Privacy Policy
Last updated: 15 September 2026
This document explains what data HexCore processes, why, who it is shared with, how long it is kept and what rights you retain over it.
1. Data controller
This policy constitutes the information required by Articles 13 and 14 of the General Data Protection Regulation. The data controller is POCKET COACH, a French simplified joint-stock company, 2 allée Clos des Blanches Pierres, 69290 Grézieu-la-Varenne, France, publisher of HexCore. Any question about your data can be sent to nicolas@hexcore.gg.
2. Data we collect
Signing in with your Riot account
HexCore uses neither a password nor an email address for authentication. You sign in through Riot Sign-On, granting HexCore only the permissions needed to read your game data. Your email address, your real name and your Riot billing details are never passed on to us. We record your Riot account identifiers, the tokens issued by Riot to maintain that access, and your in-game name, your server and your profile icon.
Game data from the Riot API
To produce the statistics that are the whole point of the service, HexCore imports and stores your rankings and how they change over time, your matches, their performance statistics and their detailed timeline. HexCore calculates a performance rating from this material.
What you enter into the platform
The information you provide in order to use the service: your team and its roster, your champion pools and compositions, your calendar and your availability slots, your notes and what you declare before a match, as well as your membership of an organisation and the changes relating to it.
Your availability and your pre-match declarations are visible to your team staff: that is the very purpose of the tool.
Subscription and payment
Payments are handled by Stripe. HexCore never receives, stores or sees any banking data, and does not keep the email address you give to Stripe. What is recorded on our side is only what is needed to track your subscription: the plan, its billing period, its dates, and the technical identifiers linking it to your payment.
Technical data
- IP address: held in memory to rate-limit requests and protect the service from abuse. It is not stored in the database.
- Country and time zone: when you create a team, HexCore records once the country code derived from your IP address by the host, your browser time zone and its offset. These indicators identify the geographic areas where the service is used. They are neither displayed nor editable.
- Server logs: retained by the host for diagnostics and security.
- Product telemetry: a few actions from the team setup step are recorded to measure where users drop out of the journey.
Audience measurement
HexCore uses Webful, an audience measurement tool that sets no cookie and stores an anonymous session identifier in your browser's local storage, valid for thirty minutes of inactivity. It measures page views, referrers, device type and clicks on certain buttons. No data is sold and no advertising profile is built.
3. Why we process this data
The law forbids us from processing your data without being able to name what allows us to. Here is the ground that applies to each use.
| What we do | What allows us to |
|---|---|
| Run the service: your account, your teams, your statistics, your calendar, your team's Discord notifications and your subscription | Without it there is no service: it is the purpose of our contract (Art. 6(1)(b)) |
| Keep a record of your payments, with our payment provider | Accounting law requires it (Art. 6(1)(c)) |
| Secure the platform, measure audience, identify the regions where the service is used, import opposing rosters to prepare a match | Our legitimate interest, without prejudice to you. You may object (Art. 6(1)(f)) |
We never ask for your consent, because none of these uses relies on it. That is also why no banner greets you on this site.
4. Cookies and local storage
HexCore sets no advertising cookie, no cross-site tracking cookie and no targeting tracker. The cookies in use serve two purposes only:
- cookies needed for signing in, which keep your session open and avoid revalidating it on every page. They are kept for thirty days at most and cleared when you sign out;
- preference cookies, which remember your display language and the team shown by default, kept for one year.
These cookies are exempt from consent: they are either strictly necessary for the service you requested, or limited to remembering your display preferences. None is passed on to a third party.
Your browser's local storage also keeps display preferences, the anonymous session identifier used for audience measurement and the state of certain onboarding guides. You can review and clear all of these at any time from your browser settings.
5. Players without a HexCore account
When a user prepares a match, they can import the opposing roster by pasting an op.gg link. HexCore then resolves those in-game names through the Riot Games API and stores, for each of them, the same public game data as for a registered user. The same applies to players present in an imported match.
This information is already publicly available through Riot Games and League of Legends statistics sites. It is processed on the basis of legitimate interest, for the sole purpose of preparing and analysing matches. If you are concerned and wish to object or request erasure, write to nicolas@hexcore.gg.
6. Who receives your data
| Recipient | Its role |
|---|---|
| Riot Games | Signing in to your account and access to your game data |
| Vercel, Railway, Supabase | Hosting of the site, the server, the database and the files |
| Stripe | Payment of subscriptions and donations |
| Discord | Messages sent to the servers you connect |
| OpenAI | Assisted generation of compositions, with no player identifier |
| Webful | Audience measurement |
| Google Ireland | The publisher's email |
Your data is never sold, rented or passed on to advertisers. It may be disclosed to an authority where the law requires it.
Location and transfers. Your data is processed and hosted in the European Union: the site runs in Paris, the application server and the database in Amsterdam, uploaded files in Ireland, email in Ireland and audience measurement in France. As the companies operating some of these services are established in the United States or Singapore, access from those countries remains possible for operations and technical support: such access is covered by the European Commission's standard contractual clauses, supplemented where applicable by the EU / US Data Privacy Framework where the provider is certified under it.
7. Retention periods
| Data | Kept |
|---|---|
| Account, teams, statistics, content you enter | As long as the account exists |
| Riot tokens | Deleted as soon as Riot invalidates them |
| Teams that took part in a tournament | Archived after deletion |
| Payment records, kept by our provider | 10 years |
| Audience measurement session identifier | 30 min of inactivity |
| Server logs | The host's retention period |
A team deleted after taking part in a tournament is archived and no longer appears to its members: its results are kept for the integrity of competition history. You can request the erasure of your account at any time, under the conditions set out in section 9.
8. Security
Traffic is encrypted in transit. Session cookies are inaccessible to the page's JavaScript and restricted to the hexcore.gg domain. Access to the database is restricted to the platform's services. No password is stored, since authentication is fully delegated to Riot Games.
9. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data. To exercise them, write to nicolas@hexcore.gg from a channel that allows us to identify you, for example by stating your Riot ID. You will receive a reply within one month.
You can also revoke HexCore's access to your Riot account at any time from your Riot Games account settings: the session is then invalidated and the corresponding tokens are deleted.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, 75007 Paris, cnil.fr.
10. Changes
This policy may change along with the service. The date of the latest update appears at the top of this page, and any substantial change is announced on the platform.
