Hardcore World Tool Kit - privacy notice

For the RuneLite plugin "Hardcore World Tool Kit" and this collection server.

Data from this service must not be used for real-world trading. It is a community tool for the game's Grand Exchange on the Hardcore Worlds, provided as is.

Who is responsible

Controller: Novith. Contact for privacy questions and requests: Discord @Novith.

What is collected

Only if you switch on sharing in the plugin (Connect). Nothing is sent before that. For each Grand Exchange event of your own (an offer placed, filled or cancelled, a trade from your GE history):

• the item, price, quantity and time (all Hardcore Worlds are filed together: the world you are on is not sent);
• a random install id the plugin generates on your computer (not your name or your RuneLite account);
• a hashed account id: the plugin hashes RuneLite's account identifier before sending, and the server hashes it again with a secret key, so it can't be turned back into your account;
• for each offer: its GE slot, a random per-offer key the plugin makes up, and when it was placed; and when you log in, a snapshot of your open offers (item, price, quantity, how much has filled);
• item names, icons and GE buy limits as your RuneLite client shows them, and the time your client sent the upload (to correct for a wrong clock).

With Share deaths on (it is, unless you turn it off), also the text of the Hardcore death announcements the game broadcasts to everyone, with the same install id (no account id). They contain the name of the player who died and of whoever killed them (a monster or, in the Wilderness, a player); these names are kept and shown on the Deaths page. When the death is your own, the map tile you died on is sent too.

Apart from the names in death broadcasts, no usernames, character names, chat or anything else from the game are collected. The only identifiers kept are the random install id and the hashed account id.

IP addresses

The plugin does not put your IP address in anything it sends. The server never stores your IP address, never logs it and never keeps a hash or any other value derived from it. Like any server, it sees the address a connection comes from while it answers that request; it uses it only for short-lived flood protection held in memory (for example how many uploads or registrations came from one address in the current minute or hour). Those counters are never written to the database, to disk or to a log, are never sent back, and are dropped when their minute or hour is over (and whenever the server restarts). Bans and abuse review work with the install id and the hashed account id only. The hosting provider's own request logs, which would contain addresses, are excluded from storage for this service. Earlier versions of the server kept a daily-changing keyed hash of the address; it has been erased from the database and its files, and the last backups that may still hold it expire within about 7 days.

Why

• To show market statistics to everyone (prices, volumes, open offers), which is what the plugin and dashboard display.
• To prevent abuse: fake trades, floods and impersonation.

Legal basis

Your consent, given by switching on sharing (Connect). You can withdraw it at any time by switching sharing off. Abuse prevention (rate limits, the in-memory flood counters, trust records, review of suspicious uploads, bans and the record of what the operator did about them) is based on legitimate interest.

How long it is kept

• IP addresses: not kept at all (see above); an in-memory flood counter is dropped at the latest a minute after its minute or hour is over.
• Install id, hashed account id and per-offer keys on individual trades: 90 days, then removed (the trade stays only as an anonymous price/quantity record).
• Open-offer snapshots and per-offer state: 30 days after the last update.
• Death reports: who reported them (install id) 2 days; the death itself (names, region, killer, tile, time) 90 days. When a player's kill of another player is deleted, the killer's name, kill count and best kill streak are kept in an all-time list of player killers, with no victims, places or times.
• Links between your install id and your hashed account id: 90 days after their last use.
• Trust records (install id or hashed account id with counters such as how many of your trades were consistent): 180 days after your last upload.
• Install registrations (install id and a hash of its key): 1 year after your last upload.
• Review flags (automatic notes about impossible or suspicious uploads): 1 year.
• The operator's audit log (bans, purges, reviews; the ids in it are hashed): 2 years.
• After a deletion: a hash of the deleted install id for 30 days (so it can't be registered again) and a record that the deletion was done, with the same hash, for 30 days.
• Aggregated statistics (prices, volumes per hour) are kept; they contain no identifiers.
• Database backups keep deleted data for about 7 days until they expire.

The identifiers are pseudonymous, not anonymous: someone with the server's secret key and your RuneLite account identifier could check whether a hashed account id is yours.

Who processes it

Google Cloud (Cloud Run and Cloud SQL) in the europe-north1 region (Finland) hosts the server and the database.

The website and accounts

This section covers hardcore.malkana.dev (Hardcore Market Tools), which is separate from the plugin's trade sharing above. You can use the market pages without an account. If you log in with Discord we store:

• your Discord user id and display name, to recognise your account (we ask Discord only for "identify");
• your plan (free or Pro) and how it was obtained, plus a Polar customer reference if you pay (payments are handled by Polar, Inc.; we never see card details);
• what you set up: your item alerts, watchlist, alert and message settings, a Discord server webhook URL if you add one, and whether you connected the Discord bot (so it can send you messages);
• who invited you, if you used an invite link, so referral credits can be given;
• how many questions you asked in Ask the market each day (a count only). The text of your questions is sent to Anthropic, PBC to produce the answer; we don't store it or log it. With each question's usage event we note only a one-word topic (such as price, flips or swap rate) and which market data the answer looked up. When a question needs them, Ask also sends Anthropic your watchlist items, your alerts (item, kind and price) and, if you entered a character, its levels (never the name); nothing extra is stored. Don't put personal information in a question.

Your character (optional). If you enter a character name in Money Making, our server looks it up on Jagex's public Hardcore Worlds hiscores and returns its levels. The name and levels stay in your browser; we don't store or log the name, and keep the hiscores' answer in memory for at most 10 minutes. When the page filters by your levels it sends the levels (never the name) with that request, and they are used only for that answer. The levels are also sent with your Ask the market questions (from the site, or with the character option of the Discord bot's /ask, which looks the name up the same way) and used only for that answer. "Forget" or logging out removes them from your browser.

Sessions use a cookie that is kept for 30 days. Nothing here is used for advertising and nothing is sold. Discord, Polar and Anthropic process the data they receive under their own terms. You can log out at any time and ask for your account and its settings to be deleted at the contact address above.

Usage statistics. To see which parts of the site are used, the server sends usage events (for example "opened the Flips tab", "created an alert", "asked a question", "started a checkout") to PostHog, hosted in the EU. They carry a one-way hash of your account id (or, without an account, a random id your browser keeps in local storage; for a Discord bot command, a one-way hash of your Discord user id), your plan, the browser type and the page that sent you here. They never include your Discord id or name, your questions, webhook URLs or payment details. No third-party script or cookie is used for this, and nothing is sent when your browser's Do Not Track setting is on. The events are kept for at most a year.

Another plugin by the same person

The same person also runs the RuneLite plugin "Deadman Tool Kit", whose server uses the same database. The two plugins use different install ids and different hashed account ids, so nothing links what one of them sent to what the other sent, and their prices are kept apart.

How to delete your data

• In the plugin: Privacy → Delete my shared data. It deletes everything your install shared (trades, offers, its install id, trust record and links, and the trust record of a hashed account id used only on this install) and recalculates the market totals without it, then disconnects.
• Or call DELETE /v1/me with your install token (Authorization: Bearer <token>).
• Switching sharing off stops all sending at once.

If you play on several computers, delete on each of them: a deletion only covers what that install sent, so nobody can delete another player's data by guessing their account id. Review flags about your install keep their counts without your ids. A ban of your hashed account id, and the operator's audit log (the ids in it are hashed), are kept for abuse prevention (periods above). For anything else (access, correction, questions, or a lost install key - the plugin then shows your install id), write to the contact above.

Your local files

Your own trade log and profit history stay on your PC, in RuneLite's folders. They are not uploaded and deleting your shared data does not touch them.

Your rights

You can ask for access, correction, deletion, restriction or portability of your data, and you can complain to your data protection authority.