Privacy Policy

This Policy explains what personal data Tiervue collects, why, and what your rights are. Tiervue is a VALORANT stats and rank tracker available as a Discord bot and a website at tiervue.com ("the Service"), operated by Strasse, a sole operator established in the Netherlands ("we", "us").

Tiervue is not affiliated with or endorsed by Riot Games.

Tiervue only stores and displays VALORANT data for players who have personally linked their Riot account through Riot Sign-On (RSO). We never display, fetch, or aggregate data for a player who has not personally opted in, even if that player is a member of a Discord server where Tiervue is installed.

By linking your Riot account, you acknowledge that your VALORANT rank and recent match history become publicly visible on your Tiervue profile and in any Discord server where Tiervue is installed. You can unlink at any time. See section 8 for how unlinking deletes your data.

The data controller for the personal data described in this Policy is Strasse, established in the Netherlands. Contact: privacy@tiervue.com.

We have not appointed a Data Protection Officer because our processing is not of a scale that requires one under Article 37 GDPR. We will reconsider as the Service grows.

We collect only what is needed to run the Service.

3a. From Riot Games (after you complete RSO)

• Riot puuid (a permanent unique identifier)
• Riot ID (game name and tag line)
• Account region
• OAuth tokens (access token, encrypted refresh token)
• Current rank and rated rating (RR) via VAL-RANKED-V1
• Recent match summaries via VAL-MATCH-V1, up to your last 20 matches

3b. From Discord (only if you link via the bot)

• Discord user ID
• Discord username and avatar URL, fetched at display time and not cached long-term
• Per-server role assignments that Tiervue itself has applied

3c. From server admins (only for installed servers)

• Discord server (guild) ID, name, icon URL
• Channels selected as the leaderboard or match-result channel
• Server configuration choices (rank roles enabled, etc.)

3d. From you, on the website

• A session cookie set when you log in via RSO. It contains a server-signed reference to your session, not your Riot tokens
• A short-lived CSRF cookie during the login flow
• Basic request logs (IP address, user agent, requested URL, timestamp), kept for a short period for security and abuse prevention

3e. Waitlist sign-ups (pre-launch)

• If you join the waitlist on tiervue.com before launch, we collect the email address you submit, in order to send you a single launch notification. Sign-ups are stored by our email provider, Resend (resend.com), acting as a processor. You can unsubscribe at any time using the link in that email or by contacting privacy@tiervue.com; unsubscribing removes your address from the list.

3f. What we do not collect

• Your Riot password or any credential. RSO happens on Riot's servers
• Voice, message content, or chat history from Discord
• Match data for players who have not personally linked
• Payment card details. Payments processed by a third party

Under the GDPR, every processing activity has a defined purpose and legal basis.

We do not rely on consent as the legal basis for our core RSO processing because RSO linking and the Service itself are inseparable. The opt-in to be displayed publicly is, however, an explicit choice you make at link time, and you can withdraw it at any time by unlinking. Waitlist emails are the exception: those rest on your consent, which you can withdraw by unsubscribing.

• Source: Riot Games API and Discord API, plus what you provide by configuring the Service or joining the waitlist
• Recipients: shown on tiervue.com and inside Discord servers where Tiervue is installed and you are present. Processors:
  • Hosting: Vercel Inc. (website) and Hetzner Online GmbH (Germany)
  • Database and cache: PostgreSQL and Redis on the above
  • Email delivery for the waitlist: Resend (resend.com)
• We do not sell your data. We do not share it for advertising. We do not run third-party advertising trackers.

Our hosting and primary processors are in the EU. Some data inevitably leaves the EU because Discord, Riot, and some providers operate globally. Where transfers occur outside the EU/EEA, we rely on the relevant transfer mechanism in Articles 44 to 49 GDPR (typically Standard Contractual Clauses or an adequacy decision).

• Active linked accounts: we keep your data for as long as your Riot account is linked.
• Match summaries: rolling window of your last 20 matches.
• Waitlist email: until launch or until you unsubscribe, whichever comes first.
• Request logs: up to 30 days, then deleted or anonymised.
• After unlink: see section 8.
• Billing records: retained as required by tax law.

You can unlink from your profile settings on tiervue.com/me/settings. When you unlink, we:

• delete your row in users and any cached rank and match summaries linked to your puuid
• delete your row in discord_links if one exists
• remove any rank roles the bot has applied to you in any server
• revoke the Riot refresh token via Riot's revocation endpoint
• clear your session

If you are in the EU/EEA, the UK, or another jurisdiction with comparable law, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data. Unlinking is the fastest way
• Restrict processing in certain cases
• Object to processing based on legitimate interest
• Data portability for data you provided to us
• Withdraw consent where consent is the basis, including unsubscribing from the waitlist
• Lodge a complaint with a supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)

To exercise these rights, contact privacy@tiervue.com. We respond within one month, as required by Article 12 GDPR.

• a session cookie set after RSO login (HttpOnly, Secure, SameSite=Lax)
• a short-lived CSRF cookie during the RSO flow
• no advertising or third-party tracking cookies. The waitlist does not set cookies

The Service is not directed at children under the age of digital consent in their country (13 in much of the world, 16 in many EU member states). We do not knowingly collect data from such children. If we learn we have, we delete it.

We use industry-standard measures to protect your data, including TLS in transit, encryption at rest for sensitive fields (including OAuth refresh tokens), role-based access for operators, and minimal logging of personal data. No service is perfectly secure, and you use the Service at your own risk.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and notify affected users without undue delay where the risk is high, as required by Articles 33 and 34 GDPR.

We do not make decisions about you that produce legal or similarly significant effects using solely automated processing. Rank roles and leaderboard placement are mechanical reflections of your in-game rank, not evaluations.

We may update this Policy. Material changes will be announced on the website. The "Effective date" at the top will be updated. We will not narrow your rights retroactively without giving you a chance to unlink first.

Privacy questions, rights requests, complaints: legal@tiervue.com.