Privacy & Usage Statistics

OSRS Card Maker records anonymous daily totals of PNG download initiations to understand how frequently the application is used. These are browser-reported events, not independently verified saved files.

Usage analytics contain only a UTC date and daily count. They do not store OSRS usernames, hashed usernames, portraits, generated cards, IP addresses, user agents or visitor identifiers. Daily totals are retained for long-term usage monitoring. No third-party analytics or analytics cookies are used.

Your entered username is sent to this server and the official Jagex hiscores service to retrieve your public statistics. The application does not retain it. Portraits are decoded and kept in browser memory; they are not sent to the server.

Short-lived, HttpOnly security cookies and temporary technical identifiers support abuse prevention. Optional access and administrator sessions also use HttpOnly cookies. Security records expire within 15 minutes; expired records are removed by scheduled maintenance and on subsequent security operations. Export tickets expire after two minutes. None of these identifiers enter the usage analytics table.

Your hosting provider, reverse proxy and Jagex may process connection information and logs. The administrator should configure logs to minimise retained query strings and IP addresses.

The administrator must configure a privacy contact before public launch.