Privacy Policy

We only collect data needed to run the Service:

• Account data (only if you sign in). We use "Sign in with Discord". When you authorise it, Discord sends us your Discord user ID, username, avatar URL, and email address. We store these to create and identify your account.
• Feature data you create. Watchlist items, custom item lists, saved flip presets, price alerts (including the threshold and notification channels you choose), and any buy/sell transactions you add to or import into the Profit Tracker.
• Premium status. Whether your account has Premium and, for timed grants, an expiry date. If you redeem a premium code, we record which code was redeemed and when.
• Session & security data. A session record and cookie that keep you signed in.
• Server logs. Our server may briefly log request metadata (IP address, timestamp, path, user agent) for security and debugging. These are not used to build profiles.

We do not collect your RuneScape account credentials, run any advertising trackers, or sell personal data.

• To authenticate you and keep you signed in.
• To store and display the watchlists, lists, presets, alerts and transactions you create.
• To send you a price-alert email when an alert you configured is triggered (only if you enabled the email channel for that alert).
• To provide, maintain, secure and debug the Service.

Legal bases (GDPR): performance of a contract (providing the account and features you request), legitimate interests (security, abuse prevention, keeping the Service working), and consent (optional cookies described below).

We keep cookie use to a minimum:

• Strictly necessary — session cookie. Set by our authentication layer (Auth.js) after you sign in, to keep you logged in and protect against cross-site request forgery. This cannot be disabled while signed in and does not require consent.
• Strictly necessary — consent cookie (mw_consent). Stores your cookie choices so we don't ask again on every visit.
• Optional — analytics. Anonymous usage measurement. None are currently set. If we add them, they will only load after you opt in.
• Optional — preferences. Remembering UI choices (sort order, filters) between visits. None are currently set. If we add them, they will only be used after you opt in.

We also use your browser's local storage for the same necessary consent record and, where you opt in, preference values. You can review or change your choices at any time:

Cookie settings

We share data only with the processors needed to operate the Service:

• Discord — identity provider for sign-in. Governed by Discord's own privacy policy.
• Resend — email delivery provider. Receives your email address and the alert content when a price-alert email is sent.
• Hosting — the Service runs on our own self-hosted server infrastructure; the database is self-hosted and not operated by a third-party managed provider.

Market data (item prices, volumes, mappings) is fetched by our server from the Old School RuneScape Wiki real-time prices API and Jagex's Grand Exchange catalogue. These requests contain no personal data about you.

We may disclose data if required by law or to protect the Service against fraud or abuse.

Account and feature data is kept for as long as your account exists. Triggered price alerts and Profit Tracker entries remain until you delete them. Server logs are retained only briefly. If you ask us to delete your account, we remove your account record and associated feature data.

Subject to applicable law, you may request access to, correction of, export of, or deletion of your personal data, and you may object to or restrict certain processing. Because sign-in is optional and we collect little data, the fastest route for most requests is to email us. You also have the right to lodge a complaint with your local data protection authority.

Data is transmitted over HTTPS and the application sends a strict Content-Security-Policy and related security headers. Access to the database is restricted to the application. No system is perfectly secure, but we take reasonable measures to protect your data.

The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. Note that Discord has its own minimum age requirement.

We may update this policy as the Service evolves. Material changes will be reflected in the "last updated" date above, and if we introduce optional cookies you will be asked to consent before they are used.

Questions or requests about your data: frontrangemycology@gmail.com.