Your data stays in view.

Who is responsible

The controller and developer is Gerard Rey Mañas. Privacy enquiries can be sent to privacy@riftscope.com. This policy applies to the Android application Armory Relay: Daily Shop, package dev.valorant.storeviewer, and, where available, its web-compatible interface.

Armory Relay is an independent, read-only companion for viewing a VALORANT store. It cannot purchase products, spend VALORANT Points, change a Riot account, or access the game itself. The app has no proprietary user-account backend. The developer does not receive or store Riot passwords, authentication tokens, PUUIDs, or personal store data on developer-controlled servers.

Data handled by the app

Riot authentication and session

When you choose to sign in, the app opens Riot Games' official authentication pages in an isolated Android WebView. Your Riot username, password, verification codes and two-factor authentication information are entered on Riot's pages and sent directly to Riot. Armory Relay does not provide its own password form and does not read, log, or send those credentials to the developer.

After a successful sign-in, the application processes:

• Riot access and identity tokens;
• an entitlement token issued by Riot;
• the PUUID contained in the signed token, identifying the Riot player account;
• token expiry and the selected or detected Riot shard; and
• Riot authentication cookies and WebView session data needed to attempt silent session renewal.

The identity token is used transiently to verify sign-in and detect the shard. The access token, entitlement token, PUUID, expiry and shard are stored locally as an encrypted session. They are used only to authenticate Riot requests, obtain the storefront, renew the session and select the correct region.

Storefront and local cache

The app requests the player's daily offers, Night Market offers when active, and featured bundles from Riot Player Data services. A response can include offer IDs, prices, currencies, discounts, rotation times and cosmetic items available to the account.

A mapped copy of this store is cached in IndexedDB on the device, allowing the last available store to appear while a refresh is attempted. The cache contains no Riot access or entitlement token, but its internal key includes the PUUID and selected language. Store contents are therefore treated as account-related data.

Public VALORANT content

Armory Relay downloads public catalog information from valorant-api.com, including skin, weapon, tier, currency, bundle, chroma, level, image and Riot client-version information. The catalog is requested in the selected language and Riot offer IDs are resolved locally.

Armory Relay does not send Riot passwords, tokens, the PUUID or the player's personal store to valorant-api.com. Like any Internet service, valorant-api.com and media or content-delivery hosts may receive technical network data such as IP address, user agent, requested URL, selected language and request time.

Preferences and technical cache

The selected language and selected or detected Riot region are stored in local application storage. Public Riot signing keys used to verify tokens, the current Riot client version and the public cosmetic catalog are cached in IndexedDB.

Wishlist

Skin identifiers added to the wishlist are stored only on the device. After a successful storefront refresh, Armory Relay compares the daily offers and Night Market with that local wishlist and displays any matches inside the app. The wishlist is not sent to a developer-operated server and the app does not use push or local notifications for these matches.

Google Play Billing and Armory Relay Plus

The Android app uses Google Play Billing to offer the non-consumable one-time product remove_ads_lifetime, displayed as Armory Relay Plus. Google Play provides product availability, localized price and purchase state, handles the checkout and payment method, and associates the purchase with the user's Google Play account. The native app transiently handles a purchase token only to acknowledge the transaction with Google Play; it is not sent to Angular, stored on a developer server or combined with Riot account data.

Armory Relay receives only the information needed to determine whether the product is available, pending or owned and to restore that entitlement. A confirmed purchase removes advertising and permits up to three locally stored Riot accounts. The developer does not receive card, bank-account or other payment-method details from the app.

Demo mode

Demo mode creates sample store information in memory. It does not create a Riot session, process a PUUID or tokens, use Riot authentication cookies, or contact Riot or valorant-api.com. The sample is discarded when Demo mode is exited or the app process ends. Advertising services may still operate in Demo mode as described below.

Advertising and consent

The Android version may show a Google AdMob banner on the store screen, including in Demo mode. It uses Google's User Messaging Platform (UMP) to request consent or show privacy choices where required. The implementation does not request an ad unless UMP reports that ads may be requested.

According to Google's disclosure for the Google Mobile Ads SDK, the SDK automatically collects and shares data for advertising, analytics and fraud prevention, including:

• IP address, which may estimate a device's approximate location;
• product interactions, such as app launches, taps and ad interactions;
• diagnostics, such as launch time, hang rate and energy use; and
• device or account identifiers, including Android advertising ID, App Set ID and other applicable device identifiers.

Depending on jurisdiction, consent choice, device settings and Google's configuration, ads may be personalized, non-personalized or limited. Armory Relay does not deliberately pass Riot passwords, access tokens, entitlement tokens, PUUID, region or personal storefront contents to AdMob.

You can review the privacy options made available for your device from Settings → Ads and privacy whenever UMP requires that entry point. You can also manage or delete the Android advertising ID in Android settings. See Google's Privacy Policy and advertising information.

Messages sent to the developer

If you contact the developer by email, the developer and email provider process your email address, message, attachments, and any technical or account information you voluntarily include. Never email passwords, authentication tokens, cookies, recovery codes or two-factor codes.

Data the app does not request

Armory Relay does not request access to contacts, precise GPS location, camera, microphone, photos, SMS, call logs, health information and does not access card or bank-account details. Google Play handles payment information for Armory Relay Plus as described above. The app includes no proprietary analytics or crash-reporting service. AdMob diagnostics remain subject to the advertising disclosure above.

Why data is used

• To provide store viewing, authentication, region, language, caching and session renewal expressly requested by the user.
• To verify Riot-signed tokens and protect the application and account session from misuse.
• To save the local wishlist and display a match inside the app when a selected cosmetic is found after a storefront refresh.
• To offer, acknowledge and restore the Armory Relay Plus entitlement through Google Play Billing.
• To display advertising and prevent advertising fraud.
• To respond to support and privacy enquiries.
• To comply with applicable legal obligations.

Where the GDPR or similar law applies, the legal bases are performance of the service requested by the user, the developer's legitimate interests in providing and securing that service, consent for advertising or local storage where legally required, and compliance with legal obligations. Consent can be withdrawn through the available privacy controls without affecting processing already carried out lawfully.

Third-party services

• Riot Games
  Official authentication, token issuance, session cookies, shard detection, entitlements and storefront data. Riot is an independent controller of Riot account data. See the Riot Games Privacy Notice.
• valorant-api.com and content-delivery hosts
  Public cosmetic metadata and media. No Riot authentication token or PUUID is intentionally sent to this service.
• Google AdMob and UMP
  Consent management, advertising, analytics, delivery, measurement and fraud prevention, as described above.
• Google Play and Google Play Billing
  Product catalogue, localized price, checkout, payment processing, purchase acknowledgement and restoration of the Armory Relay Plus entitlement. See Google's Privacy Policy.
• GitHub Pages
  This policy site is hosted by GitHub Pages. GitHub may process ordinary web-server information when the site is visited under its General Privacy Statement.
• Authorities or professional advisers
  Only if reasonably necessary to comply with law, protect legal rights or answer a valid legal request.

The developer does not sell Riot credentials, authentication tokens, PUUIDs or storefront data. Transfers performed by the Google Mobile Ads SDK may constitute “collection” or “sharing” for advertising under some privacy laws and Google Play's Data safety definitions.

Retention

• Encrypted Riot session
  Access token, entitlement token, PUUID, expiry and region remain in the local vault until sign-out, invalid-session cleanup, Android app-data clearing or uninstall.
• Riot WebView data
  Riot cookies and WebView session data remain until sign-out, expiry by Riot, Android app-data clearing or uninstall.
• Mapped personal storefront
  Stored in local IndexedDB and keyed by PUUID and language until cache clearing, sign-out while that session is active, Android app-data clearing or uninstall. Session expiry alone may not immediately remove this cache.
• Public catalog and technical cache
  Catalog and Riot signing keys are considered fresh for about 24 hours, and client-version entries for about 12 hours. Stored copies may remain until replacement, cache clearing, Android app-data clearing or uninstall.
• Language and region
  Remain in local storage until changed, Android app-data clearing or uninstall.
• Wishlist
  Wishlist skin identifiers remain locally until changed, Android app-data clearing or uninstall.
• Armory Relay Plus entitlement
  The app keeps the current entitlement state in memory and queries Google Play again when needed. Google retains the purchase with the user's Google Play account under Google's retention policies.
• Demo data
  Remains in memory until Demo mode is exited or the process ends.
• Advertising and consent data
  Retained by Google SDK storage and Google systems according to privacy choices, device settings and Google's retention policies.
• Support or privacy email
  Retained only as long as necessary to resolve the enquiry and meet applicable legal obligations.

How to delete data

1. Clear the cached store and catalog: choose Settings → Clear cache. This does not sign you out.
2. Delete the local Riot session: choose Settings → Sign out. This removes the encrypted Riot session, authentication cookies and WebView data, and the active account's stored storefront. Public catalog cache, language, region and Google advertising choices may remain.
3. Delete all local Armory Relay data: use Android App info → Storage → Clear data, or uninstall the app. This removes the local wishlist, but does not cancel or delete a Google Play purchase; Armory Relay Plus can be restored with the same Google Play account.

Armory Relay does not create or maintain its own server-side user account. Deleting local Armory Relay data does not delete the independent Riot account. Riot-account access, correction or deletion must be requested directly through Riot's official support and privacy channels.

To request deletion of information sent directly to the developer, such as a support email, contact privacy@riftscope.com with the subject “Armory Relay data deletion”. Never include a Riot password or authentication token.

Your privacy rights

Depending on location, you may have rights to access, correct, delete, restrict or object to processing; receive portable data; and withdraw consent. Use the controls above for local data, Riot's channels for Riot account data, Google and Android controls for advertising data, and privacy@riftscope.com for information sent directly to the developer.

You may also complain to the competent data-protection authority. In Spain, this is the Spanish Data Protection Agency.

Children

Armory Relay is not designed for or directed at children under 13, or people below the applicable minimum age for using a Riot account without parental or guardian authorization. Users must comply with Riot's age and account requirements. A parent or guardian who believes a child sent information directly to the developer may contact the privacy address above.

Security and transfers

The Android app encrypts session secrets with AES-256-GCM using a non-exportable Android Keystore key. Network traffic uses HTTPS/TLS. The Riot WebView runs in an isolated process, restricts navigation, disables debugging and mixed content, blocks screenshots on the authentication screen, and clears cookies and WebView data on sign-out. Sensitive values are excluded from application logs, and Android backup is disabled.

No measure guarantees absolute protection. Users should secure their device, Riot account and email account, enable Riot multi-factor authentication, and never share tokens or credentials.

Riot, Google, GitHub, valorant-api.com and their infrastructure may process technical or personal data outside your country. Their own notices describe locations, safeguards and transfer mechanisms. Armory Relay does not transfer Riot session or storefront data to a developer-controlled backend.

Changes and contact

This policy may be updated when the app, its providers or legal requirements change. The effective date at the top will be updated, and material changes will be communicated through the app or its store listing where appropriate.

Privacy enquiries can be sent to privacy@riftscope.com.

Armory Relay is an independent community application. It is not affiliated with, endorsed by, sponsored by or approved by Riot Games. Riot Games, VALORANT and related names and marks belong to their respective owners.