Privacy Policy

Who we are

OSRS Card Exchange is operated by TSMW DEVELOPMENT LTD (“we”, “us”), a company registered in England and Wales under company number 17204316.

We are the data controller for the personal data described here.

For any privacy question or to exercise your rights, contact us at contact@osrscardexchange.com.

An independent, fan-made site

OSRS Card Exchange is an independently operated community website providing optional tools for players of third-party Old School RuneScape trading card game plugins and the game modes built around them. The OSRS TCG card game is the work of its creators, and full credit for it belongs to them; we are not affiliated with, endorsed by, sponsored by, maintained by, approved by, or officially connected with OSRS TCG, Azderi or any OSRS TCG developer, nor with RuneLite or Jagex Ltd. Compatibility with an OSRS TCG feature or data format does not indicate cooperation, partnership, authorisation, endorsement or involvement by the OSRS TCG developers. As the site grows we may integrate with further plugins and game modes on the same basis: every tool here is optional, offered for the community's reference and coordination, and the site remains independent of every plugin's developers.

We do not claim ownership of any of the cards displayed on the site. Certain legacy catalogue information is derived from the publicly available OSRS TCG project, as identified in our Terms and on our OSRS TCG attribution and licensing page.

OSRS Card Exchange provides optional tools for players of third-party OSRS card-collecting plugins, and we may integrate with other providers as they emerge, so the site can grow into a genuinely useful, community-based tool for the whole Old School RuneScape Trading Card Game community.

We handle your data solely to run this community site, as described below — not on behalf of, or in connection with, any plugin or any other party.

The data we collect

We collect only what the site needs to function:

• Account details — your email address, your Old School RuneScape name, and (optionally) a chosen NPC avatar.
• Your password — stored only as a secure one-way hash, never in a readable form (see “How we protect your password” below).
• Public game statistics — your total level, total XP and combat level, read from Jagex’s public Old School RuneScape hiscores using the RuneScape name you provide, and cached to power the highscores board.
• Content you create — exchanges, trade offers and outcomes, gang-finder listings, forum threads, comments, votes, polls and quest feedback.
• Technical data — a single sign-in cookie (below), and standard server and analytics information such as your IP address, used for security, rate limiting and aggregate usage statistics.

How we protect your password

Your password is never stored in plain text and is never written to logs, included in any page, or shared with anyone. When you register or change your password, we transform it with Argon2id — a modern, memory-hard password-hashing algorithm — using parameters aligned with current OWASP guidance. Only the resulting hash is stored.

Because hashing is one-way, we cannot recover or tell you your password; we can only verify a password you enter against the stored hash. Sign-in sessions use a signed, HTTP-only cookie that JavaScript on the page cannot read, and the whole site is served over HTTPS.

How we use your data, and our lawful basis

We process your data to provide the service you have asked for — creating and securing your account, showing you on the highscores board, letting you arrange trades and post on the forums, and sending you in-app notifications about your own activity. We also use your email address to send you account-security emails when you ask to reset your password and to tell you when your password has been changed; these are sent only in response to something done on your account, and we send no marketing email at all. Under UK GDPR our lawful bases are the performance of our contract with you (running your account and the features you use) and our legitimate interests in keeping the site secure and working (for example, rate limiting and abuse prevention).

We do not sell your personal data, and we do not use it for anything outside the functionality of this website. We do not use it for third-party marketing.

Security and abuse prevention

We reserve the right to collect and retain IP addresses where we identify malicious practice or an attempt to abuse our services — for example, forged or abusive traffic sent to the site or its APIs. Records kept on this basis are used only where we believe there may be a security concern within our platform: to investigate the activity and to protect the site, including restricting or blocking access from the addresses involved.

Our lawful basis for this is our legitimate interest in keeping the site secure. These records are not used for any other purpose, are not combined with your account activity beyond what the investigation requires, and are not shared except as described under “Sharing and third parties” below.

Sharing and third parties

We do not share your personal data except with the service providers that make the site run, who act on our behalf:

• Hosting and database providers that store the site and its data on our behalf.
• Email delivery — account-security emails (password resets and password-change notices) are sent through Resend, a provider based in the United States. Your email address and the contents of that message are processed by them on our behalf under appropriate safeguards for international transfers.
• Analytics, used in aggregate to understand site usage. Our analytics provider sets no cookies and does not track you across other sites.
• Advertising — the site shows ads served by Google, which may set its own cookies subject to Google’s privacy policy. In the UK, the EEA and Switzerland this happens only after you have been asked; see “Cookies and consent” below.

We also read your public statistics from Jagex’s Old School RuneScape hiscores; we do not send them your personal data to do so. We may disclose data if required by law.

Retention

We keep your account data for as long as your account exists. Some records that others rely on — a completed trade, or forum posts other members have replied to — may be retained after you leave so the site’s history stays consistent; where practical these are disassociated from you. Cached hiscores data is refreshed or cleared automatically.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing of it, and to data portability. You can change your RuneScape name and avatar, and change your password, from your profile. For anything else, email us at contact@osrscardexchange.com and we will respond within the timeframes the law requires.

If you are unhappy with how we handle your data you have the right to complain to the ICO at ico.org.uk, though we would welcome the chance to resolve it with you first.

Cookies and consent

Essential. One cookie keeps you signed in. It is necessary for the site to work and is not used for advertising.

Analytics. We measure site usage in aggregate through Vercel Analytics, which does not set cookies and does not build a profile of you or follow you to other sites, and through Google Analytics, which does set its own cookies. In the United Kingdom, the European Economic Area and Switzerland the Google Analytics cookies are not written unless you agree to them in the consent message described below; until then it measures visits without storing anything on your device.

Advertising. The site shows ads served by Google, which may set its own cookies subject to Google’s privacy policy. We also use a short-lived cookie holding nothing but a two-letter country code, so that a sponsor’s banner is the one meant for your country. That cookie is not set at all for visitors in the United Kingdom, the European Economic Area or Switzerland.

Affiliate banners set nothing on your device. Some sponsor banners are affiliate links through Awin. Their artwork is copied onto this site and served from here rather than fetched from the network, so no request reaches Awin and no cookie of theirs is written while you are reading. That is deliberate: an advertising network’s image request would set a cookie the moment the page loaded, before you had been asked anything, and the consent message below is Google’s and speaks only for Google. Awin is reached only when you choose to click one.

If you are in the United Kingdom, the European Economic Area or Switzerland, you will be asked to make a choice about advertising before personalised ads are shown, through Google’s certified consent management platform. That choice covers Google. It does not need to cover the affiliate banners, because they store nothing on your device unless you click one. You can change or withdraw the choice at any time using the Cookie settings link in the footer. You can also control cookies through your browser settings.

Affiliate links

Some of the sponsor banners on this site are affiliate links, served through Awin. Each is labelled as an advertisement where it appears, and each is chosen for the country you appear to be in, because a shop that does not sell to you is no use to you.

If you follow one and buy something, the shop pays this site a commission. It costs you nothing and changes no price. It also does not make this site a party to the sale: your contract is with the shop, and any question about delivery, returns, refunds or warranty is theirs rather than ours.

Clicking an affiliate banner takes you to Awin, which records the click and sets its own cookies on its own domain before sending you on to the shop. That is how a sale is credited here. What Awin does with that is governed by Awin’s privacy policy rather than this one. Until you click, nothing on this site has told Awin you exist.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “last updated” date above, and where the change is significant we will ask you to accept the revised terms.