Privacy Policy

Overview

RSL Companion is a third-party fan tool for Raid: Shadow Legends account planning and roster management. This policy explains what information we collect, how we use it, how long we keep it, and the choices and rights you have.

RSL Companion is an independent community project. It is not affiliated with, authorized, endorsed by, or sponsored by Plarium Global Ltd. Game names, images, icons and related references shown in the app are the property of their respective owners and are displayed only to identify in-game content.

Who Is Responsible

RSL Companion is operated as an independent project. For any privacy matter — questions, requests, or complaints — contact [email protected]. We aim to respond within 30 days.

Information We Collect

Account information. Your email address, display name, the sign-in provider you used (email and password, Google, Microsoft, or Discord), and — if you joined through a registration campaign — the code you used. If you sign in with Discord we also store your Discord user ID and username, so your profile can show which Discord account you sign in with. Sign-in itself is handled by Google Firebase Authentication; we never see or store your password.

Game data you import. When you import a Raid: Shadow Legends account, we store the account data needed to show your dashboards, champions, artifacts, resources, plans and calculators: champion rosters and levels, gear and accessories, resources and currencies, mastery and skill progress, arena standing, and the account's name, level and creation date.

Clan information. The identity of the clan each imported account belongs to — its in-game id and name. See Clans below, which explains what we deliberately do not collect.

Things you send us. Feedback and bug reports you submit in the app, and anything you write to us by email. A report also records the page you sent it from and which of your game accounts were linked at the time. A report sent from the Extractor adds the Extractor and game versions, the game account it was running on, your operating system, language and time zone, and — only if you choose to attach it — the Extractor's activity log from its last run.

Your acceptance of these terms. When you register, we record which versions of the Terms of Service and this policy you accepted, when, and the IP address you accepted them from.

Technical information. Standard server and security data: IP address, request times and paths, and error diagnostics. This is used to keep the service running and to apply rate limits.

Paid membership. If you take out the optional paid membership, we never see or store your card details — those go directly to whichever payment provider (PayPal or Stripe) we have connected to our Ko-fi page, not to Ko-fi or to us. We do receive, via a Ko-fi webhook, the email address, display name, payment amount, and transaction id attached to your membership payment, used only to grant your account its membership tier. See Paid Membership below.

The Desktop Extractor

Importing an account uses the RSL Companion Account Data Extractor, a separate desktop application you choose to download and run. It reads the Raid: Shadow Legends client's process memory to produce an export of your own account. It does not modify game files, inject code, or handle your Raid credentials.

When you launch the Extractor from this site, we pass it a single-use sign-in code that is valid for about one minute and can be redeemed once. That code lets the Extractor sign in to RSL Companion as you without asking for your password again. It is not a password and cannot be reused.

The export the Extractor produces is sent to RSL Companion only when you choose to upload it. Installing and running the Extractor is your decision; see our Terms of Service regarding your responsibilities under Plarium's own terms.

How We Use Information

To authenticate you and keep you signed in; to provide the features you ask for and store your settings and plans; to let you share accounts with other users when you choose to; to respond to your feedback and support requests; to keep the service secure, prevent abuse and enforce rate limits; and to diagnose faults and improve reliability.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Legal Bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract for creating and running your account and processing the game data you import; legitimate interests for security, abuse prevention, fault diagnosis and service reliability; consent for anything optional you volunteer, such as feedback, and for any future analytics or advertising, which would be asked for separately before it starts; and legal obligation where we must retain or disclose information by law.

Children

RSL Companion is not intended for young children. You must be at least 13 to use it, and if you are in the European Economic Area or the United Kingdom you must be at least 16, or the minimum age of digital consent in your country if that is lower. These are the same ages set out in our Terms of Service.

We do not knowingly collect personal data from anyone below those ages. We do not ask for a date of birth and we have no way to verify age beyond the agreement you make when you register, so we depend on you being straight with us about it.

If we learn that we hold personal data collected from a child below the applicable age without the consent of a parent or guardian, we will delete the account and its data without undue delay.

If you are a parent or guardian and believe a child in your care has created an account, contact [email protected] and we will remove it. You do not need the child's password to ask; we may need enough detail to identify the account.

Sharing Accounts With Other Users

Account sharing is off by default. You control it per imported account, and can revoke it at any time — access stops on the sharer's next request. There are three independent options:

Clan lookup lets other RSL Companion users whose own accounts are in the same clan find that account by name and view it. It is also what puts the account on that clan's member list in the app.

Public lookup lets any signed-in RSL Companion user find that account by name and view it.

Share links work on their own: whoever holds the link can view the account, whether or not the other two options are on. Anyone you send a link to can pass it on. You can revoke or regenerate a link at any time.

Viewers get read-only access to the account's data — champions, gear and resources. Revoking is immediate, but it cannot un-see what somebody has already looked at, and it cannot recall information they noted down elsewhere. This includes screenshots, copies, or other records a viewer makes while they have access, which they may then redistribute. We have no way to prevent or control that once you've enabled sharing, and we are not responsible for what a viewer does with what they see. Please consider that before enabling any of these.

Clans

We store which clan each of your imported accounts belongs to — the clan's in-game id and name. We do not collect your clan's member roster. Earlier versions of the Extractor sent the names, ranks, levels and power of every member of your clan; that was removed, and RSL Companion no longer accepts or stores it.

A clan in the app is therefore only the people who imported their own account and chose to share it with their clan. Nobody appears in RSL Companion because somebody else exported them. You can also unlink any account from its clan at any time, from the account's sharing panel or from your profile.

Paid Membership

RSL Companion offers an optional paid membership, taken out through Ko-fi. Ko-fi is not a payment processor: your payment goes directly to us through whichever payment provider (PayPal or Stripe) we have connected to our Ko-fi page. We never see or store your payment card details — only that payment provider does.

When a membership payment succeeds, Ko-fi sends us a webhook containing the email address and display name you paid with, the amount, and a transaction id. We store that in a kofi_memberships record keyed by that email, and use it only to grant your RSL Companion account its membership tier. If the email you paid with matches your RSL Companion sign-in email, this happens automatically; if it doesn't, the payment is held as unmatched until we manually link it after you contact us at [email protected].

Membership access is granted per payment and expires automatically if it isn't renewed — Ko-fi does not notify us when a membership is cancelled, only when a payment succeeds. We keep the membership record as the record of your payments, including after you delete your account (see Deleting Your Account). See Terms of Service for what the membership includes, billing, and cancellation.

Service Providers

We use the following providers, which process data on our behalf to operate the service:

Google Firebase Authentication — sign-in and account credentials.
Microsoft Azure (region East US) — hosting for our API and the database storing your account and game data.
Cloudflare — hosting and delivery of the website and game images, and storage of our nightly database backups.
Discord — only if you choose to sign in with Discord, to confirm your identity.
Ko-fi — only if you take out the paid membership or send a donation, to run the payment page and send us the webhook described above.
PayPal or Stripe — whichever we have connected to our Ko-fi page actually processes your payment; neither Ko-fi nor we ever receive your card details.
GitHub — hosts the Extractor's source code and serves its installer. The download page also asks GitHub for the latest release when you open it, so GitHub receives your IP address and browser details.

RSL Companion does not currently run analytics or serve advertising. If that changes, this policy will be updated first, and visitors in the EEA and UK will be asked for consent before any such scripts are loaded.

International Transfers

Our API and database are hosted in the United States (Microsoft Azure, East US), and our other main providers — Google Firebase Authentication and Cloudflare — also process data there. If you use RSL Companion from the EEA or the UK, your data is therefore transferred to the United States. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (and the UK's extension to it) where the provider is certified, or on Standard Contractual Clauses where adequacy does not apply.

Data Retention

Your account and imported game data — kept until you delete your account, or ask us to remove it.
Import and sync history — 90 days by default, then deleted automatically.
Guest (anonymous) sessions — 24 hours, then deleted automatically.
Extractor sign-in codes — about one minute, then expired and deleted.
Signed-out session tokens — held only until the token would have expired anyway.
Feedback you submit — kept while it is useful for fixing the issue you raised, and deleted with your account.
Paid membership records — kept as the record of your payments, including after you delete your account.
Administrative records — which versions of the Terms and this policy you accepted and when (with the IP address), your closed-testing access entry if you had one, and the record of any deletion request. Kept after your account is deleted, for as long as we may need them to show what you agreed to, to answer a question or legal claim about your account, or to meet accounting and tax rules for payments.
Server logs (the technical information above, including IP addresses) — 30 days, then deleted automatically.
Database backups — a full copy of the database is taken every night, and each copy is deleted automatically after 14 days. Data you delete, or that expires under the periods above, can remain in a backup until that backup is deleted.

Deleting Your Account

You can delete your account yourself, at any time, from Profile › Delete Account. You do not need to contact us.

Deletion is not immediate. When you request it, your account is locked straight away — no data is shown and nothing can be used — but nothing is erased yet. You then have 14 days to change your mind. During that period you can still sign in, and the only page available to you shows the deletion date and a button that restores the account exactly as it was.

After 14 days your account and its data are erased: your imported accounts, champions, gear, resources, plans, sharing settings, feedback and your sign-in itself. This cannot be undone, and we do not restore deleted accounts. If you believe an account was deleted in error, contact [email protected] before the deadline.

We keep a small administrative record, also after deletion: which versions of the Terms and this policy you accepted and when (with the IP address), your closed-testing access entry if you had one, your membership payment records, and a log of the deletion itself — when you asked, whether you cancelled, when it was carried out and how much was removed, with your email address and anything you wrote when you asked. See Data Retention for how long.

Copies of the erased data remain in our nightly database backups until those backups are deleted, at most 14 days later. Backups exist only to recover the service after a failure; we do not use them to bring back an account you deleted.

The 14-day period is the current setting and may be adjusted; whatever period applied when you made the request is the one you are given, and the exact date is shown to you at the time.

Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; to receive your data in a portable format; and to withdraw consent at any time where we relied on it.

You can exercise access and erasure yourself: your imported data is visible in the app, and account deletion is self-service as described above. For a portable export of your data, or anything else, contact [email protected] — we aim to respond within 30 days. We will not charge you or treat you differently for exercising these rights.

If you are in the EEA or UK and think we have handled your data improperly, you also have the right to complain to your national data protection authority.

Storage On Your Device

RSL Companion does not use advertising or tracking cookies. It does store a small amount of data in your browser, all of it necessary for the app to work: your Firebase sign-in session (so you stay signed in), short-lived values under the raidtools.auth. prefix used to complete sign-in and provider linking, and a few interface preferences such as which account you last had selected. Clearing your browser storage signs you out and resets those preferences.

Security

Data is transmitted over HTTPS and stored with access restricted to the service. Sign-in is handled by Google Firebase, so we never hold your password. No service can promise perfect security; if a breach affects your personal data, we will notify affected users and the relevant supervisory authority without undue delay, as required by law.

Changes

We may update this policy as the service changes. The version number and date at the top of this page tell you which version is current. For material changes we will give notice in the app before they take effect. Continued use after a change takes effect means you accept the updated policy.

Contact

For privacy questions, data requests, account recovery, or legal notices, contact [email protected]. For product feedback, bug reports, or development questions, contact [email protected] or use the feedback tools in the app.