Privacy Policy

Last updated 22 October 2026

The Codex is a free, fan-made RuneScape 3 stats site. This page explains exactly what it stores, why, and how to get it removed. In plain terms: it keeps public RuneScape stats so it can show you how they change over time, and, only if you sign in, the small amount of Discord information needed to know an account is yours.

Public RuneScape data

When anyone looks up a player, The Codex reads that account's public profile from Jagex's RuneMetrics API, the same information anyone can see on the official hiscores. It then re-checks looked-up accounts periodically and stores snapshots of those public stats.

Those snapshots are the product: gains, charts, streaks, milestone dates and the drops log can only exist by comparing today's public numbers with earlier ones. The Codex does not have, ask for, or want your Jagex login, email, password, bank, or anything private. If an account's RuneMetrics profile is set to private, The Codex cannot see its quests, drops or activity feed. Its levels, XP and ranks are still on Jagex's public hiscores, which that setting does not hide, so The Codex shows those, says on the profile that they come from the hiscores, and keeps tracking them.

Stored per tracked player: daily stat snapshots, notable drops parsed from the public activity feed, milestone dates, last-known hiscore rank, and community-supplied clan name.

If a character is yours and you have verified it, you decide some of what is shown from that. The three switches are described under Removing your data, further down.

If you sign in with Discord

Signing in is optional. Everything except goals, rivalries and notifications works without it. When you do sign in, The Codex stores:

Your Discord user ID (a number), and the username/avatar Discord returns for display.
Which RuneScape accounts you have claimed, and whether each claim is verified.
Any goals and the rival you pin, against the accounts you own.
If you set up notifications: either your Discord user ID (for DMs) or the webhook URL you provide, plus which alerts you chose.
If you set a showcase on a character you have verified: a copy of the one thing you chose to show (a cape, a dated milestone or a single drop) and the note you wrote with it, up to 60 characters. Both are public: they are shown on that profile, and can appear on the picture shown when its link is shared.
Your privacy choices for each character you have verified: which of the three switches described under Removing your data are on.
Your tab order and hidden tabs, if you arrange them.

The Codex requests only the minimum Discord scopes needed to identify you. It cannot read your messages, your servers' contents, or anything else in your account.

The in-game plugin

The Codex plugin for the RuneScape client is optional. It only works for a character you have verified as yours, with a secret key you make for that character on your dashboard and paste into the plugin. Each character has its own key, and you can delete a key at any time, which stops it working at once.

What the plugin sends to The Codex, over an encrypted (HTTPS) connection:

When you level up or log out: that character's name and its XP in each of the 29 skills, with the key.
When a boss from the RuneScape Wiki's list of bosses dies near you: the boss's name and the items that dropped for you, with how many of each, with the character's name and the key.
About every five minutes while you play: the quests you have finished, your achievement count and RuneScore, and whether you're playing now and what you're training, with your XP an hour, with the character's name and the key. And, when they change: your boss kill counts, clue scrolls completed, boss pets unlocked and collection log counts, as the game keeps them.
Only if you switch on Share wealth and gear in the plugin (it is off unless you do): the items in your bank (each time you open it), your backpack and money pouch, with how many of each, and what your character is wearing, with the character's name and the key.

It never sends your chat, anything about other players, where you are in the game, or any login or account details, and it only sends your backpack, bank and money pouch while you share your wealth and gear. Your settings for the plugin (the key, whether you share your wealth and gear, and where its card sits on your screen) are kept by the game on your own computer, not by The Codex.

The XP is checked (it can never be lower than Jagex's last reading, and impossible jumps are refused), then shown on that character's public profile with a line saying it came from the plugin, until Jagex's own numbers catch up. The site keeps the latest report for 7 days. It never counts towards records, races, leaderboards or clan totals. Boss drops are checked against that boss's drop table on the Wiki, shown on the profile's Drops tab marked as coming from the plugin, and kept until you ask for them to be deleted. Anything a boss can't drop is set aside for the site's admin to look at and is not shown. Hide my drops covers them too. Finished quests, quest points, achievements and RuneScore are shown on that character's profile, marked as coming from the plugin, and the latest of each is kept for 30 days. Whether you're playing now, and what you're training, is shown on the profile for 15 minutes after the plugin last sends it, and then deleted by itself. Boss kill counts, clue scrolls, boss pets and collection log counts are kept the same way, the latest of each for 30 days, and shown on the profile marked as coming from the plugin where The Codex knows what the game's name for them means. If you share your wealth and gear, The Codex shows on that character's profile what they are worth at today's Grand Exchange prices, your most valuable items and what you are wearing, marked as coming from the plugin. Switching sharing off in the plugin deletes them at once; otherwise the latest is kept for 30 days. A 99, a 120, 200 million XP in a skill, the Max cape or the Master Max cape that the plugin's XP reports show, and a boss drop it sends that is rare on the Wiki or worth over 1M each, is also sent at once as an alert, as The Codex does when it sees one in Jagex's own numbers: to the people who have set up alerts for that character on its profile, on Discord or on their phone or browser, and to the Discord channel of the character's clan if the clan has set one up. With Hide my drops on, a drop alert goes only to your own Discord alert.

The Codex runs on Vercel and stores its data with Upstash, which may process it in the United States. Your IP address is used in the moment to limit abuse, as everywhere else on the site, and is not stored. What the plugin sends can be seen by anyone who views that character's profile (except what you hide), and by the site's admin. It is not sold or given to anyone else.

Who is responsible: The Codex (thecodexrs.com), contact ben@thecodexrs.com. Why it may be used: because you chose to: you install the plugin and give it a key for your own character. You can stop at any time by deleting the key on your dashboard or removing the plugin. Your rights: you can ask for a copy of what the plugin has sent, have it corrected or deleted, or object to it being used, by emailing that address. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live.

Site analytics

The Codex records page visits to see what's being used. This is deliberately coarse: it stores the page path, a rough location (city/country, from the hosting provider's edge headers), a browser name, and a short pseudonymous visitor ID that is re-derived daily and cannot be reversed or linked across days. Your IP address is used only in the moment, to rate-limit abuse and derive that daily ID, it is never stored. One day's IDs are held together as a set so the admin page can count people rather than page views, and that set self-deletes after 16 days. The other daily rollups hold no ID at all: they are counts per page and per player, and they self-delete after 40 days.

The site is hosted on Vercel and uses Vercel Web Analytics and Speed Insights, which collect aggregate, cookie-free performance and traffic data. Uncaught JavaScript errors are logged (message, page, browser) for up to 30 days so breakage can be fixed.

Stored in your browser, not on our servers

Favourites, recently-viewed players, your pinned primary account and a few interface preferences are kept in your browser's local storage. Clearing your browser data removes them. Sign-in uses a session cookie; there are no advertising or tracking cookies.

If you pass a question on from the help panel, it is remembered in your browser with a random reference number until it is answered and you have read the answer, and for at most 90 days, so the answer can be shown to you there.

Community submissions

Clan names, Grand Exchange price reports and feedback messages are submitted by players and shown to others. Feedback is stored with whatever contact detail you choose to include, leave it blank to stay anonymous. Don't put anything private in a submission.

A question you pass on from the help panel is sent as feedback with that reference number, and with a contact only if you type one. If it is answered, the answer is kept for 90 days and can only be read with the reference number, which only your browser has.

When you ask the help bot a question, the question is sent to Anthropic, the company whose AI writes the answer, together with the site's own guides and, if you are on a player's profile, that profile's public figures. When the guides do not cover it, the question's key words are also sent to the RuneScape Wiki's search, and the answer is written from the Wiki article it finds. The site keeps the last 300 questions with their answers and the page they were asked on, so missing guides can be written. They hold no name or contact unless you type one into the question. Your IP address is used in the moment to limit how many questions can be asked, and is not stored.

How long things are kept

Stat snapshots & milestone dates, kept while the account is tracked, so long-term charts stay meaningful.
Visit rollups, 40 days, then deleted automatically.
Live activity feed & error log, capped, recent entries only (error log expires after 30 days).
Claims, goals, rivals and notification settings, until you remove them or ask for deletion.
A showcase, its note and your privacy choices, until you change or remove them, or until the character stops being verified as yours. Un-claiming it clears them, and so does someone else proving the character is theirs. A rename in the game does not carry them over by itself. They are moved when the site moves the character's history to its new name, which you can ask for.
Your tab order and hidden tabs, until you press Reset or ask for deletion.
Answers to questions passed on from the help panel, 90 days, then deleted automatically.
XP sent by the in-game plugin, the latest report for 7 days. Boss drops it sends, until you ask for them to be deleted. Quests, achievements and RuneScore it sends, the latest for 30 days, and whether you're playing now, for 15 minutes. Boss kill counts, clue scrolls, boss pets and collection log counts it sends, the latest for 30 days. Your wealth and gear, while you share them, the latest for 30 days, and deleted at once when you switch sharing off.
Best XP gains, for each tracked player the most XP The Codex has measured between two of its snapshots of that account in a day, in 7 days and in 30 days, and the most total levels in 7 days and in 30 days (with the times of both snapshots), and the biggest of those across all tracked players, kept with no end date, including after a player stops being tracked, until you ask for them to be deleted.

Removing your data

If a character is yours and you have verified it, you can change how it appears yourself, without asking anyone. Your dashboard has three switches for each verified character:

Hide my drops. Your drops log and drop lines in your feed are hidden from everyone but you. Other people's alerts and your clan's channel stop getting your drops; your own Discord alert keeps working. Phone alerts for your drops stop too.
Leave the player lists. You're taken off the A to Z list, random player, search suggestions, the sitemap and the Records page. Leaderboards are not affected, and your profile still opens by its exact name.
Keep me out of races and squads. Your character never shows in any race or squad, including ones already running. Whoever added your name just won't see it appear.

These switches hide things. They do not delete them: The Codex keeps recording a hidden character's drops, and they are shown again when that switch is turned off. A change reaches most pages within a couple of minutes. The Discover feed can take a few minutes longer, and your badges and Wrapped pages up to an hour. The A to Z list and the sitemap are rebuilt about once an hour, and link previews and search engines can take longer. Hiding your drops changes what The Codex shows and sends. Jagex still publishes your activity log itself, and only setting your RuneMetrics profile to private changes that. A drop you picked for your showcase stays on show until you remove the showcase.

You can remove notification settings and un-claim an account yourself at any time from your profile. To have a player's tracked history deleted, or your Discord link removed entirely, ask via the feedback form or in the Discord server and it will be done, no justification needed. If you'd rather an account was never tracked at all, say so and it will be blocked from lookups. None of this needs a verified claim.

Children

The Codex isn't directed at children under 13 and doesn't knowingly collect their information. Discord's own minimum-age rules apply to signing in.

Changes & contact

If this policy changes materially, the date at the top changes and the site will say so. For anything privacy- or security-related, including reporting a vulnerability, use the feedback form or the Discord server. Security reports are welcome and will be acted on rather than argued with.

The Codex is an unofficial fan project. It is not affiliated with, endorsed by, or sponsored by Jagex Ltd. RuneScape and RuneScape 3 are trademarks of Jagex Ltd. Game data is provided by Jagex's public APIs; some images come from the RuneScape Wiki.