Privacy Policy

RuneTools (“we”, “us”) is a set of Old School RuneScape tools at runetools.com (Grand Exchange prices, calculators, a bestiary and player profiles) with a companion RuneLite plugin. This policy explains what we collect, why, and your choices. We try to collect as little as possible.

What we collect

• Account data (only if you create an account): your email address, a securely hashed password (never stored in plain text), and a display name. If you sign in with Discord, we store your Discord user ID and nothing else from Discord.
• Data you create: watchlists, price alerts, an optional Discord webhook URL you provide for alert delivery, any trade history you choose to import, gear setups, bank layouts you share, your Combat Achievements plan and your calculator preferences.
• RuneLite plugin data (only if you install the RuneTools plugin and connect it to an account): the character name and account hash that tie your character to your account, plus what each plugin feature syncs: completed Grand Exchange trades, coins, GE offers and inventory, skill levels and experience, Combat Achievements, Collection Log progress and new log items, the achievements on your Adventurer's Log, gear setups, bank layouts you share and your bank contents (only with Include bank on). Each feature can be switched off in the plugin's settings. The plugin signs in with an API key we store only as a hash.
• Public game data: a player profile shows the official Old School RuneScape Hiscores for the name it is about. When a profile is viewed we keep snapshots of those public Hiscores so its Adventurer's Log can show milestones (99s, kill counts and the like) as they happen.
• Technical data: standard server logs (IP address, browser/user-agent, requested pages, timestamps) kept briefly for security and abuse prevention.

What is public

A player profile and the site's latest-achievements feed show Hiscores milestones for any name, because the Hiscores are public. Drops and achievements your plugin reports appear on your profile only once you have proven the character is yours, and never while your profile is set to private. Public entries show the day something happened, not the time, and never what a drop or reward was worth in GP; a synced profile shows the day you last synced. If you turn on Post my achievements in the RuneTools Discord on your account page, our Discord bot also posts those same public entries in the RuneTools Discord server. It is off unless you turn it on, and turning it off stops new posts. Everything else you store with us is visible only to you.

Cookies

If you sign in we set a single strictly-necessary, signed session cookie to keep you logged in. Umami (see below) is cookieless. Google Analytics and the ads on our pages (Google AdSense) use cookies and similar technologies; see Analytics and Advertising below.

Analytics

We use Umami, a privacy-friendly, cookieless analytics tool, to count page views and rough visitor numbers in aggregate. It does not build advertising profiles or track you across other sites.

We also use Google Analytics to understand how the site is used (which pages are visited, how people arrive, how long they stay) and to see which pages the ads earn on. It uses cookies and receives your IP address and browser details. Visitors in the EEA, the UK and Switzerland are asked for consent first, and until then it sets no cookies. You can opt out everywhere with Google's opt-out browser add-on.

Advertising

We show ads from Google AdSense. Google and its partners use cookies to serve ads, including ads based on your earlier visits to this and other websites. Google's use of advertising cookies lets it and its partners show you ads based on those visits. You can turn off personalised ads in Google's My Ad Center, and opt out of other vendors' personalised ads at aboutads.info. How Google uses the information it collects on sites like ours is explained in How Google uses information from sites or apps that use its services. Visitors in the EEA, the UK and Switzerland are asked for their consent before any of this.

Gamefinity

Most pages show panels for Gamefinity, a free browser games site run by the same people as RuneTools: one above the footer, a banner at the top on phones and, on wide screens, one at the side. They are served from runetools.com, set no cookies and send Gamefinity nothing unless you click one. We count how often they are seen and clicked, as daily totals, with Umami and our own counters. To count a click once a day, we keep a one-way hash of your IP address and browser for about a day, never the address itself. Their links carry tags that tell Gamefinity the visit came from RuneTools.

Third parties

• Google: serves the ads on our pages through Google AdSense and measures site use with Google Analytics (see Advertising and Analytics above), and receives your IP address, browser details and the page you are on.
• Cloudflare: the site is delivered through Cloudflare's network, which caches public pages and protects the site from abuse. It processes your IP address and request details to do that.
• Resend: sends our account emails (email verification and password resets), so it receives your email address and the message.
• Discord: if you sign in with Discord, Discord confirms your identity to us. If you set an alert webhook, the alert content you configured is sent to the Discord webhook URL you provided. In the RuneTools Discord server, our bot gives members who connected Discord to their account the Verified player and Plugin user roles (whether the account has a proven character, and whether its plugin has synced), and posts the achievements of players who turned that on.
• Jagex: when a profile is looked up, we request that name's public Hiscores from Jagex. Game content and item sprites are © Jagex Ltd.
• OSRS Wiki: prices come from the wiki's public real-time Grand Exchange prices API, and game data (monsters, drops, items, tasks) from the wiki. We fetch these ourselves; none of your data is sent to the wiki.

How we use your data

To provide the service: authenticate you, store your watchlists, alerts and setups, deliver alerts you set up, power the plugin features you turn on (profit tracking, flip suggestions sized to your bank, your profile and Adventurer's Log), and keep the site secure and available. We do not sell your personal data.

Retention

Account data, the data you create and plugin data are kept while your account exists. Server logs are kept only as long as needed for security and operations. Hiscores milestones come from public data and stay with the name they are about. You can delete your account and associated data at any time.

Your rights

You can request access to, a copy of, correction of, or deletion of your personal data. On your account page you can download a copy of everything stored for your account (“Download my data”), disconnect a single character (which deletes what its plugin synced), and permanently delete your account and all of its data yourself at any time using the “Delete account” button. This is immediate and irreversible, and it also removes the drops and achievements your plugin reported. You can also email us at the address below and we’ll action any request.

Children

RuneTools is not directed at children under 13 (or the minimum age in your country), and we don’t knowingly collect their data.

Changes

We may update this policy; material changes will be reflected by the “last updated” date above.

Contact

Questions or data requests: support@runetools.com.

RuneTools is an unofficial fan project and is not affiliated with, endorsed by, or sponsored by Jagex Ltd. This page is provided for transparency and is not legal advice.