Privacy Policy

Effective date: June 24, 2026

This Privacy Policy explains how TFTraits.com (“we”, “us”, “the site”) handles information when you visit it, and your rights under the EU General Data Protection Regulation (GDPR) and Finnish data-protection law. We have built the site to be privacy-friendly: we use no advertising, no cross-site tracking, and no third-party analytics cookies. We process only the minimal data needed to operate the site securely.

1. Data Controller

The controller responsible for your personal data is:

Codekatu Oy
Business ID: 3222614-3
Email: [email protected]
Website: https://tftraits.com

For any privacy-related question or to exercise your rights (see section 8), contact us at the email above.

2. Summary

• We do not show advertising and do not use advertising or cross-site tracking cookies.
• We use a privacy-friendly, cookieless analytics service to count visits — it does not profile you or follow you across other websites.
• We briefly process your IP address to deliver the site and to protect it from abuse (rate-limiting and security).
• Your saved and recent searches are stored only in your own browser, on your device — they are never sent to or stored by us.
• We do not sell your data, and we do not knowingly collect data from children.

3. What We Process, Why, and Our Legal Basis

a) Technical data and IP addresses

Like any website, our servers and our security/CDN provider (Cloudflare — see section 4) need to receive your IP address and basic technical request data (such as browser type, requested page, and timestamp) in order to deliver pages to you. We also use your IP address to enforce rate limits on the search feature and to block abusive traffic, so the free service stays available to everyone.

Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in operating, securing, and protecting the site against abuse and denial-of-service. Retention: rate-limiting counters tied to an IP expire automatically within a short window (typically within one hour; a temporary block of an abusive IP lasts up to two hours). We do not build long-term profiles from IP addresses.

b) Cookieless usage analytics

We use Cloudflare Web Analytics to understand aggregate traffic (for example, how many people visit, which pages are popular, and rough referrer/country information). This service is cookieless: it sets no cookies, does not use a persistent identifier, and does not track you across other sites. The information is aggregated and cannot, by itself, identify you.

Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in measuring and improving the site. Because this analytics method is non-invasive and stores nothing on your device, it does not require your consent.

c) Aggregate search statistics

We keep anonymous, aggregate counts of how the search tool is used (for example, how many searches are run per game “level” or scoring strategy). These counts are not linked to you, contain no personal data, and are derived from the search parameters themselves — never from your identity. Computed search results are cached on our servers, keyed by a hash of the (non-personal) search parameters, so identical searches return instantly.

Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in operating and improving the service. Retention: day-by-day breakdowns are kept for about five weeks; overall totals are kept as long-running, non-personal counters.

d) On-device storage (your saved and recent searches)

When you save or run a search, the site stores that entry in your browser’s local storage on your own device, so your “Saved & recent” list is available the next time you visit. This information stays on your device, is never transmitted to or accessible by us, and is used only to provide the feature you chose to use. You can delete it at any time by using your browser’s “clear site data” controls.

Legal basis: this storage is strictly necessary to provide a feature you actively request, and it stores no data with us.

e) Cookies

We do not use advertising, analytics, or tracking cookies. The only cookies that may be present are strictly necessary ones:

• Security cookies set by Cloudflare (for example a bot-management cookie) to protect the site. These are classed as strictly necessary and are exempt from consent requirements.
• An operator login cookie for our private admin dashboard. This cookie is set only for the site operator when signing in to administer the site — it is never set for ordinary visitors.

Because the site uses no non-essential cookies for visitors, we do not display a cookie-consent banner. This will be revisited if that ever changes.

4. Service Providers (Processors)

We rely on a small number of trusted providers who process data strictly on our behalf to run the site:

• Cloudflare, Inc. — content delivery, DDoS protection, security, and cookieless web analytics. Cloudflare processes your IP address and request metadata to deliver and protect the site.
• Our hosting provider (netcup GmbH, with data centres in the European Union) — hosting of the servers that run the site.

We do not sell or rent personal data, and we do not share it with third parties for their own marketing purposes.

5. International Data Transfers

Our servers are located in the European Union. Some providers (notably Cloudflare) are established outside the European Economic Area or may route traffic through infrastructure outside it. Where that happens, the transfer is protected by appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework.

6. Game Data and Third-Party Content

The site displays Teamfight Tactics game data (champions, traits, items, etc.) that we download from publicly available sources at build time and serve from our own domain. We self-host our fonts and assets. Loading the site does not, by itself, send your data to Riot Games or to any third-party content network.

7. How Long We Keep Data

We keep personal data only for as long as necessary for the purpose it was collected. As described above, IP-based security and rate-limiting data expires within minutes to a few hours, aggregate and cached data contains no personal information, and on-device data remains under your control in your own browser. Provider-side logs (e.g. Cloudflare) are retained according to that provider’s own retention periods.

8. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data;
• restrict or object to our processing, including processing based on legitimate interests;
• data portability, where applicable; and
• lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at the email in section 1. Please note that, because we deliberately collect very little and do not identify visitors, we may be unable to locate any data relating to you (for example, we cannot connect a name or email to anonymous usage data) — in which case we will tell you so.

You also have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

9. Automated Decision-Making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

10. Security

We take reasonable technical and organisational measures to protect the site, including transport encryption (HTTPS), protection via Cloudflare, and rate-limiting against abuse. No method of transmission or storage is completely secure, but we work to safeguard the limited data we process.

11. Children’s Privacy

The site is a general-audience gaming tool and is not directed at children. We do not knowingly collect personal data from children under the age of 13 (or the relevant age in your country).

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” at the top of this page. Material changes will apply only from the date they are posted.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact:

Codekatu Oy
Business ID: 3222614-3
Email: [email protected]
Website: https://tftraits.com