Privacy Policy
What we hold: an email address, a password hash, the trades you type in, and the settings you choose. No trackers, no advertising, no data sold.
Last updated 4 August 2026
What we collect
Only what running the service needs:
- Account — your username, display name, email address if you give one, and a hash of your password. We cannot read your password.
- Security — the IP address and browser user-agent of each sign-in and active session, and a record of failed sign-in attempts. This is what makes “who else is signed in as me?” answerable, and what stops password guessing.
- Your trading — the trades, fills, prices, watchlist, alerts and settings you enter. This is the product; it is not analysed for any purpose but showing it back to you.
- Billing — if you subscribe, the plan you are on and the identifiers our payment provider gives us. We never receive or store card details.
We do not collect your RuneScape credentials, and we have no way to use them if you sent them to us. Do not.
What we do not do
No advertising, no advertising identifiers, no third-party analytics, no tracking pixels, no selling or renting your data to anyone. The only cookies are the one that keeps you signed in and the one that protects forms against cross-site submission; both are strictly necessary and neither follows you anywhere.
Who else sees it
Four kinds of processor, and no one else:
- Hosting and database — the servers OSRS Terminal runs on, which hold the database.
- Payments — our payment provider, who take the payment as merchant of record and tell us which plan you are on.
- Email — the relay that delivers password resets, address confirmations and security notices. It sees your address and the message.
- AI review — if, and only if, you press the button that asks for one, a snapshot of your performance figures and open trades is sent to Anthropic's API to be summarised. It is not sent otherwise, it carries no account identifiers, and Anthropic does not train on API data.
Price data flows the other way: we read the OSRS Wiki prices API and send it nothing about you.
How long we keep it
Your account data for as long as the account exists. Sessions until they expire, failed sign-in attempts for seven days, and price history for as long as it is useful to the rankings.
Delete your account and the ledger, watchlist, alerts, settings and sessions go with it, immediately and for good. Records we are legally required to keep -- an invoice, mostly -- are kept by the payment provider under their own policy.
Your rights
You can see and export everything you have entered from inside the app, change your email or password at any time, and delete the account outright from account settings. Depending on where you live you may also have the right to ask for a copy of what we hold, to have it corrected, or to complain to a data protection authority.
Write to the address on the site and we will answer within 30 days.
Security, children, and changes
Passwords are hashed, session cookies are HTTP-only and never contain the session itself, two-factor authentication is available and recommended, and reset links are stored only as hashes so a stolen backup is not a set of live links into accounts. No system is perfect; if we ever have a breach that affects you, we will tell you.
The service is not for children under 16.
If this policy changes we will update the date at the top and, for anything material, tell you in the app or by email.