Spicy League.

Legal

Privacy Policy

Last updated August 17, 2026

This policy explains what personal data Spicy League collects when you use www.spicyleague.dev or interact with our Discord bot, why we collect it, and who it is shared with. It applies alongside our Terms of Service.

The short version: we collect what is needed to run a community tournament and nothing else. We do not run advertising or analytics trackers, and we do not sell your data.

1. What we collect

Account information

  • Email address — required for registration, verification, and password resets. It is never shown publicly.
  • Password — stored only as a salted hash. We cannot read it.
  • Username and display name — both public.
  • Optional profile fields — bio, pronouns, and an OP.GG URL, all public if you provide them.

Technical and session data

  • When you sign in we create a session record containing a session token, its expiry, and the IP address and browser user-agent of the sign-in. This is standard security bookkeeping used to keep you signed in and to detect abuse.
  • Our hosting and database providers keep their own operational logs, which may include IP addresses.

League participation

  • Season signups, including your role preferences (LoL), map preferences (CS2), and any notes you write.
  • Captain status, draft picks made and received, team membership, and match results you report.

Linked game accounts

  • If you link a Riot account, we store your Riot ID (gameName#tagLine) and the PUUID that Riot returns for it, and we periodically fetch your public ranked standing and top champion mastery from the Riot Games API. These are shown on your public profile.
  • If you link a Steam or Leetify account, we store the identifier or profile URL you provide. We do not currently call the Steam or Leetify APIs.
  • All account linking is optional and can be undone from your profile page.

Discord

Our Discord bot can read messages in the channels of the Spicy League Discord server that it has been granted access to, and posts league updates into that server. We do not store Discord message content in our database, and we do not read direct messages. Your activity within Discord is also subject to Discord’s own privacy policy.

2. What we do not collect

  • No payment or financial information — Spicy League is free and has no entry fee.
  • No advertising, analytics, or cross-site tracking cookies.
  • No precise location data.
  • No special-category data. Please do not put sensitive personal information in your bio or signup notes.

3. Cookies

We set one cookie, sl.session_token, which keeps you signed in. It is strictly necessary for the site to function and is removed when you sign out or when the session expires. We do not use cookies for advertising or analytics, which is why you will not see a cookie consent banner.

4. How we use your data

  • To create and secure your account, and to verify your email address.
  • To run seasons: signups, drafts, schedules, standings, and results.
  • To display public profiles, rosters, and league pages.
  • To send transactional email — email verification and password resets.
  • To post league updates to our Discord server.
  • To prevent abuse, enforce our Terms, and apply rate limits.

Where the GDPR or similar laws apply, we rely on contract (running the league you signed up for), legitimate interests (security, abuse prevention), and consent (optional profile fields and linked game accounts, which you may withdraw at any time by removing them).

5. Who we share it with

We do not sell your data or share it for advertising. We use the following service providers to operate the site:

  • Vercel — website hosting and request logs.
  • Neon — the Postgres database where the data above is stored.
  • Resend — delivery of verification and password-reset emails (receives your email address).
  • Upstash — Redis used for rate limiting.
  • Riot Games — receives your PUUID when we refresh your stats, if you have linked a Riot account.
  • Discord — receives league updates that we publish to our server.

We may also disclose data where required by law, or to protect the rights and safety of our users. These providers are based in or process data in the United States; if you are accessing the site from elsewhere, your data will be transferred there.

6. What is public

Your profile at /users/<username> is publicly visible without signing in. It shows your username, display name, pronouns and bio (if set), linked Riot ID, ranked standing and top champions, and any OP.GG or Leetify links you have added. Your season signups, team, draft picks, and match results are also public. Your email address, password, IP address, and session data are never shown publicly.

7. Retention

We keep account and league data for as long as your account exists, because season history and standings are part of the league’s public record. Sessions expire automatically. Riot stat snapshots are overwritten on each refresh rather than accumulating history. If you delete your account, we remove your personal data as described below.

8. Your rights

You can view and edit most of your data yourself from your profile page, including your display name, bio, pronouns, and linked accounts. Depending on where you live, you may also have the right to request access to, correction of, deletion of, or a copy of your personal data, and to object to certain processing.

To make a request, email contact@spicyleague.dev from the address on your account. We will respond within 30 days. Note that deleting an account also removes its signups, draft picks, and team memberships — if you are a captain in an active season, we will contact you to arrange a replacement first. Historical results may be retained in anonymised form so past seasons remain coherent.

9. Children

Spicy League is not intended for anyone under 13. We do not knowingly collect data from children under 13. If you believe a child has given us personal data, email us and we will delete it.

10. Security

Traffic is served over HTTPS, passwords are hashed, and access to the production database is restricted to league administrators. No system is perfectly secure, so we cannot guarantee absolute security — please use a unique password. If we become aware of a breach affecting your data, we will notify affected users in the Spicy League Discord and by email.

11. Changes to this policy

We may update this policy as the site changes. The “last updated” date at the top reflects the current version, and material changes will be announced in the Spicy League Discord.

12. Contact

For any privacy question or request, email contact@spicyleague.dev.