Rivals Recommender

Privacy Policy

Last updated: October 15, 2026

Rivals Recommender is a fan-made playstyle recommendation tool for Marvel Rivals players, and part of the WhichMain network. I build and run it myself. This policy explains what the site collects, why, who else gets it, and how to have it deleted.

It covers every site in the WhichMain network. LoL Recommender is a separate site with its own privacy policy.

Information I Collect

You can use the recommendations and quizzes without an account. What gets collected depends on what you do.

Information you give me

  • Account: If you sign up, I store your email address, a display name, and your password as a hash, never in plain text. If you leave the name blank, I fill one in from your email. I also keep when you signed up, when you last signed in, and which site you signed up on.
  • Google sign-in: If you sign in with Google, Google shares your basic profile with me. I keep your email address and name, plus a note that Google is linked to your account. I never see your Google password.
  • Saved results and roster: When you are signed in, your quiz results and the characters you add to your roster are saved to your account.
  • Payments: If you buy Premium, Stripe takes the payment on its own checkout page, and your card details go to Stripe and never reach my server. I send Stripe your account email and ID so it can match the payment to your account. I keep your Stripe customer and subscription IDs, your plan, your last payment date, and when your membership ends.
  • Quiz result emails: If you use Email me my result, I store your email address, the character you matched, the site, and a hashed copy of your IP address. I keep this record whether or not you check the box to hear about new characters, because it also helps me limit abuse.
  • Messages: If you use the contact form, I get your message, the email address you choose to add, the site you sent it from, and your IP address.

One account across the network

Your account works on every WhichMain site and on LoL Recommender, but you sign in separately on each site's address. WhichMain and LoL Recommender look each other up by email address to see whether an account exists, whether it has Premium, and whether Google is linked.

If your account exists on only one of the two and you sign in on the other with your password, a copy of your email address, display name, and password hash is created there. If you later change your password on one site, the other updates its copy the next time you sign in. These lookups are direct connections between my own sites, and no third party is involved.

Collected automatically

  • Page views: When a page loads in a real browser, a small script tells my server which page you opened, the page you came from, and whether you are using the installed web app. The server adds a hashed version of your IP address, plus your account ID if you are signed in. I filter out most bots.
  • Feature use: I count things like starting or finishing a quiz (including your result), sharing a result, opening a shared link, and installing the web app, each with a hashed IP address. I also count when someone opens the Premium window or reaches checkout.
  • Hashed IP address: A hash is a scrambled copy of your IP address, not the address itself. The same address always gives the same hash, which is how I count repeat visits. The site's database holds hashes, not IP addresses.
  • Server logs: Like any website, my web server and Cloudflare, which sits in front of it, see your IP address, your browser, and the pages you ask for. These logs are kept for about two weeks for security and debugging.

Cookies and Local Storage

Cookies are small text files your browser keeps for a site. These are the ones in use:

  • Sign-in: rec_auth_cookie keeps you signed in for up to 90 days. Google sign-in also uses short-lived cookies, and the password reset forms use a security cookie.
  • Page tests: wm_ab holds a random letter, a or b, so I can test two versions of some pages and show you the same one each visit. It lasts 90 days.
  • Analytics: Google Analytics sets cookies to tell visits apart. There are more details in the Google Analytics section below.
  • Advertising: Google AdSense and its advertising partners may set cookies to show ads, including ads based on your visits to other websites.
  • Security: Cloudflare, which sits in front of every site, may set its own security cookies.

Your browser's local storage also holds a few notes for the site: the days you visited in the last 30 days (used to decide when to show a note to returning visitors), prompts you have dismissed, and a quiz result waiting to be saved while you sign up. They stay on your device and are not sent to me. The installable web app also saves one offline page.

You can block or delete cookies in your browser settings. Without the sign-in cookie you cannot sign in or reset a password. Browsing and the quizzes work without cookies.

Google AdSense & Advertising

This site uses Google AdSense, an advertising service from Google LLC. Google may show ads on this site, and it uses cookies to choose them, including ads based on your earlier visits to this and other websites. Premium members do not see ads.

Google's use of advertising cookies enables it and its advertising partners to serve ads based on your visit to this site and other sites. You may opt out of personalized advertising at any time by visiting:

For more information on how Google uses data when you use its partners' sites or apps, see How Google uses information from sites or apps that use our services.

The page also checks whether an ad blocker is on. If one is, you will see a short note where the ad would go. Some sites also count how often that happens.

Google Analytics

I use Google Analytics 4 to see which pages get visited and where visitors come from. Google gets the address of each page you view, including anything in it like a search term, along with your browser, device, and approximate location, and it sets cookies to tell visits apart. I do not send your name, email address, or account ID to Google Analytics. You can opt out by installing the Google Analytics Opt-out Browser Add-on. What Google does with the data is covered by its privacy policy.

How I Use Your Information

I use the information described above to:

  • Run the site, including signing you in and saving your results and roster
  • Give you the Premium features you paid for
  • Send the emails listed below
  • See which pages and features get used, and fix what is broken
  • Limit abuse, bots, and fraud
  • Help pay for the site with ads
  • Answer your messages

I do not sell your personal information. I do not give your email address or account details to advertisers.

Who Else Gets Your Information

Some services handle part of this for me:

  • Google Analytics: counts visits to the site, as described above.
  • Google AdSense: shows ads, as described above.
  • Google sign-in and Gmail: Google handles the sign-in if you choose it. Gmail carries your contact messages to me, along with notices about new accounts and payments.
  • Stripe: takes payments on its own checkout page. See Stripe's privacy policy.
  • Resend: delivers the emails I send you, such as password resets and quiz results.
  • Cloudflare and DigitalOcean: Cloudflare sits in front of every site for speed and security. DigitalOcean hosts my server and database.
  • Adobe Fonts and jsDelivr: serve the site's fonts and the script behind the search box. Like any host, they see your IP address and the page that asked for the file.

I may also share information if the law requires it.

Email

These are all the emails the site sends to people:

  • Password resets when you ask for one.
  • Quiz results when you ask me to email one.
  • New character updates, only if you checked the box for them on the quiz. Each one has an unsubscribe link.
  • Premium emails for members: a welcome note when you first join, a reminder a few days before a renewal charge, a note if a payment fails, and a patch report for members who use the Deadlock site. The patch report has an unsubscribe link.
  • Checkout reminder: if you start a Premium checkout and leave without paying, I send one email with a link to finish it, and I never send it again.

One unsubscribe link covers both new character updates and patch reports. I also get a copy of the renewal and checkout reminders. Emails about your own account, such as a password reset or a renewal reminder, have no unsubscribe link, because you only get them when something is happening on your account. I use your email address only for the things listed on this page.

Keeping and Deleting Your Data

I keep your account until you ask me to delete it. Page view and feature use records have no expiry date, because they help me compare traffic over time. They hold a hashed IP address, and page views also hold an account ID if you were signed in, but neither holds your name or email address.

There is no delete button, so deletion is by request. Use the contact form or email me at [email protected], and tell me the email address on your account. I will delete your account, your saved results and roster, and any quiz result emails tied to your address, and I will remove your account ID from page view records. You can also ask for a copy of what I hold about you, or for a correction.

If you unsubscribed from any emails, I keep that address on a do-not-email list so I do not contact you again. If you have paid for anything, Stripe keeps its own payment records, which I cannot delete. Backups of the database age out after about a month. If you also have a LoL Recommender account, that is a separate record, so tell me if you want both deleted.

Security

Passwords are stored as hashes, card details never reach my server, and the sites use HTTPS. No site is perfectly secure, and I cannot guarantee that nothing will ever go wrong.

Third-Party Links

This site may contain links to third-party websites such as game developer portals or official game pages. These sites have their own privacy policies and I am not responsible for their content or data practices.

Children's Privacy

This site is not directed at children under the age of 13. I do not knowingly collect personal information from children. If you believe a child has given me personal information through this site, please contact me and I will remove it promptly.

Changes to This Policy

I may update this policy from time to time. When I do, I will change the date at the top of this page, and the new version applies from that date.

Contact

If you have questions about this policy, or want to see, fix, or delete your data, use the contact form or reach me at:
[email protected]