I know PII is protected, and a company like Riot is audited. I’m sure something in their TOS says they can collect the information, as BS or unenforceable as it is.

They’re probably multi-cloud, but I know they are a huge AWS customer because they have a giant booth at re:Invent every year. AWS has pretty easy ways to encrypt data and even detect if it has PII. They’d encrypt or redact the images because the potential of capturing HIPAA or PCI information is too great a risk.

If anything, trust that the company is profit driven and will avoid that risk. They’re still garbage and kernel level anti-cheat sucks, but we shouldn’t be spouting that unencrypted stuff as fact.