Skip to content
Spicy League.
SIGNUPS OPENHomeSeasonsHistory10-manPlayersSign in

Legal

Privacy Policy

Last updated October 29, 2026

This policy explains what personal data Spicy League collects when you use www.spicyleague.dev or interact with our Discord bot, why we collect it, and who it is shared with. It applies alongside our Terms of Service.

The short version: we collect what is needed to run a community tournament and nothing else. We do not run advertising or analytics trackers, and we do not sell your data.

1. What we collect

Account information

  • Email address — required for registration, verification, and password resets. It is never shown publicly.
  • Password — stored only as a salted hash. We cannot read it.
  • Username and display name — both public.
  • Discord username — required to create an account and to sign up for a season, so league admins and captains can reach you. It is shown to signed-in players on your profile and to admins, never to signed-out visitors. We don’t verify it with Discord.
  • Optional profile fields — bio, pronouns, and an OP.GG URL, all public if you provide them.

Technical and session data

  • When you sign in we create a session record containing a session token, its expiry, and the IP address and browser user-agent of the sign-in. This is standard security bookkeeping used to keep you signed in and to detect abuse.
  • Our hosting and database providers keep their own operational logs, which may include IP addresses.
  • An activity log of what happens on the site: for example account creation, profile edits (with the old and new values), linked accounts, signups, draft picks, match reports, and admin actions. Only league admins can see it, it holds no passwords or IP addresses, and entries are deleted after 60 days.

League participation

  • Season signups, including your role preferences (LoL), map preferences (CS2), and any notes and moral-quandary answer you write.
  • Captain status, draft picks made and received, team membership, and match results you report.

Linked game accounts

  • If you link a Riot account, we store your Riot ID (gameName#tagLine) and the PUUID that Riot returns for it, and we periodically fetch your public ranked standing and top champion mastery from the Riot Games API. These are shown on your public profile.
  • Per-player stats from League of Legends games played in Spicy League (KDA, CS, damage and similar), fetched from the Riot Games API, are shown publicly only if you opt in. Opting in is required to sign up for a League of Legends season, and stays on until every season you're signed up for has ended; after that you can opt out on your profile page, which hides your per-player stats (team and champion totals still show). Which champion you played in a league game, as recorded by your team's draft, is league data and is shown on your profile either way.
  • If you link a Steam or Leetify account, we store the identifier or profile URL you provide. We do not currently call the Steam or Leetify APIs.
  • All account linking is optional and can be undone from your profile page.

Discord

Our Discord bot can read messages in the channels of the Spicy League Discord server that it has been granted access to, and posts league updates into that server. We do not store Discord message content in our database, and we do not read direct messages. Your activity within Discord is also subject to Discord’s own privacy policy.

The bot also manages league roles and team channels in the server (for example Captain, your team’s role and private channel, Signed up, Sub list and Champion), can set your server nickname to your display name, opens a thread per match and posts match reminders and results there, and answers slash commands such as /standings and /rank. To do that we look up the Discord username on your profile in the Spicy League server and store the matching Discord user ID with your account. Changing your Discord username on your profile clears it. If we can’t match your username, an admin may email you to ask you to fix it.

2. What we do not collect

  • No payment or financial information — Spicy League is free and has no entry fee.
  • No advertising, analytics, or cross-site tracking cookies.
  • No precise location data.
  • No special-category data. Please do not put sensitive personal information in your bio or signup notes.

3. Cookies

We set up to three cookies, all used only to keep you signed in. They are strictly necessary for the site to function, are removed when you sign out, and are not shared with any third party. On the live site their names begin with __Secure-.

  • sl.session_token — identifies your signed-in session. Lasts 30 days if you choose to stay signed in, otherwise until you close your browser.
  • sl.session_data — a short-lived copy of your session details so pages load without a database lookup. Expires after 5 minutes.
  • sl.dont_remember — set only when you sign in without choosing to stay signed in, so your session ends when you close your browser.

We do not use cookies for advertising or analytics, which is why you will not see a cookie consent banner.

4. How we use your data

  • To create and secure your account, and to verify your email address.
  • To run seasons: signups, drafts, schedules, standings, and results.
  • To display public profiles, rosters, and league pages.
  • To send transactional email — email verification and password resets.
  • To post league updates to our Discord server.
  • To prevent abuse, enforce our Terms, and apply rate limits.

Where the GDPR or similar laws apply, we rely on contract (running the league you signed up for), legitimate interests (security, abuse prevention), and consent (optional profile fields and linked game accounts, which you may withdraw at any time by removing them).

5. Who we share it with

We do not sell your data or share it for advertising. We use the following service providers to operate the site:

  • Vercel — website hosting and request logs.
  • Neon — the Postgres database where the data above is stored.
  • Resend — delivery of verification and password-reset emails (receives your email address).
  • Upstash — Redis used for rate limiting.
  • Riot Games — receives your PUUID when we refresh your stats, if you have linked a Riot account.
  • Discord — receives league updates that we publish to our server.

We may also disclose data where required by law, or to protect the rights and safety of our users. These providers are based in or process data in the United States; if you are accessing the site from elsewhere, your data will be transferred there.

6. What is public

Your profile at /users/<username> is publicly visible without signing in. It shows your username, display name, pronouns and bio (if set), linked Riot ID, ranked standing and top champions, and any OP.GG or Leetify links you have added. Your season signups, team, draft picks, and match results are also public, as are your per-player stats from league games if you have opted in. Your email address, password, IP address, and session data are never shown publicly.

7. Retention

We keep account and league data for as long as your account exists, because season history and standings are part of the league’s public record. Sessions expire automatically. Riot stat snapshots are overwritten on each refresh rather than accumulating history. The admin activity log keeps entries for 60 days. If you delete your account, we remove your personal data as described below.

8. Your rights

You can view and edit most of your data yourself from your profile page, including your display name, bio, pronouns, and linked accounts. Depending on where you live, you may also have the right to request access to, correction of, deletion of, or a copy of your personal data, and to object to certain processing.

You can delete your account yourself from your public profile page (there’s a link at the bottom of your profile). This removes your profile, sign-in, Discord and game account details, and any signups for seasons that haven’t started. If you have played in past seasons or 10-mans, those rosters and results are kept in anonymised form, shown as “Deleted player”, so past seasons remain coherent. While you are in a season that is under way or an unfinished 10-man, deletion waits until it is over.

To make any other request, email contact@spicyleague.dev from the address on your account. We will respond within 30 days.

9. Children

Spicy League is not intended for anyone under 13. We do not knowingly collect data from children under 13. If you believe a child has given us personal data, email us and we will delete it.

10. Security

Traffic is served over HTTPS, passwords are hashed, and access to the production database is restricted to league administrators. No system is perfectly secure, so we cannot guarantee absolute security — please use a unique password. If we become aware of a breach affecting your data, we will notify affected users in the Spicy League Discord and by email.

11. Changes to this policy

We may update this policy as the site changes. The “last updated” date at the top reflects the current version, and material changes will be announced in the Spicy League Discord.

12. Contact

For any privacy question or request, email contact@spicyleague.dev.