Effective Date: October 20, 2026
Idioma / Language: Este documento está disponible en español. This document is available in Spanish. → POLÍTICA DE PRIVACIDAD (Social) — español
Cunaguaro S.A.S. ("Cunaguaro," "we," "us," or "our") operates the Broken Duo mobile application (the social product for League of Legends players), the backend API services, and any related websites (collectively, the "Services"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our Services. It is separate from the Privacy Policy of our Punch desktop coaching product.
By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.
This Policy applies to all Services provided by Cunaguaro S.A.S., a company incorporated under the laws of the Oriental Republic of Uruguay. The Services are available in the Supported Regions listed at https://punchai.gg/about, subject to change as we expand to additional countries and servers. This Policy is governed by Uruguayan data protection law (Ley N° 18.331), as well as applicable international regulations including the GDPR where relevant.
Uruguay has been granted an adequacy decision by the European Commission, meaning Uruguayan data protection standards are recognized as equivalent to those of the European Union.
Unlike our Punch desktop product, Broken Duo is a social service and stores your social activity on our servers so that other players can see and interact with it. This includes:
Some of this information (for example your Riot ID, region, rank, role, badges, reputation, and the content of your LFG posts and parties) is visible to other users of the Services. Do not include personal information in free-text fields such as LFG descriptions or party names that you do not want others to see.
Broken Duo does not read live match data from the League of Legends client on your device.
When you use the Services, we automatically collect:
Anonymous votes. Votes are anonymous. We never show anyone, including the rated player, who voted, how they voted, or when. The rated player sees only their total reputation score. We keep the voter's identifier internally only to enforce limits and prevent abuse.
Conduct labels, not free text. A vote carries up to three labels from a closed list (good communication, team player, positive attitude, reliable, toxic communication, left the match, griefing). You cannot write free text in a vote. Labels describe conduct only: they are not a skill rating, they have no relation to Riot's ranked ladder, and they are not a rating of anyone's gameplay.
Parties of two. If your party has only two members, the other player may be able to infer that a change in their reputation came from you. We send no vote notifications and show no vote history, but we cannot fully prevent this inference.
Votes are final. Votes cannot be edited or withdrawn. Some votes may be recorded without changing the score (for example, when daily limits apply).
We use the collected information for the following purposes:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide and maintain the Services (LFG feed, parties, reputation, badges, leaderboards, account linking) | Riot ID, PUUID, social activity data | Performance of a contract (Terms of Service) |
| Deliver and measure advertising (banner ads via Google AdMob, Android only for now) | Advertising ID, device data, ad interactions, age band | Personalized ads (accounts confirmed as 18 or older only, and where permitted by law): consent, where Google's consent form is shown to you; the legal basis in other regions is under review. Non-personalized ads (accounts with unknown age), ad performance measurement and frequency capping: legitimate interest |
| Improve, personalize, and develop the Services | Usage data, error logs | Legitimate interest |
| Create and secure your account: verify your email with a one-time code, keep you signed in, and send service messages (sign-in codes, deletion confirmation) | Email, one-time code records (including a hashed IP address), session token hash | Performance of a contract (Terms of Service) |
| Send news and offers from Broken Duo and Punch by email (optional) | Email, marketing consent record (date, wording version, language) | Your express, informed, and revocable consent (opt-in); never a condition of using the Services |
| Comply with legal obligations and enforce our Terms | All categories as needed | Legal obligation; legitimate interest |
| Ensure security, prevent fraud, and detect abuse | IP, device data, usage patterns | Legitimate interest; legal obligation |
| Moderate conduct votes and prevent reputation manipulation | Votes, conduct labels, party membership times | Legitimate interest (integrity of the reputation system and abuse prevention) |
Where we rely on legitimate interest as a legal basis, you have the right to object to such processing. Where we rely on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Separate purposes. We use your email for account and security purposes whether or not you opt in to marketing. We use it for marketing only if you opted in. You can withdraw your marketing consent at any time and without signing in: every marketing email carries a visible unsubscribe link, and the same message supports one-click unsubscribe from your email client. Withdrawal takes effect immediately, is recorded, and a later sign-in never restores it unless you opt in again; you can also write to legal@punchai.gg. Withdrawing it does not affect your access to the Services.
Broken Duo offers a free tier funded by advertising. Free users see banner advertisements displayed within the Android application, served by Google AdMob. The iOS application shows no ads today. Ads start only after you have confirmed your age band: until then the app requests no ads. We do not currently offer paid features; if we introduce them in the future, we will update this Policy before they become available.
We use Google AdMob, an advertising service provided by Google, to display banner ads. Google and its partners may use your Advertising ID and similar device identifiers to:
The app does not request ads, and does not start Google's advertising and consent components, until your age band is known. For accounts confirmed as 18 or older, the app uses Google's default settings. For any account whose age band is not known, the app tells Google that the user is under the age of consent, requests non-personalized ads only and limits the maximum content rating to PG; these accounts still see ads. Google's User Messaging Platform (UMP) consent form is shown only in the countries where our AdMob account is configured to show it, which may not be every country where the Services are available; where the form is not shown, the app does not collect a separate ad consent. If you do not consent to personalized advertising, or if personalized ads are not available to your account, ads are served in a non-personalized mode, which may still involve limited use of device data for frequency capping, fraud prevention, and ad measurement. For more information on how Google uses data, see Google's Privacy Policy and How Google uses information from sites or apps that use its services.
You can control whether your data is used for personalized advertising by:
Broken Duo is a mobile application and does not rely on browser cookies. We and our partners use the following technologies instead:
You can clear locally stored data by clearing the app's storage or uninstalling the application, and you can reset your Advertising ID in your device settings. Disabling essential storage may impair the functionality of the Services.
We do not sell your personal information. We share information only in the following circumstances:
We engage third-party vendors to perform functions on our behalf, including:
We share with each provider only the data its function needs, and we intend each provider to process that data only to perform that function on our behalf.
We may disclose information when required by law, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to:
In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
We may share aggregated or de-identified information that cannot reasonably identify you for research, marketing, analytics, or other purposes.
The social content described in Section 2.2 (for example your Riot ID, region, rank, role, badges, reputation, LFG posts, and party information) is visible to other users of the Services as part of the product's normal operation. Specifically, your Riot ID (Game Name + Tag) is shown to other signed-in users in the LFG feed, in party member lists, and on your profile, so that players can add each other in the League of Legends client. Other users also see an opaque public identifier that we generate for your account; it does not reveal your Riot account identifier (PUUID), which stays internal and is never shown to other users. Your email address is never shown to other users. Your individual votes and the conduct labels they carry are never shown (see Section 2.4).
Cunaguaro S.A.S. is based in Uruguay. Some of our service providers may process data in other countries (e.g., the United States, through our hosting and email providers). When we transfer personal data internationally, we aim to rely on safeguards recognized by applicable law. The mechanism that applies to each provider is being confirmed; it may include:
We retain personal information only for as long as necessary to fulfill the purposes described in this Policy:
| Data Category | Retention Period |
|---|---|
| Account data (email, Riot ID) | Retained while the account is active; deleted immediately when you delete your account |
| Age band (confirmation of being 18 or older) and confirmation date | Retained while the account is active; both are removed when you delete your account. A copy kept with a one-time code record is deleted with that record (up to 24 hours after it expires) |
| Marketing consent record (whether you consented, date, wording version, language) | Retained while the account is active; after account deletion it is kept without your email address as part of the closed account record, as evidence of consent; see Section 8.1 |
| Marketing opt-out record (a keyed, non-reversible hash of your email address — never the address itself — the reason and the date) | Kept for 1095 days (3 years) after you unsubscribe or delete your account, then deleted automatically; used only to keep marketing email away from that address |
| Riot account identifier (PUUID) after account deletion | Retained without contact data (no email, no Riot ID), indefinitely in this version, for integrity and abuse prevention; the PUUID is stored only on our servers and is never shown to other users; see Section 8.1 |
| Sanction block record (a keyed, non-reversible hash of your PUUID, of your normalized email address and of your Riot ID, the reason and the date) | Kept for up to 24 months, then deleted automatically, only when your account is closed for a violation of our Terms or the law; used to prevent you from registering again to evade that decision (never kept when you delete the account yourself); see Section 8.1 and the Terms of Service Section 16.3 |
| Verification (one-time code) records | Valid for 10 minutes; kept for up to 24 hours after they expire (to count abuse attempts), then deleted automatically; also deleted immediately when you delete your account |
| Session records | A session ends after 90 days without use or 365 days after it started, or when you delete your account; ended sessions are kept for 30 days, then deleted automatically |
| LFG posts | Expire after 24 hours and are permanently deleted by an automated cleanup job; also deleted immediately when you delete your account |
| Parties and party membership | Retained while the account is active; on account deletion your memberships are marked as deleted (soft delete) and may be retained for integrity and abuse prevention; see Section 8.1 |
| Teammate reputation votes, badges, and streaks | Retained for the duration of the account (needed to compute reputation and leaderboards); on account deletion the streak is deleted, badges are marked as deleted, and votes are kept as a +1/-1 ledger detached from any account; see Section 8.1 |
| Reports (reports you file and reports filed about you) | Resolved reports are kept for 365 days (12 months) after they are resolved, then deleted automatically; the automatic cleanup does not delete open reports. When you delete your account, the free-text details of the reports you filed are deleted immediately and the report record is kept without them; see Section 8.1 |
| Push notification tokens | Deleted when you sign out of your last active session, when you sign out of all devices, and immediately when you delete your account. Turning off notifications in your device settings does not delete the token. |
| Usage analytics and error logs | 2 years |
| Advertising data | Collected and processed by Google AdMob under Google's own policies; we do not retain your Advertising ID on our servers |
We may retain information for longer periods where required by law, to resolve disputes, or to enforce our Terms of Service.
You can delete your account in the app (Profile → Delete account) or, if you no longer have the app, by email to legal@punchai.gg (see Section 9). When the deletion is completed:
Under Uruguayan law (Ley N° 18.331) and, as a secondary reference where it also applies to you, the GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, write to legal@punchai.gg. Requests are handled manually by a person; the app has no form for them. Under Ley N° 18.331 (arts. 14 and 15) we will answer an access request within 5 business days, and a request to rectify, update or delete your data within 5 business days of receiving it. You can exercise your right of access free of charge once every 6 months. Where the GDPR also applies to you, its own periods apply in addition. We may ask for proof of identity before processing your request. If you are a rated player, our response to an access request may omit or anonymize vote details where disclosing them would reveal who voted.
If you believe our processing violates data protection law, you have the right to lodge a complaint with the Unidad Reguladora y de Control de Datos Personales (URCDP) in Uruguay or the supervisory authority in your country of residence.
The Services are not directed at anyone under 18 and are not intended for children. At sign-up, the app asks you to confirm that you are 18 or older: if you say you are under 18, the app blocks you on your device, sends nothing to us and stores nothing. We store only the confirmation (an age band) and the date you confirmed it, not your date of birth, and we do not verify it with documents. Accounts whose band is not known see only non-personalized ads with a maximum content rating of PG (Section 4). The band is removed when you delete your account. We do not knowingly collect personal information from children. If we become aware that an account belongs to a person under 18, we will close the account and delete its data as described in Section 8.1. If you believe a person under 18 has provided us with personal information, please contact us at legal@punchai.gg.
We implement appropriate technical and organizational measures to protect your personal information, including:
However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
Data Breach Notification: In the event of a personal data breach, we will notify the Unidad Reguladora y de Control de Datos Personales (URCDP) within 72 hours of becoming aware of the breach, and will notify affected users without undue delay, in accordance with Ley N° 18.331 and applicable regulations.
The Services may contain links to third-party websites or services (e.g., Riot Games). This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you interact with.
The Services also interact with the Riot Games ecosystem. League of Legends and all related marks are the property of Riot Games, Inc. Broken Duo isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games and all associated properties are trademarks or registered trademarks of Riot Games, Inc.
We do not currently respond to "Do Not Track" (DNT) signals sent by browsers or desktop environments, as there is no consistent industry standard for DNT.
We may update this Privacy Policy from time to time. Material changes will be communicated through: - An email to registered users (where applicable) - A posting on our website
The Services have no in-app notice of changes. The updated Policy will be effective 30 days after such notice, unless a different effective date is stated. Continued use of the Services after that date constitutes acceptance of the updated Policy.
Cunaguaro S.A.S. Uruguay, Oriental Republic of Uruguay
For questions, concerns, or to exercise your data protection rights:
Last updated: October 20, 2026