Privacy Policy

1. Scope and operator

This Privacy Policy applies to the Riftbot website, card market, accounts, chat, watchlists, and related support interactions (together, the “Service”). Riftbot is an independently operated fan service. It is not affiliated with, endorsed by, or sponsored by Riot Games or the publishers of Riftbound.

The Riftbot operator is responsible for the information described in this policy. Privacy questions and rights requests can be emailed to chase@riftbot.ai.

2. Information we handle

Information you provide or authorize

• Account information: if you sign in with Google, Google provides the name, email address, email-verification status, profile image, provider account identifier, and authorization scope made available through the sign-in flow.
• Chat content: questions and instructions you submit, plus the answers, citations, and conversation context generated for you.
• Watchlists and alerts: starred card identifiers, requested last-sale notifications, and the settings needed to deliver them.
• Feedback and support: helpful or unhelpful ratings, associated trace identifiers, and information you choose to include in a support request.

Google is the only account sign-in method; Riftbot does not collect a Riftbot password. Riftbot does not currently process payments or ask for collection inventory. Do not place sensitive personal information, confidential information, credentials, or private collection details in a chat prompt.

Information collected automatically

• Account and session records: internal user, account, and session identifiers; sign-in provider; session token and expiration; account and session timestamps; IP address; user agent; and provider tokens or token-expiration records returned as part of the authorized Google sign-in flow.
• Pseudonymous chat identity: a random visitor identifier stored in the signed HTTP-only riftbot-visitor cookie. It separates visitors’ threads and supports security and request controls.
• Network and request data: IP address or hosting-provider network identifier, request time, route, browser language and user agent, response status, and security or rate-limit events. A keyed hash may replace a raw network identifier in the rate-limit store.
• Chat identifiers: thread, run, trace, and feedback identifiers used to route requests, maintain conversation state, and diagnose answers.
• Watchlist storage: starred card identifiers are stored locally and mirrored to a first-party cookie for anonymous visitors. When signed in, watchlist items are also associated with the account so they can sync across sessions.
• Optional product analytics: only after you allow analytics, PostHog, Vercel Analytics and GA4 may receive page views, navigation, clicked links, filter selections, market search terms, price range changes, starred card identifiers and names, referring page, browser and device details, and approximate location derived from network information. PostHog uses a pseudonymous analytics identifier and is linked to the internal user identifier after sign-in. Session replay is disabled.
• Affiliate attribution: Riftbot loads an Impact script to prepare eligible affiliate links and record impressions. Impact may process IP address, browser and device information, page and referral information, link interactions, and attribution identifiers. A qualifying action on a linked marketplace may be reported back to the affiliate provider. Riftbot also assigns each eBay outbound click a random identifier and stores its product, destination, page context, and time. EPN reports may associate that identifier with a transaction ID, purchase time, sale amount, commission, currency, and status. Campaign parameters persist with optional consent; Google click IDs require Marketing consent. These records do not require a Riftbot account or signup.

3. How we use information

Riftbot uses the information above to:

• create and authenticate accounts and maintain sessions;
• answer questions and maintain conversation context;
• show, sync, and filter watchlists;
• retrieve requested rules, card, listing, and market information;
• receive answer feedback and diagnose failed or low-quality responses;
• secure the Service, prevent abuse, enforce request limits, and troubleshoot errors;
• operate, maintain, and improve reliability and response quality;
• measure product use when optional analytics are allowed;
• attribute affiliate referrals and qualifying activity to support commissions;
• send market insights news and product updates by email only if you select the optional marketing checkbox when signing in; you can unsubscribe at any time; and
• comply with legal obligations and protect users, the operator, and others.

Where data-protection law requires a lawful basis, processing is based on providing the Service you request, the operator’s legitimate interests in operating and securing the Service, compliance with law, or consent for optional analytics, advertising measurement, and marketing email. You may withdraw each consent at any time for future processing.

4. AI processing and service providers

Chat content and necessary conversation context are sent to OpenRouter, which routes the request to the model provider configured for Riftbot. Those providers process the content to generate an answer. Their retention, abuse-monitoring, and data-location practices may apply. Avoid submitting information you would not want processed by an external AI provider.

Information may also be processed by providers supporting these functions:

• Google for account authentication and the profile fields you authorize;
• Google Ads only after separate advertising measurement consent, including page visits, ad attribution, eBay outbound clicks without purchase value, and completed sign-ups with a nominal USD 1 value and a random event identifier to prevent duplicates. For affiliate clicks recorded with Marketing enabled, Riftbot may later send the matched Google click ID, purchase timestamp, earned EPN commission, currency and transaction ID to Google Ads as a separate purchase conversion. Gross merchandise value is not the conversion value. GA4 receives the distinct outbound click event only with Analytics enabled. Ad personalization remains disabled. Withdrawal sends a denied consent update; an already-loaded tag may send cookieless consent signals until the page closes. See Google’s Privacy Policy.
• Vercel for website hosting and, only with consent, web analytics;
• Supabase for authentication, session management, and PostgreSQL storage of account, watchlist, notification, and application data;
• Supabase PostgreSQL for conversation checkpoints and abuse-prevention rate limits;
• eBay and linked marketplaces for requested market data; EPN for affiliate click and transaction reporting;
• optional LangSmith diagnostics and feedback. When enabled, Riftbot hides raw trace inputs and outputs and redacts sensitive metadata before transmission; answer ratings and operational trace metadata may still be processed;
• PostHog, only with consent, for pseudonymous traffic, navigation, and interaction measurement.
• Discord for internal affiliate-click notifications sent through PostHog, only with analytics consent. These include your internal user ID (or pseudonymous guest ID), the clicked product and sale or listing type, the link, and approximate country.
• Impact for affiliate link preparation and attribution, independently of optional product analytics. Its Privacy Policy describes its processing, cookies, retention, and privacy-request process.

Offline services such as Firecrawl collect public Riftbound source material and are not used to collect information from your browser. Providers may process information in countries other than your own. Where required, the operator relies on appropriate contractual or other lawful transfer safeguards.

5. Cookies, local storage, and privacy choices

Riftbot uses necessary cookies and local storage for chat identity, sign-in, watchlists, onboarding, security, remembering your privacy choice, and carrying your optional marketing choice through Google sign-in. Optional PostHog, Vercel Analytics and GA4 remain off unless you allow analytics. Google Ads requires a separate advertising measurement choice; previous analytics acceptance does not grant advertising consent.

The Cookie Notice lists each technology, purpose, and typical duration. You can review privacy choices at any time. These separate choices control product analytics and Google Ads measurement, not affiliate links or the Impact integration, which loads on page visits. Affiliate providers and linked marketplaces may use their own attribution cookies or similar technologies. Riftbot does not use session replay. Declining Marketing removes the browser's stored Google click ID and stops attribution of new outbound clicks to Google Ads. Existing click and transaction records retain the choice in effect at the click and may still be reconciled later. To request deletion of existing records, contact the operator using the privacy-request details below.

6. When information is disclosed

Information may be disclosed:

• to the service providers described above, only as needed to perform their work;
• when required by law, legal process, or a valid government request;
• to investigate abuse, fraud, security threats, or violations of the Terms;
• to protect the rights, safety, or property of users, the operator, or others; or
• as part of a reorganization, financing, sale, or transfer of the Service, subject to appropriate confidentiality protections.

Riftbot does not sell personal information for money and does not share personal information for cross-context behavioral advertising.

7. Retention

• Account and provider-link records remain while the account is active. Supabase session cookies expire within seven days and are renewed while the session is active or removed on sign-out. Server-side authentication records follow the configured session and retention settings.
• Signed-in watchlists remain until you remove them or request account deletion.
• The visitor and anonymous-watchlist cookies expire after no more than one year. Local watchlist, onboarding, import, and privacy-choice records remain until changed or cleared. The temporary marketing-choice cookie is removed when the sign-in callback runs or expires after ten minutes.
• Conversation checkpoints and associated identifiers are retained for thread continuity, security, and failure investigation. Riftbot does not currently provide a fixed automated deletion schedule for this data.
• Rate-limit records are short-lived operational records tied to the request window. Security logs may be kept longer where needed to investigate abuse.
• Optional analytics and advertising measurement continue until their respective consent is withdrawn, browser storage is cleared, or the records are no longer needed. Provider copies follow applicable provider settings and terms.

Data may be kept longer when required by law, needed to resolve a dispute, or reasonably necessary to protect the Service. It is deleted or de-identified when no longer needed, subject to backups and technical limitations.

8. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, information about disclosures, or an appeal of a denied request. You may also have the right to complain to a local data-protection authority. Riftbot will not discriminate against you for exercising an applicable right.

Email chase@riftbot.ai to make a request, close an account, or request deletion. A signed-in user may be asked to verify control of the account email. For anonymous chat records, include the approximate interaction date and enough non-sensitive detail to locate the record; because those records intentionally limit direct identifiers, Riftbot may be unable to connect a record to you without adequate verification.

You can unsubscribe from marketing email using the link in any such email or by emailing chase@riftbot.ai. You can remove cards in the Service, revoke Google access through your Google account, clear Riftbot browser storage, or stop chat processing by not submitting a message. You can also change privacy choices. Browser “Do Not Track” signals do not otherwise change the Service because Riftbot does not perform cross-site behavioral tracking.

9. International transfers

Riftbot and its providers may process information in the United States and other countries whose privacy laws may differ from those where you live. Where applicable law requires a transfer mechanism, the operator relies on contractual safeguards, adequacy decisions, or another legally recognized mechanism.

10. Security

Riftbot uses measures designed to reduce risk, including OAuth sign-in, signed HTTP-only cookies, access controls, request limits, diagnostic redaction, and omission of image data from stored conversation checkpoints. No internet service is completely secure, and the operator cannot guarantee information will never be accessed, lost, or misused.

11. Children

The Service is not directed to children under 13, and the operator does not knowingly collect personal information from a child under 13. If you believe a child has submitted personal information, contact the operator so it can be reviewed and, where appropriate, deleted. Users under the age of legal majority where they live should use the Service only with permission from a parent or legal guardian.

12. Third-party sites

Riftbot links to official sources, marketplaces, GitHub, and other third-party services. Their privacy practices are governed by their own policies. A link or citation does not make Riftbot responsible for a third party’s content or practices.

13. Changes to this policy

This policy may be updated when the Service, providers, or legal requirements change. The “Last updated” date will change when revisions are posted. Material changes may also be highlighted in the Service when reasonably practical.

Related information appears in the Cookie Notice and Terms and Conditions.