Privacy & Data Retention

OneMan is a personal OSRS progression tracker. This page explains what the website and optional RuneLite plugin process, why the data is used, how long it is kept, and how you can export, deactivate, or delete your account.

What OneMan stores

Account data: username, password hash, account status, login timestamps.
OSRS profile and Hiscores data: character name, account type, skill levels, XP, ranks and recent gains.
RuneLite progress data when you explicitly enable OneMan Sync: quest states, Achievement Diaries, Combat Achievements, boss KC, Collection Log, pets, personal-best events, Clue Scroll STASH states, Slayer state, observed POH facilities, selected currencies, Bird House/Farming Contract/Kingdom state and progression timestamps.
Bank and selected storage snapshot data used by account-aware features, including current inventory/equipment, Rune Pouch, Seed Vault, Looting Bag and POH Costume Room when those storages are available or opened. The plugin does not send your bank PIN, Jagex password, email password or RuneLite/Jagex credentials.
Your own notes, roadmap preferences, session plans and manual progress choices.
AI Advisor data when you explicitly submit a goal: the goal, selected planning preferences, relevant OneMan/RuneLite account snapshot, retrieved OSRS knowledge sources and the generated plan. Passwords, RuneLite Sync Keys and Jagex credentials are not sent to the AI provider.

What is not intentionally collected

Jagex account password or authentication tokens.
Bank PIN.
Payment-card or banking information.
Private chat content as a tracking feature.

Normal web hosting may still process technical information such as IP address, request time, browser/user-agent and security logs as part of operating the service.

Application data retention

Current profile & progression stateWhile the account existsSkills, quests, diaries, CA state, boss KC, Collection Log, bank/storage snapshots, Clue STASH state, Slayer/POH/account-intelligence state, roadmap preferences and similar current-state data.

AI Advisor plans & historyWhile the account existsSaved goals, generated structured plans, source references and basic token-usage metadata. AI requests are sent with response storage disabled where supported; provider-side security/abuse retention is governed by the AI provider’s policy.

Chronicle memoriesUntil account deletionImportant progression memories are designed to remain as your permanent account history unless you delete the account.

Raw boss loot history90 daysOlder raw loot rows are automatically removed. Important unlocks can remain separately in Chronicle.

RuneLite sync audit90 daysLow-level sync audit rows used for troubleshooting and service integrity.

Hiscores sync history180 daysHistorical Hiscores sync rows and their change records. Current skill state remains while the account exists.

Revoked RuneLite device records30 daysRevoked device metadata is cleaned up after the retention window. The raw Sync Key is never stored after it is shown to you.

Your controls

From Account → Privacy & account controls you can export a copy of your OneMan data, revoke RuneLite devices, deactivate your account, or permanently delete a normal member account.

Deactivate: sign-in and RuneLite sync stop, while your data is kept so you can reactivate later.
Delete: the user record and linked progression data are deleted through database cascade rules. This action is intended to be permanent.

RuneLite Sync consent

OneMan Sync is optional and must be enabled/configured by the user. A private OneMan Sync Key links the plugin to your OneMan account. You can revoke a linked device at any time from the Account page.

Security & limitations

Passwords are stored as password hashes, and RuneLite Sync Keys are stored only as cryptographic hashes after issuance. No website can promise absolute security. OneMan aims to minimize stored secrets and separate authentication credentials from game progression data.

Last updated: 2026-10-01