Privacy Policy

How KDX.GG collects, uses, stores and protects personal data, and the choices available to you.

Last updated 1 September 2026.

1. Introduction

Please read this Privacy Policy carefully. It describes our processing activities and your choices; it does not ask you to consent to every use of personal data described below.

KDX.gg (“KDX.gg”, “we”, “us”, or the “Service”) is committed to respecting and protecting the privacy of users who access and use our website and services.

This Privacy Policy explains how we collect, use, store, and protect personal data, and outlines your rights under applicable data protection laws, including the General Data Protection Regulation (GDPR).

This Privacy Policy applies to all users of KDX.gg, including free users and any future Premium users.

For questions regarding this Privacy Policy, contact us at: contact@kdx.gg

2. Who We Are (Data Controller)

KDX.gg operates as a service based in Germany and provides analytics, statistics, and tooling for the game League of Legends.

For the purposes of the GDPR, KDX.gg is the data controller for all personal data processed through the Service.

3. Principles We Apply

We process personal data according to the following principles:

3.1 Lawfulness, Fairness, and Transparency

Personal data is processed lawfully, fairly, and transparently.

3.2 Purpose Limitation

Data is collected only for explicit, legitimate purposes related to operating and improving the Service.

3.3 Data Minimization

We collect only data that is necessary for the stated purposes.

3.4 Accuracy

We take reasonable steps to ensure data accuracy and allow users to update or delete their data.

3.5 Storage Limitation

Personal data is retained only for as long as necessary.

3.6 Integrity and Confidentiality

Appropriate technical and organizational measures are applied to protect personal data.

4. How We Collect Your Data

We collect personal data through:

  • Direct user input (account creation, settings, Guides, Builds)
  • Riot Games authentication (Riot Sign-On, where enabled)
  • Riot Games APIs (match, summoner, account, champion APIs)
  • Automatic technical collection (cookies or browser storage, request logs, IP address, device and browser information)
  • Third-party service providers acting as processors

5. What Personal Data We Collect

Depending on usage, we may process:

  • IP address and technical logs
  • Riot identifiers (Riot ID, summoner name, account identifiers)
  • Usernames and public profile data
  • Guides, Builds, and other user-submitted content
  • Preferences, recent searches, layouts, and pinned content stored in your browser
  • Advertising consent signals and, where advertising is enabled, identifiers and ad interaction data processed by Google
  • Payment-related metadata (processed by third parties only)

We do not store passwords or full payment card details.

6. User-Generated Content (Guides & Builds)

6.1 Ownership

Users retain full ownership of all Guides, Builds, and custom content they create.

KDX.gg does not claim ownership over this content.

6.2 Purpose of Processing

Guides, Builds, and related content are stored and displayed in order to:

  • Showcase community knowledge
  • Improve gameplay understanding
  • Help optimize League of Legends gameplay for all users

6.3 Display and Attribution

User-generated content may be displayed publicly on KDX.gg.

The creator’s username and a link to their profile will always be visible.

6.4 Deletion Rights

Users may delete Guides, Builds, and their entire KDX.gg account at any time.

Upon deletion, this content will be removed from public display within a reasonable technical timeframe.

6.5 Public Riot Data Disclaimer

Certain Riot Games data (such as summoner names or match data) is publicly accessible by design via Riot Games services.

KDX.gg cannot restrict or delete Riot Games data that is publicly available through Riot’s ecosystem.

However, all custom content and KDX.gg account data can be deleted at any time.

7. Legal Bases for Processing (Article 6 GDPR)

We process personal data based on the following legal grounds:

  • Consent (Art. 6(1)(a))
    – Optional analytics, advertising, and other consent-controlled technologies
  • Performance of a contract (Art. 6(1)(b))
    – Account functionality, future Premium access
  • Legal obligation (Art. 6(1)(c))
    – Compliance with applicable laws
  • Legitimate interests (Art. 6(1)(f))
    – Service operation, user-requested preferences, fraud prevention, security, and improvement, balanced against your rights

8. Cookies, Browser Storage, Analytics, and Advertising

“Cookies” below also includes similar browser technologies such as local storage. Not every use is optional: storage that is strictly necessary to secure the Service, keep a session, remember a privacy decision, or carry out a feature you request may be used without optional consent.

8.1 Necessary and Requested Functionality

This includes authentication and security data, short-lived routing or profile hints, and the local record of your privacy choices. These technologies are not used to build an advertising profile.

8.2 Preferences

KDX initializes theme and language values on first load and currently stores those functional defaults in your browser even before you use the optional-preferences control. When you select a different theme, language, layout, pinned item, recent search, or another convenience feature, KDX may also store that choice locally. Some preference cookies can remain for up to one year; local-storage entries normally remain until you change the feature or clear site data. These current functional defaults and storage necessary to perform a setting you explicitly request are not gated by the optional-preferences switch.

8.3 Analytics and Operational Logs

KDX does not currently load a separate optional audience-analytics tag from its application code. The analytics preference is reserved for a future consent-gated application integration.

Cloudflare Browser Insights / Web Analytics, if enabled in the production Cloudflare configuration, may be injected at the edge rather than appearing in the application source. It can send page-load and performance measurements together with ordinary request or device metadata to Cloudflare. KDX treats enabled edge telemetry as operational performance measurement under its legitimate interests. The KDX analytics switch cannot suppress a dashboard-injected beacon.

8.4 Google AdSense

To initialize Google's Privacy & Messaging consent service, your browser may first contact Google to fetch the AdSense library while ad requests are paused. That download provides Google with ordinary request data such as your IP address and browser or device information. If advertising is then permitted, Google AdSense may additionally process advertising identifiers, consent signals, and information about ad delivery or interaction. Depending on the applicable signal, Google may serve personalized or non-personalized ads. Non-personalized ads can still use data for frequency capping, aggregated reporting, security, and contextual ad delivery.

When Google's Privacy & Messaging CMP is configured, KDX may load the AdSense library with ad requests explicitly paused so Google's consent message can initialize. No ad request is sent until the separately configured Google-certified CMP provides a ready, valid IAB Transparency & Consent Framework 2.3 signal and a resolved U.S. privacy signal. Google remains responsible for interpreting the complete consent strings and selecting personalized or non-personalized treatment. If ordinary ad authorization is unavailable, KDX does not request a limited ad as a fallback. The KDX cookie-preferences panel is not itself a certified CMP: its advertising switch is only an additional KDX-level block and cannot grant or change TCF or GPP consent. This CMP step applies where Google requires it, including the EEA, United Kingdom, and Switzerland.

Learn more in Google's explanation of how it uses information from partner sites .

8.5 U.S. Privacy Signals

Where a supported U.S. state privacy law applies, Google's message and Global Privacy Platform (GPP) signal can record a sale, sharing, or targeted-advertising opt-out. KDX also reads an enabled browser Global Privacy Control (GPC) signal. A recognized opt-out or GPC signal forces restricted data processing for any permitted request; an unknown, changing, or failed signal keeps ad requests paused. Google's message supplies the applicable “Do not sell or share my personal information” control.

8.6 Your Controls

Use the persistent “Cookie preferences” link available on KDX to revise optional KDX choices at any time. When Google's certified CMP applies, that panel also provides a “Review Google privacy and cookie settings” control that reopens Google's message; use Google's message to grant, refuse, or revoke the authoritative TCF advertising choice. Turning off KDX's separate advertising override blocks future AdSense requests but does not change the TCF record. Withdrawing a choice does not undo earlier lawful processing or automatically remove browser data that already exists.

You can also delete existing cookies and local storage through your browser controls. Blocking necessary storage may sign you out or prevent requested features from working.

8.7 Tag-Free Policy Page

This Privacy Policy is delivered as a Google-advertising-tag-free document. Navigating here from another KDX page starts a fresh document so an advertising script loaded on a previous page is not carried into this page.

9. Third-Party Recipients

Depending on the feature you use, recipients may include:

  • Cloudflare , which provides hosting, content delivery, DNS, traffic protection, browser performance measurement, and related infrastructure and may process IP addresses, request/device metadata, performance telemetry, and security logs. Its browser beacon can be injected at the edge as described in Section 8. See the Cloudflare Privacy Policy .
  • Google , as an independent recipient when the paused AdSense library loads to initialize Privacy & Messaging and, only when the controls in Section 8 permit it, for an AdSense ad request. See Google's Privacy Policy .
  • Riot Games , for Riot authentication, public game data, and official Data Dragon assets where the relevant feature is used. See the Riot Games Privacy Notice .
  • Stripe , which hosts checkout and billing-management pages and processes payment, contact, transaction, fraud-prevention, and subscription information when you purchase Premium. KDX receives transaction and subscription identifiers and statuses, but not full payment-card details. See the Stripe Privacy Policy .
  • Adobe Fonts / Typekit and FlagCDN , which deliver fonts and flag images requested directly by your browser and receive ordinary request information such as your IP address and user agent.
  • External game-data and asset delivery services, including CommunityDragon, when your browser directly requests content from them. Those services likewise receive ordinary request information such as your IP address and user agent.

A provider's role may be processor, joint controller, or independent controller depending on the service and applicable law. We do not describe every independent provider as our processor where that would be inaccurate.

10. International Data Transfers

Cloudflare, Google, Riot Games, and other providers may process data outside the European Union / EEA, including in the United States.

Where applicable, such transfers are safeguarded by:

  • EU adequacy decisions, or
  • Standard Contractual Clauses (SCCs) approved by the European Commission

11. Data Retention

Retention depends on the data and purpose:

  • Privacy choices: until you replace the choice or clear KDX site data
  • Preference data in your browser: until you change the feature, the stated cookie lifetime expires, or you clear site data
  • Operational and security logs: only for the period reasonably needed for delivery, diagnostics, security, and applicable legal requirements; provider-controlled copies follow the provider's retention settings
  • Account and user-generated content: while the account remains active
  • Legal or dispute-related data: as required by law

Google and other independent recipients apply their own published retention rules. Deleted accounts are removed unless legal retention or the resolution of a dispute is required.

12. Your Rights Under the GDPR

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request deletion of your data
  • Restrict or object to processing
  • Request data portability
  • Withdraw consent at any time (without affecting prior processing)
  • Lodge a complaint with a supervisory authority

Requests can be sent to: contact@kdx.gg

For security reasons, identity verification may be required.

13. Supervisory Authority

The competent supervisory authority is:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)

or your local German state data protection authority.

14. Automated Decision-Making

KDX.gg does not engage in automated decision-making or profiling within the meaning of Article 22 GDPR that produces legal or similarly significant effects.

15. Children and Minors

KDX.gg is not directed at children under the age permitted to play Riot Games titles.

We do not knowingly collect personal data from children in violation of applicable laws or Riot Games policies.

16. Premium Features and Payments

KDX.gg offers paid monthly, yearly, and flexible monthly or yearly Premium subscriptions through Stripe-hosted Checkout.

We associate Stripe customer and subscription identifiers, payment or subscription status, selected billing interval and amount, and entitlement state with the relevant KDX account. Stripe processes payment-method and transaction information as described in Section 9.

17. Security Measures

We implement appropriate technical and organizational measures, including:

  • Restricted access controls
  • Secure hosting environments
  • Authentication mechanisms
  • Continuous monitoring

While no system is perfectly secure, we continuously improve safeguards.

18. External Links and Third-Party Services

KDX.gg may contain links to third-party services.

We are not responsible for the privacy practices of external websites.

Users should review third-party privacy policies separately.

19. Changes to This Privacy Policy

We may update this Privacy Policy due to legal, technical, or operational changes.

Updates will be published on this page with a revised “Last Updated” date.

20. Contact

For questions or data protection requests, contact:

contact@kdx.gg