Privacy Policy

Last Updated: August 10th, 2026

1. Introduction

This Privacy Policy explains how Heatmapper ("we," "our," "the Service") collects, uses, protects, and shares information. BY USING THE SERVICE, YOU ACKNOWLEDGE AND AGREE TO THIS PRIVACY POLICY.

2. Information We Collect

2.1 Account Data

Via Riot Sign On authentication:

  • Riot ID (username#tag)
  • Player UUID (PUUID)
  • Region/shard information
  • Account creation date

2.2 Game Data

  • Match history and statistics
  • Death coordinates and circumstances
  • Performance metrics by agent/map
  • Competitive rank and rating
  • Match timelines and events

2.3 Usage Data

Automatically collected:

  • IP address (anonymized after processing)
  • Browser type and version
  • Device information
  • Pages visited and features used
  • Session duration and frequency
  • Referral sources

2.4 Communications Data

If you contact us:

  • Email correspondence

3. Legal Basis for Processing

  • Consent: For account creation and data collection
  • Legitimate Interests: For service improvement and security
  • Legal Obligations: When required by law

4. How We Use Information

We use collected data to:

  • Generate personalized heatmaps and analytics
  • Provide and improve the Service
  • Communicate service updates (if opted in)
  • Detect and prevent fraud or abuse
  • Comply with legal obligations
  • Analyze usage patterns and optimize performance

5. Data Sharing and Disclosure

We DO NOT sell your personal data. We may share data with:

  • Service providers (under confidentiality agreements)
  • Law enforcement (when legally required)
  • Business transfers (in case of merger/acquisition)
  • With your explicit consent

6. Cookies and Tracking Technologies

6.1 Essential Cookies

Required for authentication and core functionality

6.2 Analytics Cookies

Help us understand usage patterns (can be disabled)

6.3 Managing Cookies

You can control cookies through browser settings, though this may limit functionality

7. Data Security

7.1 Security Measures

  • TLS/SSL encryption in transit
  • Encrypted database storage
  • Regular security audits
  • Limited access controls
  • Secure authentication via Riot OAuth

7.2 Incident Response

We'll notify affected users within 72 hours of discovering a data breach

8. Riot Sign On and Riot Account Access

We use Riot Sign On (RSO) as the only way to sign in. We never see, receive, or store your Riot password.

  • What Riot gives us: after you approve the sign-in, Riot issues us an access token and a refresh token tied to your account, plus your PUUID, Riot ID, and region.
  • Where those tokens live: only on our servers, encrypted at rest. They are never sent to your browser, never stored in the Overwolf overlay, and never exposed to any third party. The apps you use receive only our own short-lived session tokens.
  • What we do with them: read your VALORANT match history and match details in order to build your death heatmaps. We do not use your Riot account to take any action in-game, make purchases, or modify your account.
  • Revoking access: signing out revokes our refresh token at Riot. Deleting your account does the same and additionally erases the data described in section 10. You may also revoke our access from your Riot account settings at any time, which stops all future data collection.

9. Data Retention

  • Active accounts: Data retained while account is active
  • Match and death data: retained for 90 days on a rolling basis, after which older records are removed automatically
  • Inactive accounts: May be deleted after 12 months
  • Aggregated data: May be retained indefinitely in anonymized form
  • Legal holds: Data retained as required by law

10. Deleting Your Account and Data

You can delete your account yourself, at any time, from Settings → Delete account. No email or support request is required. Deletion is immediate and cannot be undone.

When you delete your account, we:

  • invalidate your active sessions on this site and in the Overwolf overlay;
  • revoke our access and refresh tokens at Riot, ending our access to your account;
  • erase your stored profile, your match records, and every death event we hold for you, including all precomputed heatmaps.

Shared match records are not personal to you and are not deleted, but your link to them and your own events within them are. Anonymized aggregate counts that cannot identify you (for example, total deaths recorded across all users) may be retained.

11. Your Rights and Choices

  • Access Rights: Request a copy of your data in machine-readable format
  • Correction Rights: Request corrections to inaccurate information
  • Deletion Rights: Delete your account and data yourself at any time (see section 10), or contact us
  • Portability Rights: Receive your data in a structured, commonly used format
  • Objection Rights: Object to certain processing activities
  • Restriction Rights: Request processing restrictions in certain circumstances
  • Public visibility: Your profile is private by default. It is shown publicly only if you opt in, and you can withdraw that consent at any time in Settings

12. Regional Privacy Rights

10.1 California Residents (CCPA)

  • Right to know categories of data collected
  • Right to know data sale/disclosure practices
  • Right to opt-out of data sales (we don't sell data)
  • Right to non-discrimination

10.2 EU/EEA Residents (GDPR)

  • Right to lodge complaints with supervisory authorities
  • Right to withdraw consent
  • Rights related to automated decision-making

10.3 Nevada Residents

Right to opt-out of sale of personal information (we don't sell data)

13. Children's Privacy

We don't knowingly collect data from users under 13. If discovered, such data will be promptly deleted.

14. International Data Transfers

Your data may be processed in United States of America. We ensure appropriate safeguards for international transfers.

15. Third-Party Services

  • Riot Games API: Subject to Riot's Privacy Policy
  • Overwolf (if applicable): Subject to Overwolf's Privacy Policy
  • Payment Processors (if applicable): We don't store payment info; processors handle this under their policies

16. Do Not Track Signals

We currently don't respond to browser Do Not Track signals.

17. Updates to Privacy Policy

We'll notify you of material changes via:

  • Prominent website notice
  • Update to "Last Updated" date

18. Data Protection Officer

For privacy inquiries:

Email: support@heatmapper.online
Subject Line: "Privacy Inquiry"

19. Complaints

You may lodge complaints with your local data protection authority if you believe we've violated your privacy rights.

20. Contact Information

General Inquiries: support@heatmapper.online