Privacy policy

Data Runekist processes

Runekist stores account email addresses, signup IP and browser/device details, clan and membership records, invitation and approval state, player names, chest records, point rules, requirements, audit events, support messages, email delivery logs, temporary exports, and billing state received from Stripe.

Why this data is used

Runekist uses this data to provide the service, protect accounts, calculate clan standings, manage subscriptions, answer support requests, prevent abuse, keep operational audit records, and comply with accounting, tax, security, and legal obligations.

GDPR rights

People in the EU and EEA may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent where those rights apply. Requests are handled manually so Runekist can account for clan history, security logs, billing records, and legal retention duties.

Processors and service providers

Runekist may use Stripe for checkout, payments, invoices, receipts, tax handling, and saved payment methods. Runekist may use Swoosh and Mailgun for account, invitation, password reset, notification, and support email delivery. Runekist uses Plausible Analytics from analytics.opsplaza.com for privacy-friendly public-site analytics. Infrastructure, database, backup, monitoring, and logging providers may process data where needed to run the service.

AI assistants and external connections (ChatGPT, Claude and other authorized MCP clients)

Runekist is an independent service. Connecting an AI assistant is optional. You select clans and permissions; every request is checked against your current account, clan role, approved clans, permissions and enabled features. Review and confirm a proposed write before allowing the assistant to change clan records or request an action.

Authorized requests may disclose clan names, player aliases and identifiers, membership history, contributions, scores, requirements, fines, Gold Pass and guardsmen observations, resource and Conquest Points records, balances, calendar events, rules, announcements and chat content. Writes can change authorized clan records or request actions. Passwords and collector credentials are not returned.

The AI provider or other MCP client you connect receives the requested information under its applicable terms and privacy controls. Runekist hosts its infrastructure and customer database in the EU; this does not determine where an external provider processes information or the international transfer safeguards that apply to your provider and plan.

Revoke access in Runekist Account → Connected apps to stop future authorized access. Revocation does not erase information already received by an external provider, including conversation history. Contact Runekist support for requests about data held by Runekist; use your provider's controls or contact that provider for its copies, retention and deletion.

Credentials and secrets

Game, IMAP, collector, calendar, session, and API credentials are treated as secrets. They are encrypted or signed where Runekist must use them internally and are not shown back in normal administration screens.

Public tools and private links

Public stacking calculation links are public by design and must not contain account, user, clan, or secret data. Calendar subscription URLs are member-only secrets; Runekist stores token digests and re-checks membership, clan, and subscription state when feeds are requested.

Cookies and local storage

Runekist uses essential cookies for sessions, security, CSRF protection, and language preference. It uses browser local storage for the theme preference and Plausible Analytics for cookieless public-site analytics. See the cookie policy for details.

Retention and deletion

Raw collector data, audit events, support records, public calculator snapshots, email logs, Stripe webhook payloads, backups, and temporary exports can have different retention windows. Unverified pending clan signups, including reserved aliases and abandoned signup data, are deleted after 48 hours unless a legal or operational retention reason applies.

A never-established tracker may be scheduled for removal after 30 full days without qualifying activity. We send an initial notice and allow at least 14 full days after provider acceptance, then a final notice at least three full days before the exact UTC deadline. Keep or qualifying use cancels removal. Trackers with successful collection, meaningful past use, unresolved payment, active holds, uncertain evidence or unreachable authorized recipients are not automatically removed. Restricted records and backups follow their documented separate periods before destruction.