Your screenshot

What happens to it

It is held in memory for the length of one request, resized, and sent to the configured vision provider to read the champion portraits.
It is never written to disk, never put in a database, and never attached to an analytics event.
It is never logged. Error logs record an error code and a duration — never image bytes, and never the provider request body that contained them.
Once the response is sent, the bytes are garbage-collected. There is nothing to delete later because nothing was kept.

Summoner names

A champion-select screenshot usually shows the names of nine other players. The vision model is instructed to ignore names and chat entirely, and the response schema has no field they could be returned in — only champion names, roles and confidence values can come back.

What is stored

Anonymous counters: which step ran, how long it took, how many champions were read, the recommended champion and its score, and how many champions it was chosen from.
A random session id generated in your browser and kept in sessionStorage. It groups the events of one visit and is discarded when you close the tab.
Whether you had been here before, and roughly how many times — your browser counts its own visits in localStorage, stops counting at 50, and sends only that with an upload. There is nothing on our side that can tell which returning browser you are: no cookie, no address, no device fingerprint. Clearing your browser storage resets it to zero.
Every recommendation we make: the champion picked for you, its score, the role it was scored for — the one you chose, or the one we read — and the champion ids on both teams, plus the ones we read as banned and left out. This is what the scoring model is measured against.
Your 👍 / 👎 on a recommendation, when you give one, so a bad pick can be traced back to the draft that produced it.

You never need an account to get a pick. If you do not make one, none of what is described under “Your account” applies to you, and nothing we built sets a cookie — the Google advertising tag described below is the one thing on the page that can, apart from the sign-in cookies described under “Your account”, which exist only if you sign in.

Your account

An account is optional and exists for one thing: saving the champions you play, so you can ask for picks drawn only from them and have that follow you from your phone to your PC. This is everything it holds:

Your email address. Used to sign you in and to send you one email: the link that confirms the address is yours, which you must open before you can sign in. We do not send marketing. The email is sent through Resend, which therefore sees your address and the link, under its own privacy policy. Accounts created with Google are already verified and get no email.
A password hash, if you sign up with a password. We store a salted scrypt hash, never the password, so we cannot read it and cannot email it to you. Accounts created with Google have no password.
Your Google account id, if you use Google. We ask Google for your email address and a stable id — nothing from your Google profile, contacts, mail or files. If a Google address matches an existing email account, the two are linked into one account. Google, in turn, learns that you signed in to BestPick, under its own privacy policy.
Your champion pool — the champion ids you chose.
Your pick history, while you are signed in: for each screenshot you analyse, the champion we recommended, its score, the lane and mode it was scored for, when, and the champions we read on the board (allies, enemies, bans) and the alternatives we showed — as champion names only, never the image. It is what the account page and each pick’s page show, along with the win or loss you choose to record. It holds nothing else from the screenshot and is never used to score a pick.
Your rank and lane order, if you set them: the tier you pick and your lanes in your order of preference. They are shown back to you and never used to score a pick.
When you agreed to the Terms, and which version, so we can show that you did.
A confirmation token, until you use it or it expires after 24 hours. Like the sign-in cookie, only a hash is stored.
A sign-in cookie. A random token, marked HttpOnly, that keeps you signed in for 30 days. Only a hash of it is kept on our side, and signing out deletes it there too. It is set only when you sign in, and is strictly necessary for that.
A short-lived Google cookie. When you press Continue with Google, a second HttpOnly cookie holds a random one-time value (and whether you ticked the Terms) for up to 10 minutes, so we can check that the answer coming back from Google belongs to the browser that asked. It is deleted as soon as the sign-in finishes or fails.

Your account is kept apart from the anonymous data above. Recommendations, feedback and analytics events carry no user id, and nothing links them to your account; your pick history is a separate record that lives and dies with the account, and picks made while signed out are never added to it. When you ask for picks from your pool, the server reads it to score that one request; the only thing recorded is that a pool was used, never which champions are in it.

Deleting it. Choose Delete account on the account page and your email, password hash, Google id, pool, pick history and sign-in sessions are erased from the database immediately; routine database backups, if our host keeps any, age out on their normal schedule. If you cannot sign in, write to contact@bestpick.gg. We share none of this with anyone; the only third parties involved are Google, when you choose to sign in with it, and Resend, which delivers the confirmation email. Your use of the account is governed by the Terms of Service.

Your IP address

Reading a screenshot costs a call to a vision model, so uploads are rate limited. To count them, the address your request arrives from is passed through a one-way hash with a key that is regenerated every time the server restarts. Only that hash is held, in memory, for the length of the rate-limit window. Your IP address is never written to a database, never logged, and the hash cannot be linked back to you or matched against one from any other day.

Signing in and signing up are throttled the same way, to slow down password guessing: attempts are counted in memory against your hashed address and a hash of the email being tried, for 15 minutes, and then forgotten.

Page analytics

This site uses Vercel Web Analytics to count page views. It sets no cookies, does not follow you across sites, and builds no profile of you. It is a third-party service, so page visits are measured by Vercel rather than by us — your screenshot never reaches it.

Advertising

We run ads for BestPick on Google, so every page loads Google's tag (gtag.js) to tell us how many people who clicked an ad went on to actually use the site. Unlike the analytics above, this one can set a cookie and reports to Google, which does follow you across sites — see how Google uses data from sites that use its services. It runs in your browser and is told two things, each at most once per visit: that a screenshot was sent, and that a recommendation was shown. Not the screenshot, not the champions read from it, not which champion was recommended, and not the id your events here are grouped by. Blocking it breaks nothing here.