Nerfplz.LoL
Privacy Policy
Updated September 27, 2026This page explains what nerfplz.com collects while you read it, which companies receive that data, and what you can do about it. We've written it in plain English rather than in the language of a template.
Who we are
Nerfplz.LoL is an independent League of Legends site. It's run by one person, hosted on Blogger, and served through Cloudflare. We're the data controller for everything described here.
You can reach us about anything on this page, including a request to see or delete your data, at [email protected].
What this policy covers
It covers nerfplz.com and every subdomain we operate, whether or not that subdomain is named here. Today that means two places:
- www.nerfplz.com, the blog itself: every post, guide, tier list, hub page and archive page.
- data.nerfplz.com, the Nerfplz Data statistics tool, which gets its own section further down.
If we add another subdomain later, this policy applies to it from the day it goes up, and we'll add it to that list. It doesn't cover other sites we link to, and it doesn't cover what Riot Games does inside the game client.
The short version
- You can read the entire site without telling us who you are. The one login is optional: signing in to LoL Trivia with Google or Discord, which stores a display name and your quiz scores and nothing else. If you play the quiz without signing in, your scores are kept against a random guest ID until you sign in or stop playing for 90 days. No newsletter, and nothing for sale.
- Ads pay for the site. Our advertising partners set cookies and receive your IP address so they can choose and measure ads.
- We count visits with two tools: Google Analytics and a small counter of our own. We look at totals and at how readers move between pages, never at who you are.
- Posts and tools end with three reaction buttons and a feedback box. Neither one asks for your name or an email address.
- If you're in the UK or the EEA, nothing is stored in your browser beyond what the blog needs to function until you agree in the consent banner.
- Wherever you live, the Your Privacy Choices link at the bottom of any page lets you switch analytics off.
- If you're in California or several other US states, our ad setup counts as a sale or share of personal information, and you can opt out.
- We never sell your data for money. Our own visit records are tied to a random browser ID, never to a name or an email address.
What we collect and why
Technical data every website receives
When your browser asks for a page, it sends an IP address, a user agent string describing the browser and operating system, the address of the page you asked for, and the page that sent you. Blogger, which hosts the site, and Cloudflare, which delivers and protects it, both process that data to serve pages and to block abuse. We don't run our own web servers and we don't keep our own copy of those logs.
In the UK and EEA we rely on our legitimate interest in delivering and securing the site for this, and the cookies involved are the strictly necessary kind.
Analytics
We use Google Analytics 4 and our own visit counter to count visits, see which posts get read, and see where readers arrive from. Google Analytics sets its own cookies and receives your IP address. We use both for totals: how many people read the tier list this week, which guide people leave fastest. We don't try to work out who you are, and we don't upload any list of people to Google.
Our counter runs on our Cloudflare account, and its records end up on a computer we control. It sets no cookies and never stores your IP address. It notes the page, the page that sent you, your browser, your screen and window size, a few device details (touch support, processor cores, memory, time zone and language), how long the page stayed open and how far you scrolled, and a rough location and network provider (Cloudflare works those two out from the connection). If you use the site search, it also notes the words you searched for, which shows us what readers come looking for and can't find. Once you allow analytics it also keeps a random ID in your browser, so we can tell a returning reader from a new one and see which pages a visit went through. With the same permission it checks whether the ads on the page could load, or whether an ad blocker stopped or hid them, and notes the answer with that page view. We use it to count what share of readers block ads. Nothing on the site changes because of it.
In the UK and EEA, Google Analytics stores nothing until you agree in the consent banner, and our counter writes no ID until then either. Until you answer, it still counts the page view without an ID. To tell readers apart it keeps a code made from your IP address and browser, scrambled with a key that changes every day, so one reader's pages can be grouped within a day but not linked from one day to the next. If you refuse analytics, or switch it off in Your Privacy Choices, the counter stops: all it sends is a note that one page view was declined, with the site's name and the hour, and nothing about you or your device.
Advertising
NitroPay sells and fills the ad slots on the site, and the advertisers who bid on those slots are separate companies. They can receive your IP address, your browser and device details, the address of the page you're on, and advertising or cookie identifiers stored in your browser. Some of them use that to build interest profiles and to measure whether an ad worked.
In the UK and EEA, ad cookies load only after you agree in the consent banner. In the United States, see the California and other state sections below for how to opt out.
Reactions and feedback
The reaction buttons at the bottom of a page send your pick to our own visit counter, along with the details it already records for that page view. We publish only each page's totals. You count once per page and your latest pick is the one that counts. Clicks from visits that look automated aren't counted at all. If you've allowed analytics, your browser also remembers your pick, so the button is still lit when you come back.
The Send feedback box delivers what you type, the page you were on, your browser details and a rough country to a small service on our Cloudflare account. It keeps a scrambled version of your IP address to stop floods (never the address itself). Nothing you send appears on the site, and only we read it. There's no name or email field, which means we can't reply, so please leave personal details out of it.
We used to run Disqus comments here. We removed them on September 27, 2026, and the site no longer loads anything from Disqus. Old threads stay on Disqus's own servers under their policy.
What you send us directly
If you email us, we keep the message and your address for as long as we need them to deal with what you wrote about, and no longer.
What we don't collect
We don't operate accounts or passwords. We don't take payments, so we never see card or bank details. We don't run a mailing list. We don't collect precise location, and we don't collect any of the categories the law treats as sensitive: health, biometrics, race, religion, politics, sexual orientation, union membership, government identifiers, or the contents of your messages.
LoL Trivia sign-in
The trivia quiz at nerfplz.com/lol-trivia has an optional leaderboard. To join it you sign in with Google or Discord. We ask those services only to confirm who you are, and we ask each for the least it will give. From Google we request an account identifier and nothing else: not your name, not your email address. Discord has no equivalent minimum, so its narrowest permission hands back a username along with the account identifier; we read only the identifier and never store the username. Your account starts under an automatic name such as Summoner12345, which you can change on your profile page, so no name from Google or Discord is ever shown on this site. We store that display name, the provider's account identifier, and your quiz totals per difficulty. Nothing else is collected, no password exists, and the display name and scores appear on the public leaderboard.
Signing in sets one strictly necessary cookie that keeps you signed in for 90 days. It is scoped to the trivia service and is not used for advertising or analytics. In the UK and EEA we rely on the contract you enter by choosing to sign in; it never happens without your click.
You don't have to sign in to play. Answering your first question without an account creates a guest record: your quiz scores under a random Summoner name, filed against a random identifier. There's no real name or email in it, and no link to a Google or Discord account. A strictly necessary cookie, scoped to the trivia service the same way, ties your browser to that record for up to a year. Guest scores show on the public leaderboard under that Summoner name. Sign in later from the same browser and they move to your account. If you stop playing for 90 days, the guest record is deleted automatically.
Services that receive data
| Service | What it does | What it receives | Cookies and consent |
|---|---|---|---|
| Blogger (Google) | Hosts the site and serves every page | IP address, browser details, requested page | Strictly necessary, no consent required |
| Cloudflare | Delivery network, security filtering, image resizing | IP address, browser details, requested page | Strictly necessary, no consent required |
| Google Sign-In and Discord (optional, LoL Trivia only) | Confirm who you are when you choose to join the trivia leaderboard | That you signed in to nerfplz.com; we receive back an account identifier, plus a username from Discord that we discard | Strictly necessary, only after you click sign in |
| Google Analytics 4 | Counts visits and measures which posts get read | IP address, a cookie identifier, pages viewed, device type, approximate location | Consent required in the UK and EEA |
| Our own visit counter | Counts visits, shows how readers move between pages, and spots automated traffic | Pages viewed, referring page, browser, screen and window size, basic device details, time on page and scroll depth, words typed into the site search, approximate location and network, a daily scrambled code; a random ID once you allow analytics. No IP address, no cookies. If you refuse analytics, only a count that one page view was declined | The random ID needs consent in the UK and EEA |
| NitroPay and its advertising partners | Fills, targets and measures the ad slots | IP address, browser and device details, page address, advertising and cookie identifiers | Consent required in the UK and EEA, opt out available in US states |
That's the full list. If it isn't in this table, it isn't running on the site.
What runs on data.nerfplz.com
The statistics tool is quieter than the blog. It carries no advertising at all, so none of the advertising partners above receive anything from it, and it has no reaction buttons or feedback box. It counts visits with the same two tools. There's no banner and no choices panel on that subdomain: instead, Google Analytics there starts switched off for visitors in the UK and EEA and stays off, and our own counter never stores an ID there at all.
Cookies, and how to turn them off
Cookies are small files a site or its partners store in your browser. Ours fall into three groups: the ones the site needs to work and to stay online, the ones that count visits, and the ones that select and measure ads.
If you're in the UK, the EEA, or anywhere else that requires it, a banner appears on your first visit to the blog and nothing outside the first group loads until you choose.
You don't have to be in one of those places to have a say. Wherever you live, this opens a panel where you can switch analytics off. We store that choice in your browser and apply it on every later visit:
We honor the Global Privacy Control signal. If your browser or extension sends it, we treat it as an opt out of the sale and sharing of your personal information, and as an opt out of targeted advertising, for that browser.
You can also block or delete cookies in your browser settings, which works on every site rather than just this one. Blocking everything is fine for reading the site, though a few embedded elements may stop loading.
How long data is kept
- Server and security logs: held by Blogger and Cloudflare under their own retention schedules. We don't hold a copy.
- Google Analytics 4: user and event level data is deleted automatically after 14 months. Aggregate reporting totals remain.
- Our own visit counter: kept on our own computer for 14 months, then deleted automatically. Each record spends about a minute in our Cloudflare account on the way there.
- Advertising data: held by NitroPay and its partners under their own schedules. We don't receive or store it.
- Reactions: kept with the visit counter's records for 14 months. After that only each page's totals remain.
- Feedback messages: kept for 12 months, then deleted automatically.
- Emails you send us: kept while we need them to deal with your message.
- League of Legends match data: roughly the last ten game patches, then replaced.
- LoL Trivia account: display name, provider account identifier and scores are kept until you ask us to delete them by email.
- LoL Trivia guest scores: deleted after 90 days without play, or moved to your account when you sign in.
Where your data goes
We're based in the United States, and so are most of the services above, so data about your visit is processed there. For transfers out of the UK and EEA, Google and Cloudflare are certified under the EU-US Data Privacy Framework and its UK extension, and our other providers rely on the European Commission's standard contractual clauses.
We don't sell your personal information for money, and we don't hand it to anyone outside the services listed above, except where a law, court order or valid legal request requires it, or where we need to investigate abuse of the site.
League of Legends match data
The Nerfplz Data tool at data.nerfplz.com publishes statistics built from public ranked match records retrieved through the official Riot Games API. That information describes matches and champions rather than visitors to this site, and we never combine it with the log, analytics or advertising data described above.
We don't store player names, summoner names or Riot account identifiers in readable form. Where we need to count how many distinct players used a particular pick, we keep the player identifier only as a salted one-way hash. We don't display it, we don't attempt to reverse it, and we don't use any of this data for advertising, profiling or marketing.
Nerfplz Data isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games and all associated properties are trademarks or registered trademarks of Riot Games, Inc.
Amazon Associates
Nerfplz.com takes part in the Amazon Services LLC Associates Program, an affiliate advertising program that lets sites earn fees by linking to amazon.com. If you follow one of those links, Amazon knows you arrived from here, and what you do on Amazon is covered by Amazon's own privacy notice rather than this one.
Your privacy rights
If you're in the UK or the EEA
Under the UK GDPR and the EU GDPR you can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to processing we base on legitimate interest, and where we rely on your consent you can withdraw it at any time using the Your Privacy Choices link above. Withdrawing consent doesn't undo what happened before you withdrew it.
We rely on two legal bases. Consent covers advertising and analytics cookies. Legitimate interest covers the technical data needed to deliver the site, keep it online, and deal with abuse, and our own counter's ID-less page counts, which tell us which pages get read and which traffic is bots. It also covers the reactions and feedback you choose to send.
We don't make automated decisions that produce legal effects about you. Our advertising partners do profile browsers to pick ads, which is why those cookies sit behind consent.
To use any of these rights, email [email protected]. We'll answer within one month. If you're unhappy with how we handled it, you can complain to your national data protection authority, or to the Information Commissioner's Office in the UK.
If you're in California
This section supplements the rest of the policy and applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act.
What we collect, and what leaves the site for advertising. Over the last twelve months we've collected the categories marked below, all of it from you directly, from your device as you browse, and from the analytics and advertising providers listed earlier. We collect it for the purposes described throughout this policy: running the site, measuring how it's read, showing ads, and keeping it secure.
| Category | Collected | Sold or shared for advertising |
|---|---|---|
| A. Identifiers, such as IP address, cookie and device identifiers | Yes | Yes |
| B. Customer records under Cal. Civ. Code 1798.80(e), such as a name or email address | Yes, only when you email us | No |
| C. Protected classification characteristics | No | No |
| D. Commercial information, such as purchase records | No | No |
| E. Biometric information | No | No |
| F. Internet or other network activity, such as pages viewed and referring pages | Yes | Yes |
| G. Geolocation data, approximate only, derived from IP address | Yes | Yes |
| H. Audio, video and similar sensory data | No | No |
| I. Professional or employment information | No | No |
| J. Inferences drawn to build an interest profile | Yes, by our advertising partners | Yes |
| K. Sensitive personal information | No | No |
About the word "sale". Nobody pays us for your personal information, and we've never handed anyone a file of it. But California law defines a sale and a share broadly enough that letting advertising partners read cookie identifiers and IP addresses on our pages, so they can target and measure ads across sites, counts as both. We'd rather tell you that plainly than argue the point, so we treat it as a sale and a share and give you the opt out.
Your rights. As a California resident you can ask us to tell you what personal information we collected about you and where it came from, hand you a copy in a portable form, delete it, or correct it if it's wrong. You can opt out of the sale and sharing described above, and we won't treat you any differently for using any of these rights. We don't collect sensitive personal information, so there's nothing for a request to limit its use to act on.
Opting out. Use the Your Privacy Choices link above, or the opt out link here, and we'll pass the signal to our advertising partners. A Global Privacy Control signal from your browser does the same thing without you having to ask.
Making a request. Email [email protected] and describe what you want. We'll respond within 45 days, and we'll tell you if we need a further 45. You can make an access or portability request twice in twelve months. An authorized agent can act for you, and a parent or guardian can act for a child.
How we verify a request. This is the awkward part, and it's worth being honest about it. Because we run no accounts, almost everything described here reaches us as a cookie identifier or an IP address that we can't connect to a name. If you ask us to identify what we hold about you personally, we usually can't, and the law lets us say so rather than guess. Where a request is about an email you sent us, we can verify it from that thread, and we will.
Anyone under 16. We don't knowingly sell or share the personal information of anyone under 16. If you believe a child's information reached one of our advertising partners through this site, email us and we'll have it removed.
If you're in another US state
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing list of other states give residents broadly similar rights: to confirm what we hold, get a copy, correct it, delete it, and opt out of targeted advertising and of the sale of personal information. Use the same address and the same opt out link, and we'll treat your request the same way we'd treat a California one.
If we turn a request down, you can appeal it by replying to our response and saying so. We'll review the appeal and write back within 45 days explaining what we decided and why. If we deny the appeal, your state attorney general can hear a complaint about it.
Everywhere else
If you live somewhere that gives you none of these rights, ask anyway. We'll do the same thing we'd do for a reader in London or Sacramento.
Children
This site is written for people who play League of Legends, and it isn't directed at children under 13. We don't knowingly collect personal information from them. If you're a parent or guardian and you think a child gave us something, email us and we'll delete it.
Security
The site runs over HTTPS everywhere and sits behind Cloudflare, and it holds no reader accounts, no passwords and no payment details, which removes most of what an attacker would come here for. We keep the accounts that can publish to it locked down. No site can promise perfect security, and we won't pretend otherwise.
Links to other sites
We link to Riot's own pages, to the League wiki, to Amazon, and to plenty of other places. Once you follow a link you're on someone else's site, under their policy, and we don't control what they collect or how they behave.
Changes to this policy
When we change this policy we'll change the date at the top of the page. If a change materially affects what we collect or who receives it, we'll say so on the site rather than quietly editing this page.
Contact
Questions, corrections, or a request to see or delete your data: [email protected].
Last updated September 27, 2026.
