Privacy policy
What valab stores when you upload a Valorant replay, who can see it, where it is kept and how to have it removed. Short version: your matches are private to your account and other players’ real identities never leave the server.
What is stored about you
An account holds an email address, a username, and either a password hash or a link to the Discord or Google account you signed in with. A password is never stored in a form anyone can read back, including us. Sessions are stored as a hash of the cookie your browser holds, so a copy of the database cannot be replayed as a login.
If you subscribe, a customer identifier from Stripe or PayPal is stored against your account so the subscription can be managed. Card details are handled entirely by those providers and never reach valab.
What is stored about your matches
When you upload a replay, the file is read and turned into per-round data: positions and view angles, health and shields, weapons, credits, abilities, damage and round outcomes. That processed data is what the site reads from, and it stays in your account until you remove it.
The original .vrf file is deleted once its processed data is safely stored. Keeping a 40 to 70 MB file forever buys nothing: the useful content has already been extracted.
Other players in your matches
A Valorant replay contains all ten players, so uploading one necessarily brings other people's match data with it. This is handled carefully. Riot account identifiers are used only on the server, for working out who is who across your own matches, and are stripped from anything sent to a browser. A signed-out visitor sees agents, never names.
Scouting reports about other players are visible only to the account that uploaded the match they came from. They are not published, not pooled into a public profile, and not searchable by anyone else.
The demo match
One match is deliberately public, linked from the homepage so a stranger can judge the tool without making an account. It renders by agent with no real identities attached.
The .vrf inspector
The .vrf inspector reads your file entirely inside your browser using the File API. The file is never uploaded, never sent to a server and never stored. Closing the tab is the whole of its data retention.
Where data is kept
Account and match records are held in a managed PostgreSQL database. Processed match data is held in object storage. Both are accessed only by the application and by the people who operate it.
Cookies
One cookie for your session, and two short-lived ones during a Discord or Google sign-in that exist to make that flow safe from cross-site request forgery. They expire within ten minutes. There are no advertising or cross-site tracking cookies.
Deleting things
To remove a single match, or to delete an account entirely along with every match and processed record attached to it, email contact@valab.gg from the address on the account and it will be done.
There is no self-service delete button yet. Saying so plainly is better than describing a control that does not exist on the one page whose whole purpose is to be relied upon.
Changes
Material changes to this policy will be noted in the changelog with the date, rather than quietly swapped in.