Home › Privacy
Your account stays yours
OSRS Loadout plans gear. It can’t log in to your account, can’t touch your items, and will never ask for your password.
We will never
There is no login on this site and nothing on it needs them. If anyone asks for them in our name, they are trying to steal your account.
Nothing here can move, drop or trade anything. The site only reads the public hiscores and what you choose to share.
No ads, no cookies and no tracking IDs. Nothing is sold.
A synced bank is filed under a random key made by your RuneLite plugin, not your character name. Only your plugin, and browsers you link with its code, can open it.
Where your information comes from
The public hiscores, through Wise Old Man. Anyone can already see these.
The OSRS Wiki’s WikiSync, and only if you already use the WikiSync plugin.
Saved in this browser, not on our servers.
Only if you install the OSRS Loadout plugin, turn syncing on and press Sync. Everything it sends is listed below.
The RuneLite plugin
Syncing is off when you install it, and while it is off the plugin makes no internet requests at all. Opening your bank only reads it inside RuneLite. Nothing leaves your computer until you press Sync now in the plugin’s panel.
What a sync sends
- Item IDs and amounts from your bank, worn equipment and inventory
- How your bank is laid out: which item is in which slot, and your tab sizes
- A random key the plugin made, so only your plugin can update your bank
What it never sends
- Your character name
- Your password, bank PIN or authenticator code
- Your email or anything else about your Jagex account
- Your levels, location or chat
- Anything at all while syncing is switched off
The plugin shows an 8-character code that works once, for 10 minutes. The browser you type it into can see your synced bank but can never change it. Don’t share the code: whoever types it can see your bank.
The plugin’s code is public on GitHub (pilotagency/osrs-loadout-plugin), so anyone can check exactly what it does.
When you turn syncing on, RuneLite warns that the plugin sends your IP address to a server it doesn’t control. It shows that for every plugin that talks to a website. Our server sees your IP address when you sync, like any website you visit, and it isn’t saved with your bank.
What we keep, and for how long
Which page, the hour, roughly how long it was open, and whether it was a desktop, phone or tablet. On arrival, one word for the kind of site that sent you, like Reddit. No IP address, no ID, and nothing that links one visit to the next.
Items, amounts and layout, under the plugin’s random key.
The name and its public Wise Old Man data, so the same player isn’t fetched on every page. Separately, a daily count of how many visitors looked each name up.
Your message, the page, device type and country, a reply contact if you give one, any screenshots you add (stored privately, only we can see them), and your account summary only if you tick the box. Not your IP address.
Your IP address is scrambled before it reaches our database, so the database never holds it. The scrambled code is only used to count requests, so one person can’t flood the site, and those counts are deleted when each limit resets.
Vercel and Supabase, who run the site, keep their own request logs, which include IP addresses and times. Deleted data can stay in encrypted backups for up to 7 days.
What other sites see
Item price charts load straight from the OSRS Wiki’s price service, which sees your IP address like any site you visit.
Looking up a name sends only that name, from our server, to Wise Old Man and the OSRS Wiki. They never see your IP address. If Wise Old Man isn’t tracking that name yet, we ask it to start.
Staying safe
Not to look you up, not to sync your bank, not for anything. If a page, a message or a person asks for your password, bank PIN or authenticator while using our name, it isn’t us.
The only site is www.osrsloadout.com. Look at the address bar before you type a name or a link code.
Install it from RuneLite’s Plugin Hub and nowhere else. Never run a plugin or .jar file someone sends you, whoever they say they are.
Counting your visits
Visits are counted without cookies or IDs, as described above. You can stop this browser being counted here. Global Privacy Control and Do Not Track are honoured automatically.
Questions about any of this? Use the feedback button in the corner of any page.