Privacy Policy

Who this policy covers

This policy describes how the independent operator of RuneMarket handles information through runemarket.app. RuneMarket is a fan project and is not operated by Jagex Limited. You can use the public market tools, published changelogs and support page without an account.

Information we collect

Accounts: your username, display name, optional email address, chosen profile picture, account role and account status. Our authentication service handles your password. RuneMarket stores a salted hash of your security answer rather than the answer itself.

Saved tools: watchlists, price targets, buy lists, alchemy plans, trading journal entries, recorded purchases and preferences you choose to save.

Support and suggestions: your messages, replies, status history and any details you submit. Guests must provide a contact email to open a support request; signed-in users do not need to provide email. Browser and screen details are included in a ticket only when you select that option. Suggestions are public to users who can access them; support tickets are private.

Security and service records: IP addresses, sign-in and access times, request information, abuse-prevention counters and administrative actions. Hosting providers may also process browser and connection details to deliver and protect the service.

How we use information

We use information to provide accounts and saved tools, answer support requests, deliver requested password recovery and price alerts, maintain the website, investigate problems and protect users against misuse. We do not need your RuneScape account password, game login or payment-card details.

Cookies and browser storage

A secure session cookie keeps you signed in. Browser storage remembers preferences, recently viewed items, comparisons and cached workspace state. A private browser key lets a guest return to their support requests in the same browser. Clearing site data can remove that guest access and locally remembered settings.

RuneMarket does not currently run advertising trackers or client-side analytics on this site. Operational logging and abuse prevention remain necessary for running the service.

Browser notifications

Browser notifications are optional. When you enable them, we store the browser subscription and its delivery keys so price targets can be checked and notifications delivered while the website is not open. Your browser and its push-service provider process notification delivery.

You can turn notifications off in Alerts or Settings, or revoke permission in your browser. Signing out disconnects that browser from account notifications. Delivery depends on browser support, device settings, network access and reported market data.

Providers and external sites

RuneMarket uses Google Cloud services for hosting, authentication, its database, profile-image storage and application services. Account data is hosted primarily in the United States; providers may process service and security information in other locations. Authorized operators can access information needed for support, administration and security.

Prices and game-item information come from the OSRS Wiki. Your browser may contact the Wiki when loading an externally hosted item image. External Wiki and Ko-fi links open services governed by their own policies. Contributions through Ko-fi are processed there; RuneMarket does not collect your payment-card details.

Retention and deletion

Saved account information remains available while your account is active. Support, moderation and security records may be retained to handle requests, investigate misuse or meet applicable obligations. Access-history records are scheduled to expire after 90 days; the latest access details may also remain on the account record. Infrastructure logs and backups have separate retention periods, and automated expiry is not immediate.

You can edit your profile, remove saved entries and export an account backup. Request account deletion from Account or Contact us. Deletion requests are reviewed; disabling an account is not the same as permanently erasing all its records. We may need to verify ownership before deleting data, and backup copies can remain until they expire.

Your choices and privacy requests

Email is optional for an account and can be added, changed or removed in Account. You control your profile picture, saved tools and notification permission. Depending on where you live, you may have rights to access, correct, export or delete personal information, or to object to certain processing.

Use Contact us to submit a privacy or data request. You do not need an account to open a ticket, but guests must provide a contact email. We may ask for enough information to confirm ownership; never send passwords or security answers in a ticket.

Changes to this policy

We may update this policy when the service or its data practices change. The date at the top identifies this version. Material product changes may also be described in the public Changelog.