Privacy Policy
1. Who we are
RankupRL is a personal-use desktop application maintained by Joshua Jerome. There is no company, no employees, no shareholders — it is one developer's project. References to "we" in this document refer to that maintainer.
Contact: joshua.jerome@gmail.com.
2. Scope
This policy covers the RankupRL desktop application and this website (rankuprl-site on GitHub Pages). It does not cover the third-party services RankupRL interacts with — each has its own privacy policy, linked at the bottom of this page.
3. What we store, and where
Everything RankupRL stores lives in a local SQLite database on your computer, in your operating system's standard application-data directory:
- Windows:
%APPDATA%\com.rlrankup.app\rlrankup.db - macOS:
~/Library/Application Support/com.rlrankup.app/rlrankup.db - Linux:
~/.local/share/com.rlrankup.app/rlrankup.db
What's in that database:
- Profile information you enter (name, emoji, theme preference).
- OAuth connection tokens for Steam, Epic, or Google when you sign in (used only to call those services as you — see Section 5).
- Watchlists you create (groups of player handles you're tracking).
- Recently fetched tracker.gg stats, cached so we don't re-query on every load.
- UI preferences (theme choice, sidebar state).
We do not store passwords. OAuth flows never expose your account password to RankupRL — that stays between you and the provider.
4. What we send outward
The desktop application makes network requests to the following services. Each request is made directly from your machine; no RankupRL-controlled server proxies any of it.
- tracker.gg / api.tracker.gg — to look up Rocket League stats for the player handles you've added (your own account or anyone on your watchlists). The only data transmitted is the player handle (e.g., your Epic display name or SteamID64), which is already public.
- Steam Web API (api.steampowered.com) — when you sign in with Steam, used to fetch your persona name + avatar and, in a future phase, your friends list. Requires a Steam Web API key you configure as an environment variable.
- Epic Account Services (api.epicgames.dev, epicgames.com) — when you sign in with Epic, used to verify your identity, fetch your display name, and (with your consent) read your friends list and online presence.
- Google APIs (planned, Phase 6.5) — when you opt in to Google Drive backup, used to write encrypted backups of your local database to a folder in your Drive.
RankupRL also embeds a hidden browser window pointed at tracker.network so that tracker.gg's public API will accept our requests (it requires the request to originate from its own domain). That window's session cookies live in your application data directory like any browser session would.
5. What we don't do
- No analytics or telemetry. RankupRL does not report usage, crash data, screen views, or any other event to any server.
- No remote backend (yet). There is no RankupRL-controlled server. Your data stays on your machine.
- No advertising. The application contains no ads and does not pass any data to ad networks.
- No data sharing. We do not sell, rent, or share your data with anyone. There is no marketing list.
- No tracking cookies. The application stores a handful of preferences in local storage (theme choice, sidebar collapsed/expanded). These never leave your machine.
6. OAuth tokens — how they're handled
When you click "Sign in with Steam" or "Sign in with Epic," the provider returns an access token (and sometimes a refresh token) to RankupRL. Those tokens are stored in your local database, encrypted at rest by your operating system's standard file permissions on the application data directory.
The tokens are used only to call the provider's APIs as you — for example, to fetch your Steam friends list when you open the Friends tab. The tokens never leave your machine and are never sent to any third party.
You can revoke a connection at any time:
- From within RankupRL: Settings → Connections → Disconnect.
- From the provider's site: Steam account settings or Epic connected apps.
7. Deleting your data
To completely remove all data RankupRL has stored about you, do both of the following:
- Uninstall the RankupRL application.
- Delete the application data directory listed in Section 3.
That deletes everything: profiles, connections, OAuth tokens, cached stats, preferences. There is no other copy.
8. Children's privacy
RankupRL is not directed at children under 13. We do not knowingly collect data from anyone under that age.
9. Third-party services
When you use RankupRL, the third-party services it talks to are governed by their own privacy policies:
- Tracker Network privacy policy
- Steam (Valve) privacy policy
- Epic Games privacy policy
- Google privacy policy (when Drive backup ships)
10. Changes to this policy
If we change this policy, the "Last updated" date at the top of the page will be bumped. Material changes (e.g., adding a new third-party service or starting any kind of data collection) will be called out prominently in the application's release notes.
11. Contact
Questions about this policy or about how RankupRL handles your data: joshua.jerome@gmail.com.