Privacy Policy

Who we are

OSRS Card Exchange is operated by TSMW DEVELOPMENT LTD(“we”, “us”), a company registered in England and Wales under company number 17204316, with its registered office at 11 Beechwood Avenue, Stockport, England, SK5 7QD.

We are the data controller for the personal data described here.

For any privacy question or to exercise your rights, contact us at contact@tsmwdevelopment.com.

The data we collect

We collect only what the site needs to function:

• Account details — your email address, your Old School RuneScape name, and (optionally) a chosen NPC avatar.
• Your password— stored only as a secure one-way hash, never in a readable form (see “How we protect your password” below).
• Public game statistics— your total level, total XP and combat level, read from Jagex’s public Old School RuneScape hiscores using the RuneScape name you provide, and cached to power the highscores board.
• Content you create — exchanges, trade offers and outcomes, gang-finder listings, forum threads, comments, votes, polls and quest feedback.
• Technical data — a single sign-in cookie (below), and standard server and analytics information such as your IP address, used for security, rate limiting and aggregate usage statistics.

How we protect your password

Your password is never stored in plain text and is never written to logs, included in any page, or shared with anyone. When you register or change your password, we transform it with Argon2id — a modern, memory-hard password-hashing algorithm — using parameters aligned with current OWASP guidance. Only the resulting hash is stored.

Because hashing is one-way, we cannot recover or tell you your password; we can only verify a password you enter against the stored hash. Sign-in sessions use a signed, HTTP-only cookie that JavaScript on the page cannot read, and the whole site is served over HTTPS.

How we use your data, and our lawful basis

We process your data to provide the service you have asked for — creating and securing your account, showing you on the highscores board, letting you arrange trades and post on the forums, and sending you in-app notifications about your own activity. Under UK GDPR our lawful bases are the performance of our contract with you (running your account and the features you use) and our legitimate interests in keeping the site secure and working (for example, rate limiting and abuse prevention).

We do not sell your personal data, and we do not use it for anything outside the functionality of this website. We do not use it for third-party marketing.

Sharing and third parties

We do not share your personal data except with the service providers that make the site run, who act on our behalf:

• Hosting and database providers that store the site and its data on our behalf.
• Analytics, used in aggregate to understand site usage.
• Advertising— the site may show ads served by Google, which may set its own cookies subject to Google’s privacy policy.

We also read your public statistics from Jagex’s Old School RuneScape hiscores; we do not send them your personal data to do so. We may disclose data if required by law.

Retention

We keep your account data for as long as your account exists. Some records that others rely on — a completed trade, or forum posts other members have replied to — may be retained after you leave so the site’s history stays consistent; where practical these are disassociated from you. Cached hiscores data is refreshed or cleared automatically.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing of it, and to data portability. You can change your RuneScape name and avatar, and change your password, from your profile. For anything else, email us at contact@tsmwdevelopment.com and we will respond within the timeframes the law requires.

If you are unhappy with how we handle your data you have the right to complain to the ICO at ico.org.uk, though we would welcome the chance to resolve it with you first.

Cookies

We use one essential cookie to keep you signed in. Analytics and any advertising may set additional cookies. Essential cookies are necessary for the site to work; you can control the others through your browser settings.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “last updated” date above, and where the change is significant we will ask you to accept the revised terms.