Privacy Policy

Only what the site needs to work. Which of these exist depends on how you signed up:

• Discord ID, username and avatar — if you log in with Discord, so we can recognise you and show you to your clan.
• Email address and a hashed password — if you sign up directly instead. The password is hashed, never stored as you typed it.
• Your OSRS account name — required, because skill races are scored from the public hiscores and those are looked up by name.
• A display name, if you set one instead of using your Discord name.
• Your Discord servers, cached from Discord when you log in, so events restricted to a server know whether you are in it.
• Event progress — which events you joined, your position on a board, tiles you completed, and XP figures read from the hiscores.

Being logged in means a session record, and a session record includes your IP address and your browser's user-agent string alongside your account. It is deleted when you log out, and a session you leave alone is discarded after 2 hours of inactivity — that is the whole of how long it is kept. Admin actions are recorded with an IP address too — see below.

Turning on notifications registers the device you turned them on from. That means storing an address your browser hands out for this purpose, the keys needed to encrypt a message so only that device can read it, and the browser's user-agent string so you can tell your own devices apart in settings. Each device you enable is its own record, and you can remove any of them under Settings → Notifications.

A notification is delivered by the push service your browser belongs to — Google for Chrome, Apple for Safari, Mozilla for Firefox. They carry the message, and they cannot read it: it is encrypted with your device's keys before it leaves this server. They do learn that this site sent your device something, and when.

If your account has an email address, hosts of events you joined can also have the site email you when their event is paused, cancelled or started again. There is no marketing mail of any kind, and nothing else is ever sent to that address.

• An invite link records who created it and who used it, so a host can see who joined their event and revoke a link that is being passed around. Both survive the invite being used.
• A team can be tied to a Discord server, and then stores that server's id and name so membership of it can be checked.

• We do not read your Discord messages. The login only ever asks for your identity and your server list.
• We do not run analytics, advertising or third-party tracking of any kind.
• We do not sell or share your data with anyone.

Actions taken by site admins — granting a role, deleting an account — are recorded in an audit log so there is a record of who did what. An entry keeps the display name of the account it was about even after that account is deleted, because an entry that reads "deleted user" is not a record of anything. It also stores the IP address the action came from.

Entries are deleted after 90 days. That is the whole retention period, and it is the reason the paragraph above is a limit rather than an open ending.

A few outside services are involved, and each has its own policy:

• Discord, for logging in — see their privacy policy.
• [Wise Old Man](https://wiseoldman.net), for reading OSRS hiscores. We send them the OSRS account name you gave us so they can return your XP. Nothing else about you is sent.
• Your browser's push service — Google, Apple or Mozilla — but only if you turn notifications on, and only ever carrying a message they cannot read.

One more, only where a host has set it up: an event can be pointed at a Discord webhook, and when it is, that event's title and whether it has been paused or cancelled are posted into that server. That is a destination the host chooses, not us.

You can change your display name and OSRS username yourself under Settings, choose which notifications you get, and remove any device you registered. You can also delete your account yourself, under Settings → Account — nobody has to approve it and you do not have to ask anyone. It takes your progress with it, and the page tells you what happens to any event you host before you confirm.

If you cannot reach that page — you have lost access to the account, or something is broken — mail us and we will do it for you.