Privacy policy

1.Who is responsible

Wildflover is run by the Wildflover team ("we", "us"). We are the data controller for the personal data described on this page. For privacy questions and requests, open a support ticket on our Discord server.

2.What this policy covers

• This website, wildflover.wf.
• The Wildflover desktop app for Windows and your Wildflover account, which runs on our server.
• Buying access through Shopier or Gumroad.

3.This website

No cookies, no analytics, no ads. This site sets no cookies. It loads no tracking pixels, analytics or advertising scripts. The fonts, images and the introduction video are served from this site; the video loads only when you press play.

One record in your browser. The download button saves the details of the latest installer (version number, file size and download link) in your browser's local storage under the name wf:release:v2, so the button shows the current version from the start on your next visit. This is the only thing the site stores on your device. It holds no personal data, stays in your browser and is never sent to us or anyone else. You can delete it at any time by clearing this site's data in your browser settings.

Latest version and downloads. Pages ask our server for the latest installer version, and the installer itself downloads from our server. Like any web request, this sends your IP address and browser details to our server. We use them only to answer the request and to limit abuse.

Discord and Gumroad details. The Discord member and boost counts, our Discord server's banner and icon and the Gumroad rating are written into the pages when the site is built. Your browser does not contact Discord or Gumroad.

Server logs. Hostinger, which hosts this site, keeps standard server logs: IP address, browser, the page requested and the time. We do not link these logs to your account.

Links to other sites. When you follow a link to Shopier, Gumroad or Discord, their own privacy policies apply.

4.Your Wildflover account

When you create an account and use the app, our server stores the following.

Account and sign-in

Account. Username, e-mail address, password (stored only as an argon2id hash, never as plain text), whether your e-mail is verified, your access level and its end date, ban status and reason, and when you signed up and last signed in. Kept until your account is deleted.

Sign-up and e-mail codes. An unfinished sign-up is deleted 1 hour after it expires. Verification and reset codes are deleted 1 day after they expire or are used.

Sessions. A hash of your sign-in token, your device ID, IP address and browser or app details (user agent). A session lasts up to 30 days. Its record is deleted 14 days after it expires, or 2 days after it is ended.

Device and trial

Device ID. The app sends a code made from a one-way hash of your Windows installation ID (MachineGuid). The ID itself never leaves your PC. If it is not available, the app uses an ID based on your PC name. Reinstalling Windows changes the ID.

Registered devices. Device ID, IP address, user agent, and when the device was first and last seen. We use them for the device limit (one PC per account by default). They are removed when you reset your devices or delete your account.

Free trial. To give each PC one 24-hour trial, we store the device ID, IP address and user agent of the claim.

Security log. Important account events, for example when an access code is issued or redeemed, with your IP address. Kept for 90 days.

Profile and community

Profile. Display name, avatar, banner, bio, social links, accent colour and badges, the usage figures on your profile (total time in the app, number of activations, number of custom mods, favourite champion and skin) and profile views. The record of who viewed a profile is kept for 30 days.

Friends and direct messages. Your friends list and your messages (sender, recipient, text, read and edited status). We keep the last 500 messages of each conversation. Staff with moderation rights can read direct messages to handle reports and abuse.

Community chat. Messages in chat rooms. We keep the last 500 messages of each room. A message removed by a moderator is hidden, not erased. Chat mutes are deleted when they end.

Shop (community mods). Mods you upload (files, banner, screenshots, description), your comments and likes, and moderation records.

Reports. Reports you send about users or content.

Other activity. Notifications, rewards, radio likes and plays, and the community activity feed.

Online status. Kept in memory only.

5.Purchases

Checkout. You pay on Shopier (run by Değer Teknoloji A.Ş.) or on Gumroad (Gumroad, Inc.). They process your payment under their own privacy policies. Your card or PayPal details never reach us.

What the store sends us. Your name, e-mail address, order number, the product and the amount. Gumroad also sends your country; Shopier also sends your phone number.

What we store. The checkout e-mail, order number and product, the access code (only as a SHA-256 hash), who redeemed it and when, and a log of the access added to your account. For Shopier sales we keep the records the law requires for at least 3 years.

Order notifications. For each order our staff gets a message in a private channel on our Discord server. It shows your name, e-mail, order number, amount, country (Gumroad) and phone number with most digits hidden (Shopier).

Order note. If you buy at a Boost price, you write your Discord username in the order note so our team can check the boost.

E-mail. We send the access code through our own mail system (a mail service on our website host, then our own server). We do not use an outside e-mail company.

Gumroad orders. Gumroad is the merchant of record for these orders and handles tax, invoices and payment disputes.

6.Optional features in the app

These features send data only when you use them.

Discord link. If you link Discord, we ask for the identify and guilds.members.read permissions. We store your Discord ID, name and avatar (a copy on our server) and the access tokens Discord gives us, so we can show your badges, such as the server booster badge. Unlink Discord in the app to remove them.

In-app assistant. What you type to the assistant is sent to third-party AI services: the g4f.space proxy and text.pollinations.ai. If you turn on voice, the text to be spoken goes to ElevenLabs or StreamElements. When the assistant looks up the weather (Open-Meteo) or a web answer (DuckDuckGo), your question is sent to them. Do not type personal details into the assistant.

League stats. Features that show League of Legends statistics send your in-game name, tag line and region to OP.GG.

Party. Party members connect directly to each other (peer to peer). As with any direct connection, the other members' apps can see your IP address.

Lobby join requests. When you ask to join a lobby, your PUUID, summoner ID, Riot ID and region go to the lobby host only. Our server does not save them.

Game data and images. The app downloads champion, skin and item data and images from CommunityDragon, Riot Data Dragon, Meraki Analytics, GitHub and image hosts. As with any download, they see your IP address.

Security check and file storage. Cloudflare can check sign-up and sign-in requests (Turnstile) and stores Shop files and previews.

7.Why we use your data

• To run your account, deliver your access code, match it to your account and give support. Legal basis: performing our contract with you (GDPR Art. 6(1)(b); KVKK md. 5/2-c).
• To keep the service secure and fair: the device limit, one trial per PC, the security log, rate limits and abuse checks. Legal basis: our legitimate interest (GDPR Art. 6(1)(f); KVKK md. 5/2-f).
• To keep the sales records the law requires, for example the 3-year records for distance sales in Türkiye. Legal basis: legal obligation (GDPR Art. 6(1)(c); KVKK md. 5/2-ç).
• To answer chargebacks, disputes and legal claims. Legal basis: establishing, using or defending a right (GDPR Art. 6(1)(f); KVKK md. 5/2-e).
• To moderate chat, messages and the Shop. Legal basis: our contract (the community rules) and our legitimate interest (GDPR Art. 6(1)(b) and (f); KVKK md. 5/2-c and f).
• Optional features (Discord link, assistant, voice, League stats). Legal basis: your consent, given when you turn the feature on (GDPR Art. 6(1)(a); KVKK md. 5/1). You can withdraw it at any time by no longer using the feature or unlinking it.

We do not sell your data and we do not use it for advertising.

8.Who receives your data

• Hostinger: hosts this website, our server and the mail service.
• Cloudflare (USA): security checks and Shop file storage.
• Discord (USA): the optional Discord link and the staff order notifications.
• Shopier (Türkiye) and Gumroad (USA): payments. They act as independent controllers.
• AI and voice services (g4f.space, Pollinations, ElevenLabs, StreamElements): only if you use the assistant.
• OP.GG: only for League stats you ask for.
• Public authorities: only when the law requires it.

Transfers abroad. Some of these services are outside Türkiye and the EU, for example in the United States.

9.How long we keep data

The period is listed with each item above. In short:

• Account, profile, friends and Shop content: until your account is deleted.
• Sessions: until 14 days after they expire. Security log: 90 days. Messages: the last 500 of each conversation or room.
• Purchase records: at least 3 years for Shopier sales.

When a period ends, we delete the data or make it anonymous.

10.Security

• Passwords are stored only as argon2id hashes, access codes only as SHA-256 hashes.
• All connections use HTTPS. Discord tokens stay on our server.
• The device ID is a hash. Your Windows installation ID never leaves your PC.

No system is perfectly secure. If a breach affects your data, we tell you and the authorities as the law requires.

11.Your rights

You can ask us:

• whether we process your data, and for information and a copy;
• why we process it, and whether it is used for that purpose;
• which third parties in Türkiye or abroad received it;
• to correct data that is wrong or incomplete;
• to delete it, to restrict its use or to object to its use;
• to tell the third parties who received it about a correction or deletion;
• to object to a result against you that comes only from automated analysis;
• for compensation if unlawful processing caused you harm;
• to receive your data in a portable format (GDPR);
• to withdraw your consent for optional features at any time.

How to ask. Open a support ticket on our Discord server. It is free. We answer within 30 days (KVKK) or one month (GDPR).

Complaints. You can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu), to the data protection authority of your EU country, or to the ICO in the UK.

12.Deleting your account

The app has no delete button yet. To delete your account, open a ticket on our Discord server. We delete your account and the data linked to it within 30 days. We keep only what the law or an open dispute requires, such as purchase records, and the security log until its 90 days end.

13.Changes to this policy

We update this policy when the app or our services change. The date and version at the top of this page show the current text. Before a change that matters, we tell you in the app or by e-mail.

• Version 1.1, 14 October 2026: the "This website" section updated for the site as it is now.
• Version 1.0, 7 October 2026: first version.