Privacy Policy

Last updated: 24 October 2026

This policy explains what GE Uncut ("we", "the service") collects, why, and who it is shared with. GE Uncut is an unofficial, fan-made tool for tracking Old School RuneScape Grand Exchange prices; it works only with in-game data and in-game gold.

1. Information we collect

• Account: your email address and a password. Your password is never stored in plain text; we keep only a one-way argon2id hash. We email you once to confirm your address.
• Sign in with Google (optional): if you choose it, Google shares your email address, name, picture and Google account ID with us (the sign-in asks for the openid email profile scopes), and we keep only the email address, which we use to create or sign in the account. We do not store your Google name, picture or account ID, and we never receive your Google password.
• Your content: your scan settings, the flips you track, your watchlist, saved Margins views, price alerts, your votes on news analyses, and your display name, avatar and leaderboard choice.
• RuneLite plugin data (only if you link the plugin): the Grand Exchange offers and fills your game client reports (item, buy or sell, quantity, price, slot and time), the state of each offer slot, RuneLite's numeric hash of your game account, and a random install ID. This is tied to your GE Uncut account. We do not collect your in-game name or your RuneScape login. The plugin does nothing until you link it, and you can revoke the link at any time.
• Public information: the leaderboard shows a display name (one you choose, or a generated pseudonym), an avatar, your gains, number of flips and win rate. You can hide yourself from it in Settings. Comments you post on item pages are public and show the same name and avatar.
• Alert destinations: if you add an ntfy topic or a Discord or other webhook URL, we store it and our servers send alerts to it. Treat a webhook URL like a password.
• Assistant messages: the questions you type to the in-app AI assistant and the recent conversation (see section 4).
• Feedback: bug reports and feature requests you send, with the page you were on and your browser's user agent, and your account if you were signed in.
• How you arrived: your browser saves where you first came from (the referring site, the landing page and its query string, and any UTM or gclid tags) in local storage, for every visitor. If you create an account, that is saved once with the account so we can see which sources bring in users.
• Technical logs: our servers log each request's method, path, status and timing. For debugging they also log the text of searches, assistant messages and assistant actions; the chat and assistant log lines include your user ID when you are signed in. When an email is skipped or fails to send, the address it was meant for is logged. Your IP address is kept in short-lived rate-limit counters (about a day), and our network provider sees IP addresses as part of delivering the site. Server log files are rotated by size rather than kept for a fixed time, so how far back they reach depends on traffic, and files left behind by retired server processes are deleted after 30 days. Logs held by the container runtime are cleared whenever we deploy.

We never ask for, and you should not provide, payment details, real-world financial information, or your RuneScape account login.

2. How we use it

• To run the price scan against your settings, track your flips and show your profit.
• To authenticate you and keep your data scoped to your account.
• To show the leaderboard and comments, and to send the alerts you ask for.
• To answer your questions through the AI assistant (see section 4).
• To measure traffic and fix problems, and to protect the service from automated abuse (rate limiting and a bot check).

We do not sell your data and we do not send marketing email.

3. Third-party services

GE Uncut relies on these providers, each with its own privacy policy:

• Google Analytics 4: measures traffic and how the service is used. It records page views and the actions you take in the app: flips you track (with the item and the amount of gold), price alerts, items you add to a watchlist or the compare list, comments, when you open the assistant or send it a message, whether you log in or sign up and by which method, changes to your scan settings, the items you search for or open, and error messages. These events carry item IDs and amounts, never your email address or account ID, and the only thing sent about you is whether you are signed in. It sets cookies where consent allows (section 5). See Google's Privacy Policy; you can opt out with the Google Analytics Opt-out Browser Add-on.
• Google AdSense: our pages load the AdSense script. At the time of writing no ad units are shown. If ads are shown, Google may use cookies to personalise them where consent allows; manage preferences at Google Ad Center.
• Google Sign-In (Google Identity Services): the sign-in button, and a one-tap sign-in prompt shown to signed-out visitors on most pages. Loading it lets Google see that your browser visited GE Uncut.
• Google Fonts: the guide pages load their fonts from Google.
• Cloudflare: sits in front of the site as a proxy and network edge, sees requests and IP addresses, tells us your country (used only to decide whether to show the cookie banner), and provides Turnstile, the bot check at sign-in and sign-up, which receives your IP address. When our server is unavailable, a Cloudflare Worker temporarily holds plugin uploads (including your plugin token and account hash) and replays them later, for at most 30 days. See Cloudflare's Privacy Policy.
• OpenRouter: runs the AI assistant and writes the news analysis, and routes requests to model hosts it chooses. See OpenRouter's Privacy Policy.
• DigitalOcean: hosts our servers and database, so it holds the data described in this policy, including database backups. See DigitalOcean's Privacy Policy.
• Resend: sends the one email we send, the address confirmation.
• OSRS Wiki: item images load from the OSRS Wiki's servers, so the Wiki can see your IP address, and the assistant looks game facts up there.
• ntfy, Discord or your own webhook: if you add a destination, alerts are sent there by our servers, and by your browser for the browser-side alerts you enable.

4. The AI assistant and AI-written content

When you chat with the assistant, the text you send, the recent conversation and the results of the tools it runs are sent to OpenRouter and the model host it picks to generate a reply. If you are signed in, tool results can include your own tracked flips, settings, alerts (including any ntfy topic or webhook URL) and leaderboard identity. Please do not share personal, sensitive or real-world financial information in the chat. Your chat history is kept in your own browser for 24 hours, not in our database, but the text of messages is written to our server logs (section 1).

The market news analysis is written by an AI model from public article text and public prices; no personal data is sent for that. See how GE Uncut works for which parts of the site use AI.

5. Cookies, consent and local storage

• Session cookie: access_token, an httpOnly cookie that keeps you signed in for up to 7 days (SameSite Lax, and Secure over HTTPS). It is the only cookie we set ourselves and is required to stay signed in.
• Google Consent Mode: in the EU, the UK, Switzerland, Iceland, Norway and Liechtenstein, analytics and advertising storage start denied and a banner asks you to accept or reject. Elsewhere there is no banner and analytics and advertising storage start granted. The banner works on the app and its server-rendered pages. The standalone guide pages do not show it, but they apply the same defaults and honour a choice you saved in the app. Your choice is saved in your browser; clear your browser storage to be asked again.
• Analytics and advertising cookies: set by Google (for example _ga) when consent allows, as described in section 3.
• Local storage: your browser keeps your theme, your cookie choice and region, where you first arrived from, assistant chat threads (24 hours), notification preferences (including any webhook URL or ntfy topic you enter), pinned items, the compare list, scan controls, onboarding flags and similar display preferences. These stay on your device.

You can block cookies and clear local storage in your browser.

6. Data security

• Passwords are stored only as argon2id hashes, never in plain text.
• In our database, plugin tokens are stored only as hashes. The Cloudflare Worker described in section 3 holds the raw token for up to 30 days while it buffers plugin uploads.
• All traffic is served over HTTPS.
• The session cookie is httpOnly, and Secure when served over HTTPS.
• Requests are rate-limited to deter automated abuse.

7. Your rights

You can see and change your settings, tracked flips and display name in the app, and you can delete your account yourself (section 8). Depending on where you live, for example the UK/EU under the GDPR or California under the CCPA, you may have additional rights to access, correct, port or erase your data, and to object to processing. There is no data export button yet; email us and we will send you a copy of what we hold about your account.

8. Data retention and deletion

We keep your account data while your account is active. In Settings, Delete account removes your account, tracked flips, settings, watchlist, saved views, alerts, plugin tokens, plugin offers and fills, link codes, news votes and the first-visit information saved with your account. Your comments are removed too, except a comment that other people replied to, which stays as "[deleted]" with its text erased. Bug reports, feature requests and any site ratings you gave stay, with your account link removed. Some things are outside that deletion: rate-limit counters expire within about a day, plugin uploads held at Cloudflare expire within 30 days, server log files are rotated by size and those from retired processes are deleted after 30 days, database backups are kept for a period we have not fixed and age out as they are replaced, and copies held by Google, Cloudflare, OpenRouter and Resend follow their own policies.

9. Children

GE Uncut is not directed to children under 13 (or the minimum age in your country). We have no age check at sign-up and do not knowingly collect children's data. If you think a child has an account, contact us and we will delete it.

10. Intellectual property & Jagex

GE Uncut is an unofficial, fan-made tool and is not affiliated with, endorsed, sponsored, or approved by Jagex Limited. RuneScape and Old School RuneScape are trademarks or registered trademarks of Jagex Limited. All in-game content, including item names and item images, is the intellectual property of Jagex Limited and is used here for informational and reference purposes only. Live and historical price data is obtained from the Old School RuneScape Wiki real-time prices API. GE Uncut works only with in-game Grand Exchange prices and in-game gold and does not facilitate or support real-world trading. See our Terms of Use for the full disclaimer.

11. Changes

We may update this policy; the "Last updated" date above reflects the current version.

12. Contact

Questions about this policy or a request about your data? Email [email protected] or use the contact page.