Privacy Policy — Mejai's

Last updated: 16 June 2026

Mejai's ("the app") is an unofficial, fan-made companion for the Riftbound TCG by Riot Games and UVS Games. This policy explains what data the app handles, where it's stored, and the choices you have.

Summary

• By default, your data stays on your device. No account is required to use the app.
• Cloud sync and social features are optional and opt-in. If you choose to sign in with Google or GitHub, the data you create in the app is backed up to your own cloud account so it follows you across devices.
• No advertising, no analytics, no tracking SDKs, signed in or not.
• No data is ever sold or shared with third parties for marketing.

Data stored on your device (default)

Everything you create in Mejai's — owned cards, wishlist, trade list, binders, decks, match logs, daily value snapshots, and app settings — is stored locally on your device in a private SQLite database. You can export a backup to a JSON file at any time via the in-app share sheet, and delete everything by clearing the app's storage or uninstalling.

Optional account sign-in

Mejai's offers two independent and optional sign-in methods. The app runs without either of them, and you can sign out at any time from Settings → Account.

Sign in with Google (Firebase)

When you sign in with Google, the app uses Google Sign-In and Firebase (operated by Google LLC) to back up your data under your account.

• What we receive from Google when you sign in: your Google account name, email address, profile photo URL, and a stable Firebase user ID.
• What is stored in our Firebase project:
  • users/<your-firebase-uid> — a single document containing the same backup JSON you can export from the app (collection, wishlist, trade list, binders, decks, match logs, value snapshots, app settings).
  • Social features (only if you open the Social screen and only for the categories you choose to share): see "Social features" below.
• Where it lives: Cloud Firestore, in the developer's Firebase project. Firestore security rules restrict each user document so that only the signed-in user can read or write their own document — other users (including the developer) cannot access it.
• Encryption: in transit (HTTPS / TLS) and at rest (Firebase default encryption).
• What we never send to Firebase: payment information (handled by Google Play, not by us), advertising identifiers, contacts, photos, files, location, or any data from other apps.

Sign in with GitHub (Personal Gist)

As an alternative, you can sign in by pasting a GitHub Personal Access Token with the gist scope. In this mode:

• The token is stored locally in the app's settings; it is sent only to api.github.com and never to any other server.
• Your backup JSON is stored as a private gist under your own GitHub account, with the file name mejais-backup.json. The developer has no access to it.
• The app communicates with api.github.com over HTTPS to read and write this gist.
• You can revoke the token at any time from GitHub's settings, which immediately disables the cloud sync without affecting your local data.

Social features

The Social screen is opt-in and only becomes active when you sign in with Google. It is built on top of Firebase Auth and Firestore (same rules as above) and uses the following documents in our Firebase project:

• Your public profile (social_profiles/<your-uid>): a display name, a unique handle you can change, a short invite code, your friend- visibility toggles, your Mejai's Pro flag (cosmetic gold crest), and — if you choose one — the URL of the League of Legends champion icon you picked as your avatar. This document is readable by other signed-in users so they can find you by handle or invite code.
• Friend requests and friend list: when someone sends or accepts a request, the involved profiles' display names and handles are duplicated into the requests / friends sub-collections so both sides can see who you're connected with.
• Shared content (social_shares/<your-uid>): for the categories you turn on in Social → You (collection summary, decks, binders, trade list), the relevant data is published to this document so your friends can view it. Toggling a category off deletes the corresponding part of the document on the next sync. Only your direct friends can read this document.

You can disable any category at any time from Social → You, remove friends from your friends list, change or remove your champion avatar, or stop using the social features entirely by signing out. None of this data is shared with anyone other than friends you have added.

Mejai's Pro (in-app purchase)

Mejai's offers an optional paid subscription ("Mejai's Pro") that unlocks additional features inside the app. Purchases are handled by Google Play Billing, and the entitlement is checked through RevenueCat (operated by RevenueCat, Inc.). To do this:

• A pseudonymous anonymous app user ID generated by RevenueCat is used to identify your purchases. We do not send your Google account email, name, or any personal data to RevenueCat from the app.
• Google Play handles your payment details directly under Google's own privacy policy. We never see your card details.
• RevenueCat tells the app whether your Pro entitlement is currently active. That status (true / false) is mirrored to your social profile so friends can see the cosmetic gold crest; nothing about your purchase history is shared with friends.

You can cancel a subscription at any time from your Google Play account; when it expires, the Pro features turn off automatically.

Network access (default features)

Even without signing in, the app makes a few anonymous network requests for optional content:

• News: the Home screen shows the latest Riftbound news by fetching Riot's public news page (riftbound.leagueoflegends.com/en-us/news). A bundled snapshot is shown if you're offline.
• Events: the Home screen can open the official events locator (locator.riftbound.uvsgames.com) or a store's website in your browser.
• Card data and images: card thumbnails and the card catalogue may load from the public RiftScribe API and CDN, and are cached locally on your device.
• Suggested decks: the Decks screen can fetch community deck suggestions from the public DotGG API (riftbound.gg).
• League of Legends champion list (avatar picker only): when you open the Social → You avatar picker, the app fetches the public champion roster from Riot's Data Dragon CDN (ddragon.leagueoflegends.com) to show the champions and their square icons.

These requests carry only what any web browser sends (your IP address and a generic app user-agent). No account, email, or collection data is ever included.

Camera and on-device OCR

The optional card scanner uses your camera only to read the card name on your device, using Google's on-device Text Recognition (ML Kit). Photos are not saved and nothing is uploaded — recognition runs entirely on the device. Camera access is requested only the first time you open the scanner, and you can decline or revoke it later from Android settings.

Location

To suggest events for your area, the app reads your device's region setting (for example, your country) locally. It does not use GPS and does not request location permission.

Children's privacy

The app is not directed at children under 13. We do not knowingly collect data from children under 13. If you are a parent or guardian and believe your child has signed in to the app, contact us at the email below and we will delete their cloud backup and social profile.

Your choices and data deletion

• Stay local. Don't sign in. Nothing leaves your device.
• Sign out. Settings → Account → Sign out. Removes the local link to your cloud account; your local data is kept.
• Disable social sharing. Social → You → toggle off any category; the published copy on Firestore is deleted on the next sync.
• Delete cloud backup (Google): sign in, then use Settings → Account → Delete cloud data to remove your Firestore document. Alternatively, contact us at the email below and we will delete your backup, social profile, friends list, requests, and shares.
• Delete cloud backup (GitHub): delete the mejais-backup.json gist from your GitHub account, or revoke the token used by the app.
• Cancel Mejai's Pro: Google Play → Subscriptions → Mejai's Pro → Cancel. The entitlement turns off automatically when the current period ends.
• Delete everything on this device: uninstall the app or clear its storage from Android Settings.

Third-party services

Third-party trademarks

Riftbound, League of Legends, and all related names and artwork are trademarks of Riot Games, Inc. UVS Games is the publisher of physical Riftbound product. Mejai's is an unofficial fan project and is not endorsed by or affiliated with Riot Games or UVS Games.

Changes to this policy

If this policy changes, the updated version will be published at the same location with a revised "Last updated" date.

Contact

If you have any questions about this privacy policy, or if you'd like your cloud backup, social profile, or any shared data deleted, contact us at: hello@riftvault.pt