Hardcore World Tool Kit - privacy notice

For the RuneLite plugin "Hardcore World Tool Kit" and this collection server.

Data from this service must not be used for real-world trading. It is a community tool for the game's Grand Exchange on the Hardcore Worlds, provided as is.

Who is responsible

Controller: Novith. Contact for privacy questions and requests: Discord @Novith.

What is collected

Only if you switch on sharing in the plugin (Connect). Nothing is sent before that. For each Grand Exchange event of your own (an offer placed, filled or cancelled, a trade from your GE history):

• the item, price, quantity and time (all Hardcore Worlds are filed together: the world you are on is not sent);
• a random install id the plugin generates on your computer (not your name or your RuneLite account);
• a hashed account id: the plugin hashes RuneLite's account identifier before sending, and the server hashes it again with a secret key, so it can't be turned back into your account;
• for each offer: its GE slot, a random per-offer key the plugin makes up, and when it was placed; and when you log in, a snapshot of your open offers (item, price, quantity, how much has filled);
• item names, icons and GE buy limits as your RuneLite client shows them, and the time your client sent the upload (to correct for a wrong clock).

No usernames, character names, chat or anything else from the game are collected. The only identifiers kept are the random install id and the hashed account id.

IP addresses

The plugin does not put your IP address in anything it sends. The server never stores your IP address, never logs it and never keeps a hash or any other value derived from it. Like any server, it sees the address a connection comes from while it answers that request; it uses it only for short-lived flood protection held in memory (for example how many uploads or registrations came from one address in the current minute or hour). Those counters are never written to the database, to disk or to a log, are never sent back, and are dropped when their minute or hour is over (and whenever the server restarts). Bans and abuse review work with the install id and the hashed account id only. The hosting provider's own request logs, which would contain addresses, are excluded from storage for this service. Earlier versions of the server kept a daily-changing keyed hash of the address; it has been erased from the database and its files, and the last backups that may still hold it expire within about 7 days.

Why

• To show market statistics to everyone (prices, volumes, open offers), which is what the plugin and dashboard display.
• To prevent abuse: fake trades, floods and impersonation.

Legal basis

Your consent, given by switching on sharing (Connect). You can withdraw it at any time by switching sharing off. Abuse prevention (rate limits, the in-memory flood counters, trust records, review of suspicious uploads, bans and the record of what the operator did about them) is based on legitimate interest.

How long it is kept

• IP addresses: not kept at all (see above); an in-memory flood counter is dropped at the latest a minute after its minute or hour is over.
• Install id, hashed account id and per-offer keys on individual trades: 90 days, then removed (the trade stays only as an anonymous price/quantity record).
• Open-offer snapshots and per-offer state: 30 days after the last update.
• Links between your install id and your hashed account id: 90 days after their last use.
• Trust records (install id or hashed account id with counters such as how many of your trades were consistent): 180 days after your last upload.
• Install registrations (install id and a hash of its key): 1 year after your last upload.
• Review flags (automatic notes about impossible or suspicious uploads): 1 year.
• The operator's audit log (bans, purges, reviews; the ids in it are hashed): 2 years.
• After a deletion: a hash of the deleted install id for 30 days (so it can't be registered again) and a record that the deletion was done, with the same hash, for 30 days.
• Aggregated statistics (prices, volumes per hour) are kept; they contain no identifiers.
• Database backups keep deleted data for about 7 days until they expire.

The identifiers are pseudonymous, not anonymous: someone with the server's secret key and your RuneLite account identifier could check whether a hashed account id is yours.

Who processes it

Google Cloud (Cloud Run and Cloud SQL) in the europe-north1 region (Finland) hosts the server and the database.

Another plugin by the same person

The same person also runs the RuneLite plugin "Deadman Tool Kit", whose server uses the same database. The two plugins use different install ids and different hashed account ids, so nothing links what one of them sent to what the other sent, and their prices are kept apart.

How to delete your data

• In the plugin: Privacy → Delete my shared data. It deletes everything your install shared (trades, offers, its install id, trust record and links, and the trust record of a hashed account id used only on this install) and recalculates the market totals without it, then disconnects.
• Or call DELETE /v1/me with your install token (Authorization: Bearer <token>).
• Switching sharing off stops all sending at once.

If you play on several computers, delete on each of them: a deletion only covers what that install sent, so nobody can delete another player's data by guessing their account id. Review flags about your install keep their counts without your ids. A ban of your hashed account id, and the operator's audit log (the ids in it are hashed), are kept for abuse prevention (periods above). For anything else (access, correction, questions, or a lost install key - the plugin then shows your install id), write to the contact above.

Your local files

Your own trade log and profit history stay on your PC, in RuneLite's folders. They are not uploaded and deleting your shared data does not touch them.

Your rights

You can ask for access, correction, deletion, restriction or portability of your data, and you can complain to your data protection authority.