This Privacy Policy explains how OSRS Scry Exchange (“Scry”, “we”, “us”) collects, uses, stores, and shares personal data when you visit https://osrs-scry.exchange or use our Grand Exchange analytics, forecasts, workspace tools, or billing features.
We design the service for users in the UK and EEA and treat the UK GDPR / EU GDPR and the UK Data Protection Act 2018 as our baseline. If you are outside those regions, local laws may also apply.
1. Who we are
Controller: the operator of OSRS Scry Exchange at https://osrs-scry.exchange. Privacy requests: privacy@osrs-scry.exchange. General support: support@osrs-scry.exchange.
2. Data we collect
- Account data — email address, display name, Firebase Authentication identifiers, and sign-in provider metadata when you create an account.
- Workspace data — watchlists, alerts, presets, notes, and similar settings you save while signed in.
- Billing data — subscription status, Stripe customer / subscription IDs, and payment-related events processed by Stripe. We do not store full card numbers on our servers.
- Usage & security logs — IP address (or hashed/derived network signals), request paths, rate-limit counters, auth session cookies, and error diagnostics needed to operate and secure the service.
- Optional analytics & diagnostics — if you accept optional cookies, aggregated product analytics (e.g. Vercel Analytics) and client error monitoring (e.g. Sentry) may collect device/browser metadata and performance signals.
- Market data — Grand Exchange prices and volumes from the OSRS Wiki Real-time Prices API. That data is about the game economy, not about you personally.
3. Why we process data (legal bases)
- Contract — to create your account, provide paid features, process subscriptions, and deliver the tools you request.
- Legitimate interests — to secure the service (abuse prevention, rate limiting), improve reliability, and understand aggregate product usage where compatible with your rights.
- Consent — for non-essential cookies/analytics/error monitoring. You can withdraw consent anytime via the Cookie Policy controls or by clearing site data.
- Legal obligation — where we must retain records for tax, accounting, or lawful requests.
4. Sharing & processors
We use service providers that process data on our behalf, including:
- Firebase / Google Cloud — authentication and database hosting
- Vercel — application hosting and (if consented) analytics
- Stripe — payments and subscription billing
- Upstash Redis — caching and rate limiting
- Sentry — error monitoring when optional diagnostics are enabled
We do not sell your personal data. We may disclose information if required by law or to protect the security of users or the service.
5. International transfers
Some processors are located outside the UK/EEA (for example in the United States). Where transfers occur, we rely on appropriate safeguards such as the processors’ standard contractual clauses or equivalent transfer mechanisms offered by those providers.
6. Retention
- Account and workspace data — while your account remains active
- Billing records — as required for accounting and dispute handling
- Security/rate-limit logs — typically short-lived operational windows
You may request deletion of your account and associated personal data (see Your rights). Some anonymised or legally required records may remain.
7. Your rights
Subject to applicable law, you may request:
- Access to your personal data (including a machine-readable export)
- Correction of inaccurate data
- Deletion of your account and personal data
- Restriction or objection to certain processing
- Withdrawal of consent for optional cookies/analytics
- Complaint to your supervisory authority (in the UK: the ICO)
Signed-in users can export or delete account data from Settings → Privacy. You may also email privacy@osrs-scry.exchange. We may need to verify your identity before acting on a request.
8. Children
The service is not directed at children under 16. If you believe a child has provided personal data, contact us and we will delete it where appropriate.
9. Security
We use industry-standard measures including HTTPS, authenticated APIs, access controls, and rate limiting. No method of transmission or storage is perfectly secure.
10. Not financial advice; game affiliation
Scry provides informational analytics about an in-game virtual economy. Nothing on the service is financial, investment, or trading advice. Scry is not affiliated with or endorsed by Jagex Ltd.
11. Changes
We may update this policy from time to time. The effective date at the top will change when we do. Material changes may also be highlighted in-product or by email where appropriate.