and Data Dragon for game images; Riot Sign On and player search once Riot approves Flaro.
• Community Dragon, a community project: rank emblem images.

We don't sell, rent or trade personal data. We don't give Riot data to any other company, and we don't use it to contact players. We may disclose information if the law requires it, for example to a court or authority.

17. Transfers outside the EU

The accounts database is stored in the European Union, and Scaleway sends our email from France. The servers that deliver this website and run the accounts server belong to Cloudflare's global network, so a request can be handled outside the European Economic Area; Cloudflare, Google and Discord are based in the United States. Such transfers rely on a European Commission adequacy decision (such as the EU–US Data Privacy Framework, for companies certified under it) or on the Commission's standard contractual clauses.

18. Your rights

Under the GDPR you have the right to ask for access to your personal data, its correction, its erasure, the restriction of its use, and a copy in a portable format; to object to processing based on our legitimate interests; and to withdraw your consent at any time, without affecting what was done before. Flaro makes no decisions about you that are based solely on automated processing and have legal or similarly significant effects.

Much of this you can do yourself. The data on your PC is already yours (section 3). On your account page you can see your account, change your nickname and picture, sign out browsers and PCs, download everything as a file, and delete the account. You can't change the account's email address yourself yet: write to us, or download your data, delete the account and create a new one.

For anything else, write to [email protected] or open a “Privacy” request on the support page. We answer within one month; for complex requests this can be extended by two more months, and we will tell you why. We may ask for information to confirm it is you.

You can also complain to a data protection authority: in Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, dataprotection.ro, or the authority where you live or work.

If Riot tells us that a player has asked for their data to be deleted, we delete whatever of theirs we hold. Today we hold none.

19. Age limits

Flaro is not meant for children. You must be at least 16 to use Flaro and to create a Flaro account (you confirm it when you sign up), and old enough to play League of Legends under Riot's terms where you live. If you are under 18, ask a parent or guardian before you use Flaro. Paid plans, when they come, are only for people aged 18 or older. We don't knowingly collect personal data from children under 16; if you think a child has created an account or sent us data, write to us and we will delete it.

20. Security

There are no passwords. On the accounts server, personal data is encrypted with keys kept apart from the database, sign-in codes and tokens are stored only as hashes, and IP addresses aren't stored. Sign-in attempts and requests are rate-limited, the cookies are locked to api.flaro.gg and hidden from page scripts, and the staff inbox needs a staff account and a passkey check within the last 12 hours.

On your PC, the app's sign-in token is encrypted by Windows. Flaro talks to the League client only on 127.0.0.1 and checks Riot's certificate before sending anything, installs without administrator rights, and adds nothing to Windows startup unless you turn that on. This website is served over HTTPS only, with no third-party code.

If a breach puts your data at risk, we will report it to the data protection authority within 72 hours and tell you without undue delay when the law requires it.

21. Planned features (not active)

None of the following is part of Flaro today. Before any of it starts, we will update this policy, change its date, and tell you in the app or by email:

• “Link your Riot account” through Riot Sign On, once Riot approves Flaro (section 6).
• Riot API data through our server with Riot's production key: player search (section 8), and anonymous statistics such as the most popular rune pages by champion and patch. We would honour Riot's deletion requests and yours within 30 days, keep raw match data only for a limited time, and after that only aggregates.
• A written post-game review by an AI provider acting as our processor, only if you turn it on. Only your own finished game would be sent, with other players' Riot IDs removed (champions and roles only).
• An optional paid plan, for people aged 18 or older, through a payment company acting as merchant of record (section 16).
• A list of switched-off features that the app downloads from our server, so a feature can be turned off quickly if Riot's rules change.
• A bot check on the sign-in page (Cloudflare Turnstile), if spam makes it necessary.

22. Changes to this policy

We date every version at the top of this page and list what changed in the changelog. If a change affects data we already hold, or starts something from section 21, we will tell you in the app or by email before it applies.

23. Contact

[email protected] · support page
Ciprian Tironeac, Romania

24. Riot Games

Flaro isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games, and all associated properties are trademarks or registered trademarks of Riot Games, Inc.