Legal
Privacy Policy
Last updated: 18 July 2026
CinderGrind is a free, fan-made companion tool for Old School RuneScape. This policy explains what data we collect, why, and what you can do about it.
We collect as little as possible. If you never create an account, we store no personal information about you at all.
Contact: 88embers@gmail.com
1. What we collect
If you use the site without an account
- Nothing personal. We do not run advertising or any form of tracking that identifies you or follows you across sites.
- Cookieless analytics. We use Vercel Web Analytics to see aggregate traffic patterns — pageviews, referrers, country, and device type. It identifies a visit using a hash derived from the request that rotates daily and is then discarded, so it cannot track you across days or across other websites, and it never uses cookies. No personal information is collected, and no advertising or cross-site tracking is involved. See section 4.
- Local browser storage only. We save your last-looked-up RuneScape username and your light/dark theme preference in your own browser's local storage. This never reaches our servers. Clearing your browser data removes it.
If you create an account
- Your email address. This is the only piece of personal information we store. We use it solely to send you a sign-in link and to identify your account. We do not use passwords.
- RuneScape usernames you choose to track.
- Your preferences and progress data: theme choice, goals you set, routes you save, milestones you mark complete or dismiss.
- Imported bank data, if you choose to paste in an export from a RuneLite plugin. This is item IDs and quantities. It contains no personal information and is only used to show which gear you already own.
What we never collect
- Passwords (we don't use them)
- Payment or card details (see section 3)
- Your Jagex or RuneScape account credentials — we never ask for these and never will
- Advertising identifiers
- Behavioural tracking / cross-site tracking
- Any special-category personal data
2. Game data
When you enter a RuneScape username, we fetch that account's publicly available hiscores data through the Wise Old Man API. This information is public — anyone can look it up without an account, and we have no access to any private part of a Jagex account.
Entering a username does not link your CinderGrind account to your Jagex account in any way. The two are entirely separate.
3. Third parties
We keep the list short. These are the only services involved:
| Service | What it does | What it sees |
|---|---|---|
| Supabase | Database and sign-in | Your email address and your saved data |
| Vercel | Website hosting | Standard server request logs, including IP addresses, kept briefly for security and reliability |
| Vercel Web Analytics | Aggregate traffic statistics | Anonymous, aggregated page requests — no cookies, no cross-site tracking, nothing tied to you personally |
| Wise Old Man | Public hiscores data | The RuneScape usernames you look up |
| OSRS Wiki | Item prices and images | Nothing about you |
| Ko-fi / Stripe | Donations, if you choose to donate | Handled entirely on their site — we never see or store your payment details |
Donations are optional. If you never donate, Ko-fi and Stripe receive nothing about you.
4. Cookies
We use essential cookies only — specifically, the cookies Supabase needs to keep you signed in. We do not use advertising or tracking cookies, and our analytics (Vercel Web Analytics, sections 1 and 3) is itself cookieless.
Because we use no non-essential cookies, and our one analytics tool doesn't use cookies or any equivalent tracking technology at all, there is no cookie/analytics consent banner to click through — there's nothing being collected that legally requires one.
5. Why we're allowed to hold your data
Under the UK and EU GDPR, our lawful basis is:
- Consent — you provide your email and create an account voluntarily, and you can withdraw at any time by deleting your account.
- Legitimate interests — for basic server logs and rate limiting, which are necessary to keep the service running and protect it from abuse.
6. Your rights
Whoever and wherever you are, you can:
- Access and export your data. There is a one-click export in your account settings that downloads everything we hold about you as a JSON file.
- Delete everything. There is a self-serve "Delete my account" option in your account settings. It permanently removes your account and every associated record immediately. This cannot be undone.
- Correct your data. You can edit your tracked usernames, goals, and preferences directly in the app at any time.
- Withdraw consent by deleting your account.
- Object or restrict processing — email us.
If you are in the UK, EU, or another region with a data protection authority, you also have the right to lodge a complaint with your local regulator.
If you are a California resident: we do not sell or share personal information, and we have no financial incentive programmes.
7. How long we keep things
We keep your data until you delete your account. When you delete it, your records are removed immediately and permanently — there is no soft-delete or archive copy. Vercel's server logs roll off on their own short retention schedule.
8. Where your data lives
Our infrastructure providers (Supabase and Vercel) may process data in the United States and other countries. Where required, these transfers rely on the providers' own standard contractual clauses and equivalent safeguards.
9. Security
All traffic is encrypted in transit over HTTPS. Your data is protected at the database level by row-level security policies, meaning your records can only ever be read by your own authenticated session. We use sign-in links rather than passwords, so there are no password hashes to leak.
No system is perfectly secure, but we've deliberately minimised the amount of data worth stealing.
10. Children
CinderGrind is not intended for anyone under 16. We do not knowingly collect information from under-16s. If you believe a child has created an account, email us and we will delete it.
11. Changes
If we change this policy, we'll update the date at the top. Material changes affecting how we use your data will be announced in the app.
12. Contact
Questions, requests, or complaints: 88embers@gmail.com
CinderGrind is not affiliated with, endorsed by, or associated with Jagex Limited.