Public beta · build 0.1.5

Data, network use and beta accounts.

This notice covers public Windows beta 0.1.5, which targets Windows 11 x64 and RAID build 11.85.5 through the standard Plarium Play installation, plus account-first access and optional match sharing. The Windows client displays in-app match-sharing notice version 2026-10-v10 before collecting match data. This page also identifies delivery, deletion and retention checks that have not been independently verified.

Public beta data notice · beta enrollment notice 2026-10-v1 · in-app match-sharing notice 2026-10-v10 · reviewed 23 October 2026

Match sharing · public Windows client 0.1.5

The standard Release supports two distinct match-sharing options. Anonymous-only sharing is selected by default in the in-app notice. No match is collected until you review and save that notice. This default is a sharing preference, not a claim that every part of the network request is anonymous or a legal conclusion about the processing.

Account-linked pseudonymous sharing is separate and off by default. It requires an explicit opt-in while signed in to your beta account. The service links these records to that account outside the match JSON, so they are pseudonymous, not anonymous.

Only a complete, played Live Arena match with an explicit Victory or Defeat is eligible. Draws, departures before combat, unknown outcomes, abandoned matches and incomplete captures are not queued.

To stop sharing, turn it off in Settings > Privacy & telemetry. This stops future collection and uploads, cancels an active request and deletes pending local match files. It does not delete records already accepted by the service.

What an anonymous match record contains

The anonymous V3 record can include a random per-match event ID; RSL Drafter and RAID versions; a RAID build fingerprint; collector and champion-catalog versions; Live Arena context; optional season and division; player and opponent points rounded to 50-point bands, seasonal points rounded to 10-point bands when available, and a coarse points-gap band.

It also includes observed draft facts: pick mode, which side picked first, pick batches with phase, side, public champion Base IDs and whether their order is known, plus observed bans and leaders. The result and quality fields contain an explicit Victory or Defeat and bounded termination, evidence and quality categories.

Match records exclude player and opponent names, RAID/Plarium account IDs, beta usernames and emails, local profile names, device or hardware IDs, tokens, exact match times or ratings, full rosters and champion-instance IDs, equipment, screenshots, logs, raw game memory, and bot decision rationale or fallback details. A champion Base ID is a public champion identifier, not a roster-instance ID. The app does not collect button-click or unrelated product-usage analytics, and automatic crash/error reporting is off.

Account-linked pseudonymous records

The optional pseudonymous route uses the same fact-only match fields. The match JSON does not contain a username, email, beta-account ID, session token or contributor ID. The service derives the account link from the authenticated session and stores it separately. Because the service can link these records to your account, this sharing is pseudonymous, not anonymous.

Your choice is bound to your signed-in beta account and rechecked when a match is queued and sent. Changing accounts does not send another account's pending records. Withdrawing this option stops future linked sharing and removes pending linked files, but does not delete accepted server rows. Account-deletion handling for linked match rows has not been verified end to end.

Local queue, server delivery and retention

Pending match files expire locally after 30 days. The combined outbox is limited to 500 files or 50 MiB. Anonymous sharing also uses a random installation UUID and bearer secret, stored separately from match records. The client protects the secret with Windows DPAPI; the API stores the UUID and a SHA-256 hash of the secret. The API and Cloudflare proxy may process a source IP to deliver and protect requests. The match record itself has no source-IP field; provider access-log retention has not been independently verified.

The client sends eligible records over HTTPS to api.rsldrafter.app. The production routes and a two-calendar-year raw-record expiry are configured, but no authenticated real-player match has yet been independently verified as accepted and retrieved from production. An app acknowledgement, even when it matches a saved event ID, is not an independent check of database persistence. Actual expiry, backup expiry and account-deletion cleanup of linked match rows have not been verified, so turning sharing off does not promise remote deletion.

See the technical telemetry inventory and latest release notes for implementation details.

Account-first signup, access and deletion

Create an account with a username, email address and password on RSL Drafter's Keycloak identity service. Email verification is required before beta access. At the 21 October 2026 review, account registration and automatic beta enrollment were available, while new applications through the former beta application form were disabled. Availability can change. In the normal signup flow, Keycloak sends one confirmation email. After verifying your address and signing in to the account page, the API checks the current policy and your account before granting access while enrollment is open; no application or invitation email follows. If enrollment is paused, new grants wait until it reopens. The current beta enrollment notice is version 2026-10-v1. Previously issued legacy application links use the separate legacy application notice version 2026-10-v13. Account creation, email confirmation and beta access do not enable match sharing.

The identity service processes your username, email, password credential and verification state. The website and beta API do not receive your password; use a unique password and never enter your RAID password. After sign-in, the browser holds an OIDC token in memory and sends it to the API over HTTPS as a bearer token, with browser cookies omitted from the API request. Keycloak and its configured email provider process the address and messages needed for confirmation and, if requested, password recovery. Their service-side logs and retention behavior have not been independently verified.

The desktop app requests the offline_access sign-in scope and stores a refresh token separately from your profiles in %LOCALAPPDATA%\ArenaDrafter\account\refresh-token.bin. Windows Data Protection API (DPAPI) protects the token for the current Windows user; it is not your RAID password. RSL Drafter attempts to clear the saved token when you sign out, start a new interactive sign-in, or the identity service reports that the session is invalid, revoked or replaced. A closed app cannot process a remote access change until it checks again. A local profile archive can include authentication state, so restoring it for the same Windows user may restore the saved token and settings. Local sign-out does not close the identity provider's browser session.

The beta-access database stores the identity issuer and subject reference, grant status and timestamps, the self-enrollment notice version, and a one-way hash of the actor identity in the audit record. It does not store the account email in the grant row. Authorized administrators can read current username, email, enabled state and verification status from the identity service when managing accounts. The retention period for identity accounts, active grants and audit entries has not been set or independently verified. Match-data sharing remains a separate choice in the Windows app.

After signing in, you can request account deletion from the account page and confirm the action. Beta access is revoked immediately, active application records and queued emails are removed, and the identity service is asked to delete the account. If the identity service is temporarily unavailable, a restricted retry queue holds the identity subject until deletion is confirmed. The queue is removed when the identity service confirms deletion; a one-way hashed marker is kept for 20 minutes afterward so still-valid access tokens cannot restore access. Daily PostgreSQL backups are kept in restricted local server storage for up to two years, so deleted information may remain in a backup until that copy expires. The archive format is checked after creation, but a full restore and deletion-reconciliation drill has not been completed; deletion is not immediate erasure from every backup copy. Cleanup of account-linked match rows during account deletion has not been verified end to end.

The former application-and-invitation workflow is not the normal way to join. Valid previously issued verification, invitation and withdrawal links remain a separate legacy path and may work until their tokens expire. Existing legacy application records follow their configured 90-day expiry. These links do not enable match sharing.

Forgot-password recovery is hosted by Keycloak and sent to the verified email address. Ordinary web hosting, identity-provider, API, email-delivery and network protection logs may contain connection or delivery metadata; their service-side retention has not been independently verified.

Account emails may load a logo and background image from fixed HTTPS URLs shared by all recipients. Those URLs do not contain account identifiers, email addresses or action tokens, and the templates do not include tracking pixels. An image request may reveal the requester's IP address (or an image-proxy address), client or user-agent details, and load time to the image host and any CDN, proxy or mail-image proxy involved. This infrastructure may log requests; its retention has not been independently verified. If images are disabled, the email text and solid-color backgrounds remain, and verification, recovery and required-action links still work.

Other app network use and local files

Before sign-in, the public 0.1.5 client checks GitHub's latest release on every launch. If a newer version is available, the app asks before downloading it. An unavailable or invalid update check keeps sign-in blocked until it can be retried. The package is checked against the manifest's declared size and SHA-256 before installation. GitHub receives ordinary connection metadata; RSL Drafter has not verified GitHub's server-side logging or retention.

The champion reference catalog is bundled with the app and is not fetched from HellHades while running. Strategy and profile files stay local. The app does not send generic button-usage analytics or automatic crash reports. Diagnostic reports are created locally and are not uploaded automatically; review and redact a report before sharing it yourself.

Website and scope

The site does not use analytics. Keycloak may use necessary authentication cookies on its hosted identity service for sign-in and session recovery. The account page keeps OIDC tokens in browser memory only; signed-in requests to the separate API at api.rsldrafter.app use bearer authorization with browser credentials omitted, so those API requests do not include cookies. This account API path is not the app's match-ingestion endpoint. The hosting provider may process ordinary request information; server-side logs and retention have not been independently verified here.

This is a technical description of the client behaviors above, not a complete legal privacy policy for every use of the application or website. RSL Drafter is an independent community tool and is not affiliated with or endorsed by Plarium.