Privacy Policy

Lowkey Clan is a player-run Old School RuneScape clan. This website is operated by the clan's staff team, who decide what is collected here and why — in data protection terms, we are the controller for the information described below.

We are a hobby community, not a company. We are not affiliated with, endorsed by, or connected to Jagex Ltd, Wise Old Man or Discord.

“We” and “us” mean the clan staff who run this site. “You” means anyone visiting it, whether or not you are a member.

Public Old School RuneScape data. Player names, account type, in-game clan rank, experience, levels, efficient hours played and bossed, boss kill counts, competition standings and milestone achievements. This comes from Wise Old Man, which mirrors the official OSRS hiscores. It is public game data about an account, and we read it rather than collect it from you.

Your Discord account, if you sign in.Signing in is optional and uses Discord's standard OAuth flow. We store your Discord user ID, username and avatar URL. The email address on your Discord account is also passed to our authentication provider, because it keys accounts on it — nothing on this site reads, displays or sends to that address.

Whatever you choose to give us.

• A display name and a profile picture, if you set them from your dashboard.
• Your application answers, if you apply: the OSRS account name you are applying with, why you want to join, your PvM experience, and who referred you. We store the public Wise Old Man stats for that account as they were on the day you applied, so staff are reviewing the same numbers you submitted.

A small amount of security data, recorded automatically. Your IP address and browser user-agent string are stored against staff panel sessions and account recovery requests, so an unexpected login can be recognised as one. Staff actions in the admin panel are written to an audit log — who did what, to what, and when. Requests to a few sensitive endpoints are rate limited, which involves counting recent requests per IP in memory for a short window.

What we do not collect. No payment details — nothing here is paid for. No real names, addresses or phone numbers. No advertising, analytics or tracking cookies, and no third-party trackers of any kind.

• To run the public boards — highscores, the Hall of Fame, competitions and the token leaderboard are built from public game data.
• To review applications and confirm that the account applying is the account whose stats we are looking at.
• To give you a dashboard showing your linked accounts, gains and clan standing.
• To keep the site and the clan safe — moderating content, spotting abuse of the application form, protecting staff accounts, and investigating if something goes wrong.
• To notify staff in our own private Discord channels when someone signs in, applies, or unlocks the staff panel.

Where the UK GDPR or EU GDPR applies to you, we rely on your consent for the things you actively choose — signing in, setting a profile, submitting an application — and on our legitimate interests in running a clan community and keeping it secure for the rest. You can withdraw consent at any time by asking us to delete your site account.

The leaderboards, Hall of Fame and competition pages are public. They show an account's OSRS name, account type, in-game clan rank and the relevant statistics.

Your Discord profile picture is never shown on a public page. A picture only appears next to your name if you uploaded one yourself from your dashboard. This is enforced in the code, not by convention: the query that builds public avatars can only read the picture you uploaded. Signing in with Discord does not put your face on a leaderboard.

Application answers are never public. They are visible to clan staff in the admin panel and are used to decide on your application.

We set only strictly necessary cookies. There is no advertising, analytics or profiling cookie on this site, which is why you are not being asked to agree to one.

• Session cookies — set when you sign in with Discord, so the site knows it is still you on the next page. They expire, and signing out clears them.
• A short-lived sign-in cookie — written while the Discord handshake is in progress and used once to complete it.
• A staff panel cookie — signed, and only present for staff who have unlocked the admin panel. It expires on its own.

Clearing cookies for this site signs you out and nothing else.

We do not sell your data, share it with advertisers, or give it to data brokers. It reaches other organisations only where they provide part of the site:

• Supabase — hosts our database, authentication and uploaded profile pictures.
• Discord — handles sign-in, and receives the notifications we post to our own private staff channels.
• Wise Old Man — the source of the game statistics. We read from them; the only thing we send is the account name being looked up.
• Our hosting provider — serves the site and keeps standard server logs.

These providers operate internationally, so data may be stored or processed outside your own country. We would also disclose information if we were legally required to.

• Your site profile — for as long as your account exists. Ask us and we will delete it.
• Applications — kept after a decision so staff have a record of who was accepted or turned down and why. Ask us and we will remove yours.
• Security records — staff sessions, recovery requests and the audit log are kept only as long as they are useful for spotting misuse.
• Game statistics — these are not ours to delete. They belong to the public hiscores and to Wise Old Man; see the note in your rights below.

Depending on where you live, you may have the right to ask for a copy of what we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent you have given.

To exercise any of these, contact us at our Discord server. We will respond within 30days. We may ask you to confirm you control the Discord or OSRS account in question — otherwise anyone could ask us to delete somebody else's profile.

One limit worth being clear about: deleting your account here removes your profile, not your presence on the hiscores. Your OSRS statistics are published by Jagex and mirrored by Wise Old Man, and leaving the clan's Wise Old Man group is what takes your name off these boards. We are happy to do that for you on request.

If you think we have handled your data badly, please tell us first — but you also have the right to complain to your local data protection authority.

This site is not intended for children under 13, and signing in requires a Discord account, which has its own minimum age. If we learn that an account here belongs to someone below that age we will delete it.

The site is served over HTTPS. Staff passwords are stored only as salted hashes, one-time setup and recovery links are stored only as hashes, and the keys that can read the database directly are held on the server and never sent to a browser. Sessions expire, and staff can see and revoke their own.

No system is perfectly secure. If you believe you have found a vulnerability, please report it privately at our Discord server rather than posting it publicly.

If we change what we collect or how we use it, we will update this page and the date at the top of it. Anything significant will also be announced in the clan Discord.

Questions about this policy, or about anything we hold on you, go to our Discord server.

Our Terms of Service cover the rules for using this site, and the clan rules cover conduct in the clan itself.