Privacy Policy
Last updated 13 October 2026
OSRS Tracker is a free fan site run by Freek Mencke in Belgium. For questions or requests about your data, email freek_mencke.dev@outlook.com.
Server logs
The site’s servers log every request: your IP address, the page requested, the referring page, your browser’s user agent and the time. The logs are used only to keep the site secure and working, a legitimate interest (Article 6(1)(f) GDPR), and are deleted after 30 days.
When a request is an attack, such as scanning for vulnerabilities, its IP address, the type of attack and the time are shared with CrowdSec’s community blocklist, which protects other sites too. Normal visits are never shared.
Analytics
Only if you allow it in the cookie banner, the site uses Google Analytics 4. It sets cookies (_ga and _ga_…) to count visits, and records the pages you visit, what you search for (player and item names), the features you use and how fast pages load. Google signals and advertising features are off, and the data is deleted after 2 months. Google processes it for the site and may transfer it to the United States under the EU-US Data Privacy Framework. The legal basis is your consent (Article 6(1)(a) GDPR): change your choice at any time with Cookies at the bottom of every page.
On your device
Your theme, favourite and recently viewed players and items, tracking offset and cookie choice are kept in your browser’s local storage. They stay on your device, and you can clear them in your browser’s settings.
Other services
Pages load some content straight from other services, which see your IP address under their own privacy policies: prices and images from the OSRS Wiki, and the changelog from GitHub. Hiscores go through the site’s own proxy on Amazon Web Services in Frankfurt, Germany.
Your rights
Under the GDPR you can ask for access to your data, have it corrected or deleted, restrict or object to its use, and withdraw your consent. Server logs are needed to investigate abuse, so they aren’t deleted early on request (Article 21(1) GDPR); they expire after 30 days. Include the IP address you used: it’s the only way to find your entries. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).
The date at the top shows when this policy last changed.