Privacy policy

Last updated 14 October 2026

Arbiter is a free, unofficial fan project, run by one person. In this policy “we” means that person. To ask anything about your data, write to hello@riftarbiter.com.

The short version

• No advertising, no analytics and no cookies.
• You can use all of Arbiter without an account. Your progress then stays in this browser and is never sent to us.
• With an account, we keep your email and your practice progress so they follow you between devices. You can download or delete them at any time in Settings.
• We never sell your data or share it, apart from the services listed below that run Arbiter for us.

What stays in your browser

Whether or not you have an account, Arbiter keeps these in your browser’s storage on this device:

• your practice progress: the questions you have answered, how you did, when each is due again, and the days you practised;
• your pinned rules and your daily goal;
• your theme and the rules date you chose;
• the saved rules, so Arbiter works offline;
• a few notes for itself, such as the newest rules version it has seen (so an older copy cannot replace it) and whether you closed the first-visit note, the notice about new rules or the suggestion to add Arbiter to your Home Screen;
• a report you wrote while offline, until it can be sent;
• if you are signed in, a sign-in token, and changes waiting to be sent to your account.

All of this is needed for Arbiter to work, so there is no consent banner. Clearing this site’s data in your browser removes it.

What your browser fetches

Like any website, each server your browser contacts sees your network (IP) address and your browser’s name. Arbiter’s are:

• The Arbiter server, hosted by Railway, sends the pages. Until the rules are saved on your device it also answers what you open and search for. It keeps no record of what you ask; it counts requests from each network address for one minute, to stop overuse, and then forgets them. Railway keeps its own request logs, which include network addresses.
• The rules download, and the occasional check for newer rules, come from Cloudflare Pages.
• Card pages show the card’s picture from Riot Games’ servers (cmsassets.rgpub.io). Arbiter asks your browser not to tell Riot which page you were on. Links to official documents also open on Riot’s servers.

Once the rules are saved on your device, searching and reading the rules send nothing anywhere. Card pictures still load from Riot’s servers.

If you create an account

We keep:

• your email address, and your password in a scrambled form that cannot be turned back into the password;
• for each question you have answered: how often, how many times correctly, your recent results, when you first and last answered it, and when it is due again;
• the days you practised;
• your pinned rules and when you pinned them;
• your daily goal.

The account service also records when the account was created and when you last signed in.

We use this only to give you the account: the same progress on every device. Other people using Arbiter cannot see any of it. We can reach the database to keep Arbiter working, and we look at an account’s data only when that needs it or when you ask us to.

Account emails (confirming your address, resetting your password) are sent through Mailtrap. We send no other email.

If you report a problem

A report holds:

• what you write;
• the page it is about, and the rules date and rules version you were reading;
• your browser’s name and version;
• a link to your account, if you are signed in;
• your email address, only if you enter one, so we can reply;
• a one-way scrambled form of your network address (or of your account, if you are signed in). It cannot be turned back into the address, and it is used only to limit how many reports one sender can send.

Reports are private: only we can read them. We keep a report until we have dealt with it, and delete it about 90 days after that. Ask at hello@riftarbiter.com and we will delete yours sooner. If you delete your account, your reports stay but no longer link to it.

Services that handle your data

• Supabase: accounts, sign-in and reports.
• Railway: hosts the site and the Arbiter server.
• Cloudflare Pages: hosts the rules download.
• Mailtrap: sends account emails.
• Namecheap: the riftarbiter.com address, and forwarding of email sent to hello@riftarbiter.com.
• Riot Games: card pictures and the official documents.

Each handles data under its own privacy policy. Some of them store or process data in the United States and other countries.

How long we keep it

• Account data: until you delete the account. Deleting it removes the account and all its progress, pinned rules and goal at once.
• Reports: until we have dealt with them, then about 90 days; sooner if you ask.
• What is in your browser: until you clear it. Removing the saved rules is in Settings.
• Service logs: as long as each service keeps them.

Your choices

• Download your data: Settings, “Download my data”.
• Delete your account: Settings, “Delete my account”. It takes effect at once.
• Change your password or sign out: the Account page.
• Anything else, such as a copy or deletion of a report you sent, a correction, or a question: write to hello@riftarbiter.com.

Depending on where you live, you may have further rights, including the right to complain to your data protection authority. We will help with any request we can.

Children

Arbiter is not directed at children under 13. Accounts are for people aged 13 or over (16 or over where local law sets that age for this kind of service). Anyone can use Arbiter without an account, which keeps nothing about them on our side. If you think a child under that age has created an account, write to hello@riftarbiter.com and we will delete it.

Changes

If this policy changes, the new version goes on this page with a new date.