Privacy Policy
Last updated 30 September 2026. This policy describes what the site actually does today — it is not a template.
The short version
- There are no cookies, no analytics, no advertising and no tracking pixels on this site. None. You can check in your browser's network tab.
- We never see your card. Payments happen on Stripe's own pages.
- You can use the entire builder without an account. An account exists so you can save and share builds.
- Your saved builds are private by default. A build becomes visible to other people only when you choose to publish or share it.
- We do not sell your data, and there is nobody to sell it to.
Who runs this
Goated Build Lab is operated by an individual based in the United States. For anything in this policy — including a request to see or delete your data — email GoatedStudiosOfficial@gmail.com.
What is collected, and why
If you never make an account
Nothing is stored about you on our side. The builder runs in your browser. Some preferences are kept in your own browser's local storage, which never leaves your device and which you can clear at any time:
| Stored | What it is |
|---|---|
lab-theme | Light or dark, if you picked one. |
gbl_qr_ids | Which build codes you have made a QR for. |
| daily search count | How many finder searches you have run today, for the free allowance. |
gbl-auth | Your sign-in session, once you have an account. |
These are local storage, not cookies. They are not sent to us with requests and cannot be read by any other site.
If you make an account
| Data | Why | Who can see it |
|---|---|---|
| Email address | To identify your account and let you sign in or recover it. | Only you and the operator. |
| Password | Sign-in. Stored only as a salted hash by our authentication provider — the site never receives or stores your actual password. | Nobody, including us. |
| Display name (handle) | So a shared build has an author. | Public. |
| Bio, gamertag, console, character avatar | Optional. So people can find you in-game if you want that. | Public. Leave them blank if you would rather not. |
| Saved builds: name, build code, notes | The point of the account. | Private unless you publish or share one. |
| Likes | To order the community list and stop a build being liked twice. | Counts are public; who liked what is not shown. |
| Subscription tier and renewal date, plus Stripe customer and subscription identifiers | To know what your account has access to. | Only you and the operator. |
Anything marked public really is public — it is readable by anyone, signed in or not, including by software reading the site automatically. Do not put anything in a bio, gamertag, build name or note that you would not want indexed by a search engine.
Payments
Card details are entered on Stripe's own checkout pages and are never sent to, seen by, or stored by this site. We receive from Stripe only which plan you are on, whether it is active, when it renews, and identifiers we use to look your subscription back up. Stripe processes that payment under its own privacy policy.
Box score screenshots
When you add a game to the League, your phone or computer reads the Game Stats screenshot itself, on the device, and nothing is uploaded. Only if that read cannot be checked cleanly, and only when you are signed in, the screenshot is sent to our server and passed to Anthropic's Claude to read the numbers. It is used for that one read and then discarded: we do not store the image or log its contents, and Anthropic does not use it to train its models. From a screenshot we keep only the numbers you choose to save, plus the gamertags on your own team; the other team's names are never read or kept.
Connecting your Xbox
This is optional. If you connect your Xbox to import screenshots, you sign in on Microsoft’s own page through OpenXBL, an independent Xbox service, and we never see your password. We keep your gamertag and an access key that lets us list your Xbox screenshots; the key is stored encrypted and is never shown to anyone, including you. We do not keep the email address that comes with it. A screenshot you pick is fetched from Xbox, read, and not stored. Disconnect Xbox in your account deletes the key and gamertag at once, and deleting your account deletes them too.
Who your data is shared with
Only the services needed to run the site. None of them are advertising companies and none of them receive your data for their own marketing.
| Service | What it handles |
|---|---|
| Supabase | The database and sign-in. Your account, profile and builds live here. |
| Vercel | Serves the site itself. |
| Render | Runs our API: billing, account deletion, Discord roles, and box score screenshots on their way to be read. |
| Stripe | Subscriptions and payments. |
| Anthropic | Reads a box score screenshot, only when the on-device read could not and you are signed in. Not stored, not used for training. |
| OpenXBL | Only if you connect your Xbox: fetches your Xbox screenshots when you choose to import one. You sign in on Microsoft’s page. |
| Google Fonts, jsDelivr, cdnjs | Serve the typefaces and two small code libraries the page loads. |
Being honest about the last row: when your browser fetches a font or a library from Google, jsDelivr or Cloudflare, those companies necessarily see your IP address and basic request information, the same as on any site that loads files from them. We send them nothing about you, and we get nothing back about you, but the request itself is visible to them. If you would rather that did not happen, a content blocker will stop it and the site still works.
What is never done
- Your data is not sold, rented or traded. There is no advertising on this site and no ad network is present.
- No behavioral profiling, no cross-site tracking, no session recording, no heat maps.
- Your email address is not added to a mailing list. The only email you will get is one you asked for, such as a sign-in link or a password reset.
How long it is kept
Account data is kept while your account exists. Delete a build and it is gone from the database. Ask us to delete your account and everything tied to it is removed. Stripe keeps payment and invoice records for as long as financial and tax law requires, which is outside our control.
Your rights, and how to actually use them
Wherever you live, you can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Email GoatedStudiosOfficial@gmail.com from the address on the account and we will act within 30 days.
Much of it you can do yourself, immediately: edit or clear your handle, bio and gamertag in your profile; delete any saved build; make a public build private again; cancel a subscription through Manage subscription.
If you are in California, the CCPA gives you the right to know what is collected, to have it deleted, and to opt out of its sale. We do not sell personal information, so there is nothing to opt out of, and the other two are the email above. If you are in the UK or EU, the UK GDPR and GDPR give you equivalent rights plus the right to data portability and to complain to your data protection authority; the lawful bases we rely on are performing our contract with you (your account and subscription) and our legitimate interest in keeping the service working and free of abuse.
Children
This site is not directed at children under 13 and we do not knowingly collect their information. If you believe a child under 13 has made an account, email us and it will be deleted.
Security, stated plainly
Sign-in, storage and payments are handled by established providers rather than home-made code. Access to your data is enforced by database-level rules, so one account cannot read another's private builds. No system is perfectly secure, and nobody can honestly promise otherwise; if a breach ever affects your data, you will be told.
Changes
If this policy changes, the date at the top changes with it. A change that materially affects what is collected or who it goes to will be announced on the site itself rather than made quietly.