Runeterra.org is an independent fan publication about Riot Games’ unannounced Runeterra MMO. This policy explains what personal information the site collects, why, who else touches it and what you can do about it. It covers runeterra.org and the emails we send. It does not cover Riot Games, or any other site we link to.
The publisher of Runeterra.org is the controller of the personal information described here. You can reach us at contact@runeterra.org, and that address is answered by a person.
The short version: the site collects an email address if you choose to give one, keeps a little technical detail alongside it to stop abuse, counts its readers with Google Analytics, and measures whether the emails it sends are opened and which links in them are clicked. There is no advertising and nothing is sold, but that email measurement is tied to your address rather than anonymous, and section 1 says exactly what it records. On the site itself, in Europe, the measurement waits for you to say yes.
1. What we collect
Your email address, if you join the waiting list. This is the only piece of information we ask anyone for.
A small amount of context stored with it. When you submit the form we record which page or campaign the sign-up came from, your browser’s user agent string cut to 240 characters, and the language preference your browser sends cut to 32 characters. We keep these to tell real sign-ups from automated ones and to know roughly who is reading.
Timestamps and a confirmation token. We record when the confirmation email went out and when you confirmed. The confirmation link itself is never stored. What we store is a SHA-256 hash of it, which is enough to check a link you present and useless to anyone who reads the database.
What an account holds, if you make one. An account is optional; the site reads the same without one. It stores your email address, the date it was created, and a public handle if you choose one. It stores no password, because there is none: you sign in with a six-digit code sent to your address, or through Google, Discord or Twitch.
The Google sign-in prompt on our pages. On the blog and the pages around it, if you are not signed in, we may show Google's own "Sign in with Google" prompt in the top right. Drawing it means loading a script from Google and letting Google read the account you already have open in that browser, which is why we treat it exactly like the audience measurement: where consent is required, the prompt does not appear until you have accepted, and refusing costs you nothing. We show it at most once, then after three days, two weeks, six weeks, and quarterly after that, for as long as you stay signed out. That schedule is kept in your own browser under the key runeterra:signin, and clearing your browser data resets it. If you never press it, Google learns that its prompt was shown on this page and nothing else about you passes to us.
What a sign-in provider tells us. If you sign in through one of those services we receive the identifier they hold for you, and, where the service gives one, your email address and whether they have verified it. That is all. We do not receive your password, your friends, your posts or anything you do there, and we do not write anything back. We use what they send for one purpose only: to identify your account and, where an address is given, to send you the newsletter if you asked for it. We do not sell it, share it onward, or use it to build a profile of you. If a service ever gives us no address, we ask you for one afterwards, and until you give it we cannot send you anything.
Your IP address, briefly. Every submission is counted against the address it came from so that nobody can hammer the form. That counter lives in the server’s memory for 60 seconds and is then discarded. Your IP address is not written to our database.
Whatever you put in an email to us. If you write to contact@runeterra.org we receive your address, your message, any attachment and the message’s technical headers.
Whether you open our emails, and what you click in them. Every message we send to the waiting list carries an invisible one-pixel image, and its links are rewritten to pass through links.runeterra.org before forwarding you on. When your mail client loads that image we record that the message was opened, when, and the IP address and client your mail app reported; when you follow a link we record which one, and when. Unlike the site measurement, this is attached to your email address, not to an anonymous identifier — we can see that a particular subscriber opened a particular email. Mail clients that block remote images, and readers who never click, are simply not recorded.
We keep our own copy of those opens and clicks, alongside your address, the identifier of the message and the address of the link you followed. We do not keep the IP address, although our provider reports one: Gmail serves remote images from its own cache and Apple Mail loads them ahead of you, so the address recorded is theirs rather than yours, and it would tell us nothing true about where you are.
Ordinary server logs. Our host records requests to the site, including IP addresses, in the normal course of running a web server.
What Google Analytics sees. We use Google Analytics 4 to count readers. It records the pages you open, when, roughly where from — Google derives a country and city from your IP address and does not give us the address itself — and the sort of device and browser you use. Where analytics storage is allowed it also writes a cookie holding a random identifier, so that two visits from the same browser count as one reader rather than two. We do not send it your email address or anything else that names you.
We do not collect payment details, government identifiers, precise location, contacts, photographs or anything about your health or beliefs. There are no passwords on the site, so there is none of yours to lose.
2. Why we use it, and on what legal basis
| Purpose | Information used | Legal basis |
|---|---|---|
| Send you the confirmation link and, once confirmed, the occasional email about the MMO | Email address, timestamps, token hash | Your consent |
| Keep the sign-up form from being abused by bots and floods | IP address (transient), user agent, source label | Our legitimate interest in keeping the site working |
| Understand roughly where readers come from and what language they read in | Source label, language preference | Our legitimate interest in running a publication people can use |
| Count readers and see which pages are actually read | The analytics identifier and events described in section 1 | Your consent in the EEA, the UK and Switzerland; our legitimate interest in knowing whether anyone reads this, elsewhere |
| See whether our emails are opened and which links are followed, so we know what is worth writing and stop sending what nobody reads | Your email address, the open and click records described in section 1 | Your consent, given when you confirmed your address; withdraw it by unsubscribing |
| Let you sign in, and keep you signed in | Your email address or the identifier your sign-in provider gives us, and the session cookies of section 3 | Necessary to provide the account you asked us for |
| Remember which way you signed in last time, so the next visit is quicker | The name of the button you pressed, in a cookie on your own device | Our legitimate interest in a sign-in page that is not a memory test |
| Reply to you when you write to us | Your email and its contents | Our legitimate interest in answering correspondence |
| Keep the site secure and investigate problems | Server logs | Our legitimate interest in security |
| Meet a legal obligation, or establish or defend a legal claim | Whatever is relevant | Legal obligation, or our legitimate interest in defending claims |
Where we rely on consent you can withdraw it at any time, and withdrawing it does not affect anything we did before you withdrew. Where we rely on a legitimate interest, you can object, and section 10 explains how.
We do not sell personal information, share it for cross-context behavioural advertising, or make automated decisions about you that have any legal or similarly significant effect. We do not use it to train machine learning models, and we do not give it to anyone who does.
We should be plain about one thing rather than hide it behind a word: because the email measurement is tied to your address, we can build up a picture over time of which of our emails a given subscriber opens and which links they follow. We use it to decide what to publish and to stop mailing people who never read us. We do not combine it with the site analytics, which never receives your address, and we do not sell it or hand it to advertisers. Unsubscribing ends it and deletes the address.
3. Cookies and what your browser stores
Analytics. Google Analytics writes cookies named _ga and _ga_XXXXXXXXXX, which hold a random identifier and no more. They last two years and they exist so that your second visit is not counted as a second person.
In the European Economic Area, the United Kingdom and Switzerland those cookies are not written until you accept: the page loads with analytics storage denied, and a banner asks. Refuse, and no identifier is stored — Google still receives a cookieless signal that a page was viewed, which feeds an aggregate count and nothing that follows you. Elsewhere the measurement starts on, which the law there allows, and the Cookies link in the footer turns it off. That link reopens the same choice everywhere, and your answer is remembered in your own browser under the key runeterra:consent.
We keep Google's advertising features off in all cases. No advertising identifier is ever set, on any continent, whatever you answer.
Signing in. If you have an account and are signed in, your browser holds a session cookie whose name begins with sb- and which may be split across two cookies when it grows past the size limit. It carries the token that proves you are you. It is strictly necessary — without it there is no way to stay signed in from one page to the next — so it is not part of the choice the banner offers, and refusing analytics does not remove it. Signing out deletes it. If you never make an account it is never written.
The way you last signed in. Once you have signed in, a cookie named runeterra_last_method holds one word — google, discord, twitch, reddit or email — so the sign-in page can mark the button you used last time. It holds nothing else: no address, no identifier, nothing that tells two people apart. It is on your device only, it lasts a year, and it deliberately survives signing out, because that is the moment it becomes useful. Clearing your browser data removes it.
Two cookies that last ten minutes. Signing in happens partly on our server and partly on someone else's, and two decisions have to survive the journey between them. One cookie, runeterra_join_list, remembers whether you ticked the box asking for the newsletter before you left for Google, Discord or Twitch — without it, the tick would be lost by the time you came back. The other, runeterra_outcome, holds what just happened in three words — signed in, signed out, account opened, account closed, by which button, and whether an address joined or left the newsletter on the way — so that the page you land on can count it, because the counting happens in your browser while the deciding happens on our server. Neither holds an address or an identifier, neither tells two people apart, and both are deleted by the page that reads them, or expire on their own after ten minutes.
How often we offer the sign-in prompt. The key runeterra:signin holds a count and a date, so that the Google prompt described in section 1 is not shown to you twice in a week. It holds nothing else, never reaches us, and clearing your browser data resets it.
One last thing. If you turn the atlas sound on or off, that preference is saved in your own browser under the key runeterra:sound. It never reaches us, and clearing your browser data removes it.
4. Who else handles it
We use four service providers. Each acts on our instructions and none of them may use your information for their own purposes.
Supabase hosts the database that holds the waiting list, and runs the sign-in itself: it keeps accounts, issues the six-digit codes and holds the sessions.
Resend sends our email and receives what arrives at contact@runeterra.org. Mail sent to that address is forwarded to a private mailbox we read. Resend also hosts the measurement described in section 1: it serves the tracking pixel, operates links.runeterra.org where our email links are rewritten, and records the opens and clicks on our behalf.
Vercel hosts the site and serves every page.
Google provides Google Analytics, which measures readership as described in section 1. Google's own account is at policies.google.com/technologies/partner-sites. We have not enabled its advertising features, its Google Signals, or any link to an advertising account.
Three sign-in providers sit alongside them, and only if you press one of their buttons: Google — in a second capacity, unrelated to the analytics above — along with Discord and Twitch. The relationship runs the other way round with these — they are not acting on our instructions, they are answering a request you made by pressing their button. What they receive is the fact that you signed in to this site; what they send back is described in section 1. Each has its own privacy policy, and what happens on their side is governed by it. Pressing none of those buttons keeps them out of it entirely.
Beyond all of these, we disclose personal information only where the law requires it, or where we need to establish, exercise or defend a legal claim. If the site were ever transferred to someone else, the waiting list would go with it, and we would say so on the site before that happened.
5. Where it goes
Our providers are United States companies and may process your information there or elsewhere. Where information leaves the European Economic Area, the United Kingdom or Switzerland, that transfer is made on the basis of an adequacy decision, the European Commission’s standard contractual clauses, or another mechanism permitted by Chapter V of the GDPR. Write to contact@runeterra.org if you want to know which one applies to a given provider.
6. How long we keep it
Confirmed addresses stay on the waiting list until you ask us to remove them, or until we stop publishing, whichever comes first. Ask and it is deleted; we do not keep a suppression copy unless you tell us you never want to hear from us again.
An unconfirmed address stays in the database as an unconfirmed row. Its confirmation link stops working after 48 hours. Ask us and we will delete the row.
Analytics events are kept by Google for the retention window set on the property, which is at most fourteen months. After it, only aggregate reports remain, and they name nobody.
Email open and click records are held by Resend for the retention period of our account with them, and we keep our own copy for as long as we publish. Unsubscribing deletes your address from the waiting list, and you can ask us at contact@runeterra.org to delete the open and click history attached to it at the same time; say so and we will, without asking why.
An account is kept until you close it. There is a button for that in your settings, it takes effect at once, and it cannot be undone: the account, the handle and the record of which services you signed in with all go. Your address on the waiting list is a separate thing you agreed to separately, so closing the account leaves it alone unless you tick the box that says otherwise — and the unsubscribe link at the foot of every email keeps working either way. If you would rather we did it by hand, write to contact@runeterra.org.
Emails you send us are kept as long as the exchange is useful, and longer only where a legal claim makes that necessary. Server logs are kept for the short period our host retains them.
7. How we protect it
Traffic is served over HTTPS. Confirmation links exist only as a hash in the database and expire after 48 hours. The key that can write to the waiting list is held on the server and never reaches your browser. The sign-up form is rate limited and carries a hidden field that automated submissions tend to fill in.
None of this makes a system perfectly secure, and we will not pretend otherwise. If a breach affects your information and the law requires it, we will tell you and the relevant regulator.
8. Your choices
You can use the site without giving us anything. Every page reads the same signed out as signed in; an account changes nothing about what you can read.
You do not have to sign in with another service. The six-digit code sent to your address does the same job and tells Google, Discord and Twitch nothing. If you have already signed in with one of them and would rather not have, closing the account ends the connection on our side, and each of them lets you revoke our access from your own settings there.
You can refuse the audience measurement, or change your mind later, from the Cookies link in the footer of every page. Refusing costs you nothing: the site behaves exactly the same. Google also publishes a browser add-on that opts you out of Analytics everywhere, at tools.google.com/dlpage/gaoptout.
You can stop the email measurement without leaving the list. Set your mail client not to load remote images and no open is ever recorded — most clients do this by default and offer it as "block remote content" or similar. To avoid the click records, copy the article address from the email and open it directly rather than following the link. Neither costs you anything: the emails read the same, and we do not treat a silent subscriber differently except by eventually leaving them alone.
Every email we send carries an unsubscribe link, and it keeps working however old the message is. Your mail client may also show its own one-click unsubscribe button, which we honour immediately. Either one deletes your address outright rather than flagging it, so nothing is left behind on a suppression list.
If you would rather not use the link, write to contact@runeterra.org and we will delete the address by hand. You do not need to give a reason and we will not ask for one.
9. Children
The site is not directed to children. You must be 18 to join the waiting list, and we do not knowingly collect personal information from children. If you believe a child has given us an address, write to contact@runeterra.org and we will delete it.
10. If you are in Europe or the United Kingdom
This section applies to people in the European Economic Area, the United Kingdom and Switzerland. "Personal information" here means "personal data" as the GDPR uses the term.
You have the right to ask us to:
- Give you access to the personal information we hold about you, and tell you how we process it.
- Correct anything inaccurate.
- Delete it, where there is no good reason for us to keep processing it.
- Transfer a machine-readable copy to you or to somebody else you name.
- Restrict our processing, for instance while an accuracy dispute is being settled.
- Object to processing we base on a legitimate interest. You may always object to direct marketing, and we will stop.
- Withdraw your consent, at any time, where consent is what we rely on.
To use any of these, write to contact@runeterra.org. We may ask for enough information to be sure it is you. We answer within one month, and tell you why if we cannot do what you asked.
Complaints. If our answer does not satisfy you, you may complain to the data protection authority where you live or work. People in the EEA can find their national authority through the European Data Protection Board at edpb.europa.eu. People in the United Kingdom can contact the Information Commissioner’s Office at ico.org.uk, or by telephone on 0303 123 1113. We would rather you told us first, but you are not obliged to.
Automated decisions. We make none. Nothing on this site decides anything about you automatically.
11. If you are in a United States state with a privacy law
California, Colorado, Connecticut, Virginia and a growing number of other states give residents rights over their personal information. Depending on where you live, those may include knowing what we collect and why, getting a copy, correcting it, deleting it, and opting out of sale, targeted advertising and profiling.
We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use it for targeted advertising or profiling. There is nothing here to opt out of, and we honour Global Privacy Control signals in the sense that there is no sale or sharing for them to stop.
The categories we collect are identifiers, meaning your email address and the random analytics identifier, and internet activity information, meaning the user agent, language preference, source label, the page views described in section 1, and your interactions with our emails — opens and clicks — as described there too. Section 2 gives the purpose for each. We collect them from you directly. We disclose them only to the providers named in section 4, for the purposes named there. We collect no sensitive personal information as California defines it.
To use any of these rights, write to contact@runeterra.org. We will not treat you differently for asking.
California Shine the Light. California Civil Code section 1798.83 lets residents ask about personal information disclosed to third parties for their own direct marketing. We make no such disclosures.
12. Changes to this policy
We may update this policy. The revision date at the top changes when we do. If a change matters, we will say so on the site, and we may email the waiting list. We will not start using information we already hold for a materially different purpose without a legal basis to do so, and where that basis is your consent, we will ask first.
13. How to contact us
Write to contact@runeterra.org, about anything in this policy or anything else.