Nerfplz.LoL
Privacy Policy
Updated August 19, 2026This page explains what nerfplz.com collects while you read it, which companies receive that data, and what you can do about it. We've written it in plain English rather than in the language of a template.
Who we are
Nerfplz.LoL is an independent League of Legends site. It's run by one person, hosted on Blogger, and served through Cloudflare. We're the data controller for everything described here.
You can reach us about anything on this page, including a request to see or delete your data, at [email protected].
What this policy covers
It covers nerfplz.com and every subdomain we operate, whether or not that subdomain is named here. Today that means two places:
- www.nerfplz.com, the blog itself: every post, guide, tier list, hub page and archive page.
- data.nerfplz.com, the Nerfplz Data statistics tool, which gets its own section further down.
If we add another subdomain later, this policy applies to it from the day it goes up, and we'll add it to that list. It doesn't cover other sites we link to, and it doesn't cover what Riot Games does inside the game client.
The short version
- You can read the entire site without telling us who you are. There are no accounts, no logins, no newsletter, and nothing for sale.
- Ads pay for the site. Our advertising partners set cookies and receive your IP address so they can choose and measure ads.
- We count visits with two analytics tools. We look at totals, not at individuals.
- Comments run on Disqus, which is a separate company with its own accounts and its own policy.
- If you're in the UK or the EEA, nothing beyond what the blog needs to function loads until you agree in the consent banner.
- Wherever you live, the Your Privacy Choices link at the bottom of any page lets you switch analytics and comments off.
- If you're in California or several other US states, our ad setup counts as a sale or share of personal information, and you can opt out.
- We never sell your data for money, and we don't build our own profile of you.
What we collect and why
Technical data every website receives
When your browser asks for a page, it sends an IP address, a user agent string describing the browser and operating system, the address of the page you asked for, and the page that sent you. Blogger, which hosts the site, and Cloudflare, which delivers and protects it, both process that data to serve pages and to block abuse. We don't run our own web servers and we don't keep our own copy of those logs.
In the UK and EEA we rely on our legitimate interest in delivering and securing the site for this, and the cookies involved are the strictly necessary kind.
Analytics
We use Google Analytics 4 and StatCounter to count visits, see which posts get read, and see where readers arrive from. Both set their own cookies and both receive your IP address. We use them for totals: how many people read the tier list this week, which guide people leave fastest. We don't try to work out who you are, and we don't upload any list of people to either tool.
In the UK and EEA these load only after you agree in the consent banner.
Advertising
NitroPay sells and fills the ad slots on the site, and the advertisers who bid on those slots are separate companies. They can receive your IP address, your browser and device details, the address of the page you're on, and advertising or cookie identifiers stored in your browser. Some of them use that to build interest profiles and to measure whether an ad worked.
In the UK and EEA, ad cookies load only after you agree in the consent banner. In the United States, see the California and other state sections below for how to opt out.
Comments
Comments run on Disqus, which loads on post pages. Disqus is an independent controller of the data it collects, not a service acting on our instructions. It sets its own cookies, receives your IP address, and holds whatever your Disqus account contains, such as the display name, email address and avatar you gave it. Anything you type into a comment is public. Their privacy policy governs that account, and we can only delete comments, not the account behind them.
What you send us directly
If you email us, we keep the message and your address for as long as we need them to deal with what you wrote about, and no longer.
What we don't collect
We don't operate accounts or passwords. We don't take payments, so we never see card or bank details. We don't run a mailing list. We don't collect precise location, and we don't collect any of the categories the law treats as sensitive: health, biometrics, race, religion, politics, sexual orientation, union membership, government identifiers, or the contents of your messages.
Services that receive data
| Service | What it does | What it receives | Cookies and consent |
|---|---|---|---|
| Blogger (Google) | Hosts the site and serves every page | IP address, browser details, requested page | Strictly necessary, no consent required |
| Cloudflare | Delivery network, security filtering, image resizing | IP address, browser details, requested page | Strictly necessary, no consent required |
| Google Analytics 4 | Counts visits and measures which posts get read | IP address, a cookie identifier, pages viewed, device type, approximate location | Consent required in the UK and EEA |
| StatCounter | Second visit counter, used for daily traffic checks | IP address, a cookie identifier, pages viewed, referring page | Consent required in the UK and EEA |
| NitroPay and its advertising partners | Fills, targets and measures the ad slots | IP address, browser and device details, page address, advertising and cookie identifiers | Consent required in the UK and EEA, opt out available in US states |
| Disqus | Runs the comment threads | IP address, a cookie identifier, and your Disqus account details if you have one | Consent required in the UK and EEA |
That's the full list. If it isn't in this table, it isn't running on the site.
What runs on data.nerfplz.com
The statistics tool is quieter than the blog. It carries no advertising at all, so none of the advertising partners above receive anything from it, and it runs no comment system. It counts visits with the same two analytics tools. There's no banner and no choices panel on that subdomain: instead, analytics there start switched off for visitors in the UK and EEA and stay off.
Cookies, and how to turn them off
Cookies are small files a site or its partners store in your browser. Ours fall into three groups: the ones the site needs to work and to stay online, the ones that count visits, and the ones that select and measure ads.
If you're in the UK, the EEA, or anywhere else that requires it, a banner appears on your first visit to the blog and nothing outside the first group loads until you choose.
You don't have to be in one of those places to have a say. Wherever you live, this opens a panel where you can switch analytics and comments off. We store that choice in your browser and apply it on every later visit:
We honor the Global Privacy Control signal. If your browser or extension sends it, we treat it as an opt out of the sale and sharing of your personal information, and as an opt out of targeted advertising, for that browser.
You can also block or delete cookies in your browser settings, which works on every site rather than just this one. Blocking everything is fine for reading the site, though comments and a few embedded elements may stop loading.
How long data is kept
- Server and security logs: held by Blogger and Cloudflare under their own retention schedules. We don't hold a copy.
- Google Analytics 4: user and event level data is deleted automatically after 14 months. Aggregate reporting totals remain.
- StatCounter: visit logs are held under the retention setting on our account and roll off as newer visits arrive.
- Advertising data: held by NitroPay and its partners under their own schedules. We don't receive or store it.
- Comments: kept by Disqus until you or we delete them.
- Emails you send us: kept while we need them to deal with your message.
- League of Legends match data: roughly the last ten game patches, then replaced.
Where your data goes
We're based in the United States, and so are most of the services above, so data about your visit is processed there. For transfers out of the UK and EEA, Google and Cloudflare are certified under the EU-US Data Privacy Framework and its UK extension, and our other providers rely on the European Commission's standard contractual clauses.
We don't sell your personal information for money, and we don't hand it to anyone outside the services listed above, except where a law, court order or valid legal request requires it, or where we need to investigate abuse of the site.
League of Legends match data
The Nerfplz Data tool at data.nerfplz.com publishes statistics built from public ranked match records retrieved through the official Riot Games API. That information describes matches and champions rather than visitors to this site, and we never combine it with the log, analytics or advertising data described above.
We don't store player names, summoner names or Riot account identifiers in readable form. Where we need to count how many distinct players used a particular pick, we keep the player identifier only as a salted one-way hash. We don't display it, we don't attempt to reverse it, and we don't use any of this data for advertising, profiling or marketing.
Nerfplz Data isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games and all associated properties are trademarks or registered trademarks of Riot Games, Inc.
Amazon Associates
Nerfplz.com takes part in the Amazon Services LLC Associates Program, an affiliate advertising program that lets sites earn fees by linking to amazon.com. If you follow one of those links, Amazon knows you arrived from here, and what you do on Amazon is covered by Amazon's own privacy notice rather than this one.
Your privacy rights
If you're in the UK or the EEA
Under the UK GDPR and the EU GDPR you can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to processing we base on legitimate interest, and where we rely on your consent you can withdraw it at any time using the Your Privacy Choices link above. Withdrawing consent doesn't undo what happened before you withdrew it.
We rely on two legal bases. Consent covers advertising, analytics and comment cookies. Legitimate interest covers the technical data needed to deliver the site, keep it online, and deal with abuse.
We don't make automated decisions that produce legal effects about you. Our advertising partners do profile browsers to pick ads, which is why those cookies sit behind consent.
To use any of these rights, email [email protected]. We'll answer within one month. If you're unhappy with how we handled it, you can complain to your national data protection authority, or to the Information Commissioner's Office in the UK.
If you're in California
This section supplements the rest of the policy and applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act.
What we collect, and what leaves the site for advertising. Over the last twelve months we've collected the categories marked below, all of it from you directly, from your device as you browse, and from the analytics and advertising providers listed earlier. We collect it for the purposes described throughout this policy: running the site, measuring how it's read, showing ads, and keeping it secure.
| Category | Collected | Sold or shared for advertising |
|---|---|---|
| A. Identifiers, such as IP address, cookie and device identifiers | Yes | Yes |
| B. Customer records under Cal. Civ. Code 1798.80(e), such as a name or email address | Yes, only when you email us or comment | No |
| C. Protected classification characteristics | No | No |
| D. Commercial information, such as purchase records | No | No |
| E. Biometric information | No | No |
| F. Internet or other network activity, such as pages viewed and referring pages | Yes | Yes |
| G. Geolocation data, approximate only, derived from IP address | Yes | Yes |
| H. Audio, video and similar sensory data | No | No |
| I. Professional or employment information | No | No |
| J. Inferences drawn to build an interest profile | Yes, by our advertising partners | Yes |
| K. Sensitive personal information | No | No |
About the word "sale". Nobody pays us for your personal information, and we've never handed anyone a file of it. But California law defines a sale and a share broadly enough that letting advertising partners read cookie identifiers and IP addresses on our pages, so they can target and measure ads across sites, counts as both. We'd rather tell you that plainly than argue the point, so we treat it as a sale and a share and give you the opt out.
Your rights. As a California resident you can ask us to tell you what personal information we collected about you and where it came from, hand you a copy in a portable form, delete it, or correct it if it's wrong. You can opt out of the sale and sharing described above, and we won't treat you any differently for using any of these rights. We don't collect sensitive personal information, so there's nothing for a request to limit its use to act on.
Opting out. Use the Your Privacy Choices link above, or the opt out link here, and we'll pass the signal to our advertising partners. A Global Privacy Control signal from your browser does the same thing without you having to ask.
Making a request. Email [email protected] and describe what you want. We'll respond within 45 days, and we'll tell you if we need a further 45. You can make an access or portability request twice in twelve months. An authorized agent can act for you, and a parent or guardian can act for a child.
How we verify a request. This is the awkward part, and it's worth being honest about it. Because we run no accounts, almost everything described here reaches us as a cookie identifier or an IP address that we can't connect to a name. If you ask us to identify what we hold about you personally, we usually can't, and the law lets us say so rather than guess. Where a request is about a comment or an email you sent us, we can verify it from that thread, and we will.
Anyone under 16. We don't knowingly sell or share the personal information of anyone under 16. If you believe a child's information reached one of our advertising partners through this site, email us and we'll have it removed.
If you're in another US state
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing list of other states give residents broadly similar rights: to confirm what we hold, get a copy, correct it, delete it, and opt out of targeted advertising and of the sale of personal information. Use the same address and the same opt out link, and we'll treat your request the same way we'd treat a California one.
If we turn a request down, you can appeal it by replying to our response and saying so. We'll review the appeal and write back within 45 days explaining what we decided and why. If we deny the appeal, your state attorney general can hear a complaint about it.
Everywhere else
If you live somewhere that gives you none of these rights, ask anyway. We'll do the same thing we'd do for a reader in London or Sacramento.
Children
This site is written for people who play League of Legends, and it isn't directed at children under 13. We don't knowingly collect personal information from them. If you're a parent or guardian and you think a child gave us something, email us and we'll delete it.
Security
The site runs over HTTPS everywhere and sits behind Cloudflare, and it holds no reader accounts, no passwords and no payment details, which removes most of what an attacker would come here for. We keep the accounts that can publish to it locked down. No site can promise perfect security, and we won't pretend otherwise.
Links to other sites
We link to Riot's own pages, to the League wiki, to Amazon, and to plenty of other places. Once you follow a link you're on someone else's site, under their policy, and we don't control what they collect or how they behave.
Changes to this policy
When we change this policy we'll change the date at the top of the page. If a change materially affects what we collect or who receives it, we'll say so on the site rather than quietly editing this page.
Contact
Questions, corrections, or a request to see or delete your data: [email protected].
Last updated August 19, 2026.
