Privacy Policy

Last updated: 2026-06-03

1. Who we are

RankupRL is a personal-use desktop application maintained by Joshua Jerome. There is no company, no employees, no shareholders — it is one developer's project. References to "we" in this document refer to that maintainer.

Contact: joshua.jerome@gmail.com.

2. Scope

This policy covers the RankupRL desktop application and this website (rankuprl-site on GitHub Pages). It does not cover the third-party services RankupRL interacts with — each has its own privacy policy, linked at the bottom of this page.

3. What we store, and where

Everything RankupRL stores lives in a local SQLite database on your computer, in your operating system's standard application-data directory:

• Windows: %APPDATA%\com.rlrankup.app\rlrankup.db
• macOS: ~/Library/Application Support/com.rlrankup.app/rlrankup.db
• Linux: ~/.local/share/com.rlrankup.app/rlrankup.db

What's in that database:

• Profile information you enter (name, emoji, theme preference).
• OAuth connection tokens for Steam, Epic, or Google when you sign in (used only to call those services as you — see Section 5).
• Watchlists you create (groups of player handles you're tracking).
• Recently fetched tracker.gg stats, cached so we don't re-query on every load.
• UI preferences (theme choice, sidebar state).

We do not store passwords. OAuth flows never expose your account password to RankupRL — that stays between you and the provider.

4. What we send outward

The desktop application makes network requests to the following services. Most go directly from your machine; the one exception is the Steam Web API path, which routes through a thin RankupRL-operated proxy described in detail in Section 4.1.

• tracker.gg / api.tracker.gg — to look up Rocket League stats for the player handles you've added (your own account or anyone on your watchlists). The only data transmitted is the player handle (e.g., your Epic display name or SteamID64), which is already public.
• RankupRL API proxy (api.rankuprl.app) — used to call the Steam Web API on your behalf (your persona name + avatar, your friends list). See Section 4.1 for full detail.
• Epic Account Services (api.epicgames.dev, epicgames.com) — when you sign in with Epic, used to verify your identity, fetch your display name, and (with your consent) read your friends list and online presence.
• Google APIs (planned, Phase 6.5) — when you opt in to Google Drive backup, used to write encrypted backups of your local database to a folder in your Drive.

RankupRL also embeds a hidden browser window pointed at tracker.network so that tracker.gg's public API will accept our requests (it requires the request to originate from its own domain). That window's session cookies live in your application data directory like any browser session would.

4.1. The RankupRL API proxy (api.rankuprl.app)

RankupRL runs a small server-side proxy at api.rankuprl.app that forwards requests to Steam's Web API on your behalf. We do this because Steam requires every app that calls its API to use an API key registered to a single operator — distributing one key per user is a violation of Steam's terms. A central proxy with one key, owned by RankupRL, is the standard pattern Steam expects.

The proxy is intentionally minimal:

• Stateless. Each request is forwarded to Steam and the response is returned to you verbatim. The proxy does not store request bodies, responses, your SteamID64, or your friends list anywhere.
• Authenticated via your Epic OAuth token. To prevent the proxy from being abused by other apps, every request must carry your Epic access token. The proxy verifies the token by calling Epic's own /userInfo endpoint. Your Epic Account ID (a public identifier) is used as the rate-limit bucket — see next bullet.
• Per-account rate limit. 60 requests per minute per Epic Account ID. A short-lived counter is kept in Cloudflare's key-value store, scoped to your Epic Account ID, and automatically expires after 60 seconds.
• Cloudflare access logs. The proxy runs on Cloudflare Workers. Cloudflare records standard request metadata (timestamp, source IP, request path, response status) for operational reasons. These logs are retained no longer than 30 days and are not used for any analytics or marketing purpose by RankupRL. See Cloudflare's privacy policy for their handling of this data.
• Open source. The full Worker source is in the rankuprl-site repository under worker/; you can audit exactly what it does.

The proxy does not log your request bodies, does not store your Steam friends list, does not maintain any database of users, and does not share any data with third parties.

5. What we don't do

• No analytics or telemetry. RankupRL does not report usage, crash data, screen views, or any other event to any server.
• No backend storage. Aside from the stateless Steam proxy described in Section 4.1, there is no RankupRL-controlled server. Your profile data, watchlists, OAuth tokens, and stats cache all live on your machine.
• No advertising. The application contains no ads and does not pass any data to ad networks.
• No data sharing. We do not sell, rent, or share your data with anyone. There is no marketing list.
• No tracking cookies. The application stores a handful of preferences in local storage (theme choice, sidebar collapsed/expanded). These never leave your machine.

6. OAuth tokens — how they're handled

When you click "Sign in with Steam" or "Sign in with Epic," the provider returns an access token (and sometimes a refresh token) to RankupRL. Those tokens are stored in your local database, encrypted at rest by your operating system's standard file permissions on the application data directory.

The tokens are used only to call the provider's APIs as you — for example, to fetch your Steam friends list when you open the Friends tab. The tokens never leave your machine and are never sent to any third party.

You can revoke a connection at any time:

• From within RankupRL: Settings → Connections → Disconnect.
• From the provider's site: Steam account settings or Epic connected apps.

7. Deleting your data

To completely remove all data RankupRL has stored about you, do both of the following:

1. Uninstall the RankupRL application.
2. Delete the application data directory listed in Section 3.

That deletes everything: profiles, connections, OAuth tokens, cached stats, preferences. There is no other copy.

8. Children's privacy

RankupRL is not directed at children under 13. We do not knowingly collect data from anyone under that age.

9. Third-party services

When you use RankupRL, the third-party services it talks to are governed by their own privacy policies:

• Tracker Network privacy policy
• Steam (Valve) privacy policy
• Epic Games privacy policy
• Google privacy policy (when Drive backup ships)

10. Changes to this policy

If we change this policy, the "Last updated" date at the top of the page will be bumped. Material changes (e.g., adding a new third-party service or starting any kind of data collection) will be called out prominently in the application's release notes.

11. Contact

Questions about this policy or about how RankupRL handles your data: joshua.jerome@gmail.com.