Privacy Policy
Effective August 15, 2026 · Plain language on purpose
What we collect
Without an account: nothing personal. Pages are served with standard server logs, and no ads. One third-party script runs: Vercel Analytics, which counts page views without cookies and without an identifier that follows you to any other site. There is no advertising or cross-site tracking of any kind. With an account: your email, display name, and sign-in provider identity; your saved settings (bankroll, watchlist). If you join the Pro waitlist: the email address you give, the optional answer about what you use the GE for, which page you joined from, and when. It is used to confirm the address, tell you when Pro launches and honour your early-bird price — nothing else, and it is never shared. Each signup gets a share code; if you joined through someone's share link we note that, so their place in line can move up. They see only a count of friends who joined, never who. If you connect the RuneLite plugin: your own Grand Exchange offer events — item, price, quantity, offer state, timestamp, and a client-side hash of your game account (used only to separate multiple accounts in your journal). Never your RuneScape credentials, chat, or anything else from the game — the plugin cannot see them and we would not accept them. If a creator's link brought you here: the link's name rides in the page address, not in a cookie or browser storage. If you create an account within a day, or join the waitlist, we note which creator sent you so we can pay them their share. They see totals only, never who you are.
What we do with it
Your trade events power your own flip journal and your own buy-limit tracker. Nothing else, today: no number shown to anyone else is derived from them. If that ever changes it will be after anti-abuse validation, behind a k-anonymity floor — no public number derived from fewer than several distinct accounts, no individual trade ever published — and this page will say so before it ships. We do not sell or share personal data with anyone. Payment processing, if/when subscriptions launch, will be handled by Stripe; card details will never touch our servers.
Where it lives
Data is stored with our infrastructure providers: Vercel (hosting) and Neon (database). Email we send (sign-in links, alerts you set, the daily journal summary if you turn it on, waitlist confirmation) goes out through Resend, which sees the recipient address and the message. Public price data originates from the OSRS Wiki real-time prices API.
Your rights
Delete your account and everything attached to it, or request an export of your data, by emailing contact@offerbook.gg from your account email (self-serve export/delete buttons are on the roadmap and will replace the email path). Revoke plugin tokens anytime from your account page — revocation stops collection immediately. EU/UK visitors: the practices above are our GDPR posture; the lawful basis for processing is performing the service you signed up for.
Cookies
One first-party session cookie to keep you signed in. That's the complete list — no consent banner needed because there's nothing to consent to.
Changes
Material changes will be noted here with a new effective date. Questions: contact@offerbook.gg.