Privacy Policy

Who we are

Who Carried? is run by whocarried.com (“we”, “us”). It's a free, for-fun tool that lets friends who play League of Legends together look back at a game and settle who carried. We decide how the data described here is used, so we are responsible for it (the “controller” under the GDPR).

Privacy questions and removal requests: privacy@whocarried.com. Anything else: help@whocarried.com.

There are no accounts or sign-ups. You can use the whole site without telling us who you are.

What data we handle

Game data from Riot Games. When someone searches for a Riot ID, we request data from Riot's official API: the Riot ID (name and tag), the account's player ID (PUUID), ranked standing, the list of recent matches, and the details and timelines of those matches. A match includes data about all ten players in it: champions, items, stats, positions on the map and in-game events. Riot makes this data available to registered developers under its developer policies.

What we work out from it. Verdicts (who carried), win-probability charts, role grades, awards, jokes about the game, and which players often queue together (duo and premade detection). These are automated estimates for fun. They have no legal or similarly significant effect on anyone.

Who is named. Pages and share cards name only the player who was searched and the friends they queued with. Everyone else in a game appears by champion only (“your Zed”, “their Ahri”). Share cards are images made when someone opens or shares them, and they follow the same rule.

Visitor data. When you visit, our hosting provider (Cloudflare) processes technical data: IP address, browser and device type, the pages you request (page addresses include the Riot IDs searched) and the time. This is used to deliver pages, keep the site secure and stop abuse.

Stored only on your device. Your recent searches, favorites and last chosen region are saved in your browser's local storage. They are never sent to us, and clearing your browser data removes them.

Emails you send us. Your address and whatever you write, used only to answer you and handle your request.

Cookies, analytics and ads

We don't set cookies, we don't run analytics or tracking scripts, and there are no ads. We don't build profiles of visitors, and we don't sell or rent personal data. Cloudflare may set a strictly necessary security cookie if it has to check that a visitor isn't a bot. It also shows us overall traffic figures, such as request counts, without cookies.

If we ever add ads or analytics, we'll update this policy first and ask for consent where the law requires it.

Why we use it (legal basis)

We process this data to provide the service you ask for (looking up and analysing games), to keep the site secure and working, and to prevent abuse. Under the GDPR our legal basis is legitimate interests (Article 6(1)(f)). The data is game data Riot already provides to developers for tools like this, we use only what the features need, other players are never named, and anyone can object or have their Riot ID removed (see below). For emails you send us, the basis is handling your request.

How long we keep it

• Match details and timelines: kept while the site runs, because finished games never change and fetching them again would waste Riot's API.
• Riot ID lookups: 1 hour by name, 1 day by player ID. Ranked standings: 10 minutes. Recent match lists: 2 minutes.
• Saved verdict summaries (the badges in match history): 30 days.
• Detected duo and premade partners: 90 days.
• Cloudflare request logs: about 7 days.
• Emails: until your request is handled, then deleted within 12 months.

Data is deleted sooner if you ask us to (see “Your rights”).

Where it's stored and who else is involved

• Riot Games is the source of all game data. Champion art and icons load directly from Riot's servers, so Riot receives your IP address and browser details when you view them, under Riot's privacy notice.
• Cloudflare hosts and runs the site, protects it from attacks, and stores our cached game data. That data (database and file storage) is kept in Cloudflare's Western Europe region. Pages themselves are served from Cloudflare's global network. Cloudflare's privacy policy.
• Email. Messages to our addresses are forwarded by Cloudflare Email Routing and stored with our email provider, Microsoft (Outlook).
• Authorities, only if the law requires it.

These providers act on our behalf and may process data outside your country, including in the United States. Where the GDPR requires it, transfers are covered by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

Your rights

You can ask to see the data we hold about you, correct it, delete it, restrict it, or object to its use, and you can ask for a copy. You can also complain to the data protection authority where you live. Email privacy@whocarried.com. We reply within one month.

Removing your Riot ID. Email us your Riot ID and region. To confirm the account is yours, we'll ask you to set a specific profile icon in the League client for a few minutes. Then we delete the lookups, verdict summaries and premade links we hold about you, and block your account on Who Carried?: your profile and verdicts can't be looked up, and you're never named in anyone else's games. You still appear as one of the ten players in other people's matches, shown only by your champion, because that game also belongs to the other nine players.

Children

Who Carried? isn't meant for children under 13, or under the minimum age to play Riot's games in your country. If you think a child has contacted us, email us and we'll delete their message.

Security

The site runs only over HTTPS. Our Riot API key stays on our servers and is never sent to your browser. Cached data sits in storage that only the site itself can reach, and we keep only the data the features need.

Changes

If this policy changes, we'll update it here and change the date at the top. See also our Terms of Service.