Privacy policy

Using the site without an account

You can use SW Optimizer without an account. Your Summoners War Exporter (SWEX) export, your settings, presets and marks stay in your own browser (see What is kept in your browser). Nothing you load is uploaded to us or to anyone else. The optional Live drops plugin runs on your own computer and only talks to the page on that same computer.

If you create an account

An account is optional. If you create one with an e-mail address, we store:

• your e-mail address, to log you in, send the confirmation and password e-mails and contact you;
• your username, which is shown in the page header and the account menu;
• your password, stored only in scrambled form (a hash) by the login service, never as readable text;
• your plan level (Free or Pro), shown in the account menu;
• your API key for the SW Optimizer plugin. It is stored readable on purpose, so that you can see it again on your profile page. Only you can see it there, and you can replace it at any time;
• the date you became a member.

We use this only to run your account and the features it unlocks. When you log in, your username or e-mail and password pass through our login service on Cloudflare to the login database; we do not keep or log them ourselves. You can change your e-mail address and password on your profile page. Nothing about you is public.

Signing in with Google

If you choose “Continue with Google”, Google confirms who you are and our login service receives the details Google shares for sign-in: your Google account e-mail address and, as the login service stores them in your account record, the name, profile picture link and Google account ID that come with it. We only use your e-mail address. We do not read, show or use the name or the picture. We never get your Google password, and we do not ask for access to your Gmail, Drive or any other Google data.

A Google account has no username yet, so we give it a generated one (for example user_1a2b3c4d) until you choose your own after your first log-in. The same rules as above apply to everything else we store. Google’s own handling of your data is described in Google’s privacy policy.

If you use the contact form

The contact form is optional. If you send a message, we receive what you type: your name (optional), your e-mail address (required, so we can reply), the topic you choose and your message. Nothing about your account or username is added.

The message is sent by e-mail, through Cloudflare, to the mailbox of the person who runs SW Optimizer. It is not stored on the website or in the account database, and our server code does not log it. We use it only to answer you. It stays in the owner’s mailbox for as long as needed to answer you and deal with what follows, and we delete it on request. To stop abuse, the number of messages from one connection is limited; this briefly uses your IP address at Cloudflare, and we keep nothing of it.

What is kept in your browser

SW Optimizer sets no cookies. It uses your browser’s own storage, only for things the site needs to work, and only on your device:

• Browser storage for larger data: your last SWEX export, so you do not have to load it again. Use forget saved data on the start screen to remove it.
• Browser storage for settings: your settings and choices (the page you were on, card view, favourites, preset names, battle conditions, stat edits, PvE and Runes page settings, Live drops settings, presets and sound files, when each rune was first seen) and, if you are logged in, your login session, which keeps you logged in until you log out.

None of this is sent to us. Clearing your browser data removes all of it; you then have to log in again.

Who handles your data

We do not share your data with anyone except the services that run the site for us:

• Supabase runs the login service and the database that hold your account data (servers in the EU, Frankfurt). It also sends the account e-mails (confirmation, password reset, e-mail change).
• Cloudflare hosts the website, runs the small login service in front of the database and delivers the contact form’s e-mails to the owner. Like any host, it sees technical request data such as your IP address and browser type, and keeps standard request logs and security records.
• Google, only if you choose to sign in with Google (see above).

The Live drops plugin is separate: it runs on your own computer, listens only on 127.0.0.1 and sends nothing to us.

What we do not do

• No advertising, no trackers, no analytics and no tracking cookies.
• We do not sell your data and we do not use it to profile you.
• We do not upload, store or look at your game export or your in-game account.
• We do not load scripts, fonts or images from other websites.

How long we keep it

Account data is kept for as long as your account exists. When your account is deleted, your profile, plan level and API key are deleted with it. Technical logs at Cloudflare and Supabase are kept by them for their own, usually short, periods. Contact messages stay in the owner’s mailbox for as long as needed to answer you and are deleted on request. Data in your browser stays until you remove it.

Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• access the data we hold about you (most of it is on your profile page);
• correct it: you can change your e-mail address and your password yourself on the profile page;
• have it deleted: there is no delete button yet, so contact us and we will delete your account and everything linked to it (and any contact messages you sent);
• receive a copy of your data in a common format (data portability), and ask us to restrict or stop using it;
• complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

We use your data to run your account (your agreement with us), to keep the service secure, and, for Google sign-in, because you chose it.

Security

The site is served over HTTPS only. Your password is stored only in scrambled form. The database lets each account see only its own data, and the one key that can look people up is kept on our server, never in the page. No system is perfectly secure, but we take care to keep your data safe and to collect as little of it as we can.

Children

SW Optimizer is not meant for children. Please do not create an account if you are under 16 unless a parent or guardian agrees. If you think a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy when the site changes. The date at the top shows the latest version. The Terms of use are available from the footer of the main page.

Contact

Questions, or a request to see, correct or delete your data: use the contact form, or write to support@sw-optimizer.com. This address forwards to the person who runs SW Optimizer. Please write from the e-mail address of your account so we can find it.