Privacy Policy

Effective 23 August 2026

Waypoint is a personal Old School RuneScape progression tracker. We keep the data we hold to the minimum needed to run it. We never collect your email address — not even when you sign in with Discord or Google, where we deliberately do not request it. We do not ask for your real name, we run no advertising, we use no third-party analytics or tracking, and we never sell or share your data.

What we collect

• Account details: a username you choose, and a password if you set one, stored only as a secure one-way hash (we cannot read it).
• Social sign-in: if you sign in with Discord or Google, we store the provider's name and the opaque account identifier it gives us — a meaningless string of digits. We request the narrowest permission each offers (identify for Discord, openid profile for Google) and deliberately do not request your email address, so it is never sent to us. Your display name from the provider is used only to pre-fill the username box during signup; we do not store it. We never receive your password for those services.
• A recovery code: because we hold no email address, we cannot send you a reset link. Instead you are given a one-time recovery code. Only a one-way hash of it is stored, so we cannot show it to you again or use it ourselves.
• Your RuneScape names (RSNs): one for each character you track, so we can label them and look up their public stats.
• Game progress: quests, skills, achievement diaries, combat achievements and collection-log data, either synced by the Waypoint Sync RuneLite plugin or imported by you. This is public in-game information tied to your account here.
• A plugin token: a random credential that links the plugin to your account. It is not personal information and can be regenerated at any time.
• Technical data: your IP address is processed for the ordinary operation of the site and to rate-limit abuse. Our network provider, Cloudflare, also processes it to deliver and protect the site.
• One functional cookie: a session cookie that keeps you logged in. It is strictly necessary, is marked HttpOnly, and is not used for tracking or advertising.

What we do not collect

• No email address — for accounts or from Discord or Google — no real name, no postal address, no phone number.
• Nothing else from your Discord or Google account: not your friends, servers, contacts, documents, profile picture or anything besides the account identifier described above.
• No payment information — the service is free.
• No advertising, no third-party analytics, no cross-site tracking.
• Nothing about other players, and no bank, inventory, equipment, position or chat from the game (see the plugin's disclosures for exactly what it sends).

Why we use it

• To provide the tracker and show you your progress and recommendations.
• To keep your account secure and to prevent abuse of the service.

Legal bases (UK/EU GDPR)

Where UK or EU data protection law applies, we rely on performance of the service you have asked us to provide for your account and progress data, and on our legitimate interests in keeping the service secure and free from abuse for technical data such as your IP address.

Who we share it with

We do not sell or share your personal data, and we send no personal data to any third party for their own purposes.

• Cloudflare delivers and protects the site, and in doing so handles connection data such as your IP address.
• Discord or Google, only if you choose to sign in with them. You are sent to them to log in, so they know you signed in to Waypoint. We send them nothing about you beyond what that requires, and we receive only the account identifier described above. You can unlink a provider at any time from Sign-in & security, provided it is not your only way to sign in.

Your game data reaches our server from the Waypoint Sync plugin, which discloses this before you install it.

How long we keep it

We keep your account and its data for as long as your account exists. You can delete it yourself at any time from Sign-in & security, which removes your account, every character on it, and all of your progress, collection log and share links. Because we hold no email address for you, deletion is immediate and permanent: there is nothing to restore from and no way for us to verify a later change of mind. Short-lived technical records such as rate-limit counters expire automatically.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to object to or restrict how we use it. To exercise any of these, email [email protected]. You can also delete your account from within the app at any time. If you are in the UK or EU and are unhappy with how we have handled your data, you may complain to your data protection authority (in the UK, the Information Commissioner's Office).

Cookies

We use a single strictly-necessary session cookie so you stay logged in. Because we set no tracking or advertising cookies, there is no cookie-consent banner to click through.

Children

Waypoint is not directed at children under 13 (or under the minimum age of digital consent in your country). Please do not create an account if you are under that age.

International use

The service is operated and hosted by its operator and delivered globally through Cloudflare. If you access Waypoint from another country, your data may be processed in the country where the service is operated.

Changes to this policy

We may update this policy as the service changes. The effective date above shows the current version, and we will note any significant changes on the site.

Contact

Questions or data requests: [email protected].

Not affiliated with Jagex. Old School RuneScape is a trademark of Jagex Ltd.