Privacy

• Nothing is required. The map, the search, the travel routes and the star list work with no account, no cookie you have to accept, and nothing stored about you at all.
• Your settings live in your browser. Favourites, pins, the travel profile, filters, layers, theme and the farm run are localStorage on your own device unless you sign in and ask for them to follow you.
• No position history, ever. Where a player is standing is held in memory for minutes so their friends can see the dot move, and there is no column in this server’s database that could hold it.
• Nothing here can be searched by name. This site cannot answer “where is player X”, and that is a design line rather than a missing feature.
• There is no advertising, no analytics service and no third-party tracker on any page.

Most of what this site knows about you is in your own browser and has never been anywhere else. Clearing your browser data for this site deletes all of it, and the site keeps working — it just forgets your preferences.

That covers your favourite landing sites, your personal pins, your travel profile (levels, quests and diaries you have told it about), star filters, which map layers are on, light or dark, the farm run you are planning and the runs you saved, the player name you looked up on the hiscores, and which groups you have been in.

Three cookies exist, none of them for tracking, and the page’s own scripts can read none of them. companion_device is 32 random bytes that let this server recognise the same browser between requests, so a group can have owners and members at all. It carries no name, no address and nothing about a person, only its own SHA-256 is stored, and it exists because the live group stream cannot send headers, so there was nowhere else to put it. The other two exist only if you sign in: companion_session says which account you are (see below), and companion_oauth_state lives for the ten minutes of the trip to Discord and back, so the reply can be checked as the one this browser asked for.

The server keeps what a shared secret in memory cannot do: a group that survives a quiet week, the browsers that own and belong to it, the invites that let people in, and — only if you signed in — your account and the settings it carries.

• Live positions, worlds, skills and the group's timeline

  Kept: Minutes. A member the server stops hearing from is dropped after 30 minutes, and everything goes when the process restarts

  Memory only, never written to disk

• Your RuneLite code (the personal half of ABC234-K7PQ2M3X)

  Kept: 1 day, refreshed whenever the card is shown

  Database, as a hash

• Invite links

  Kept: Until they expire, fill up, or an owner withdraws them, and 7 days after that — long enough to tell whoever clicks the link which of those happened

  Database, as a hash

• A group: its name, its members, the browsers in it, its meetups

  Kept: While the group exists — until an owner closes it, or 180 days with nobody in it saying anything. Somebody an owner removed is kept as a removal for 90 days, so their client is told what happened rather than quietly let back in

  Database

• Who said they were coming to a meetup, and the places a group has named

  Kept: While the group exists. Removing somebody, leaving from a browser, or forgetting one takes their answers with them; the places stay with the group, with nobody's name on them

  Database

• A group's activity — notable rewards, pets, collection unlocks and levels — when its owner turns it on

  Kept: 14 days and 200 entries, whichever ends first. Off unless an owner switches it on; the live timeline is 30 minutes either way

  Database

• Groups made before invite links existed

  Kept: 1 day of silence, as they always have been

  Memory, plus one row saying the code exists

• A closed group's tombstone (the code, marked closed)

  Kept: 30 days, so an old plugin is told the group ended rather than recreating it

  Database

• This browser, as a random number in a cookie

  Kept: Until you clear it, or a year unseen holding nothing

  Database, as a hash

• Your account and the settings it syncs, if you signed in

  Kept: Until you delete it, or a year without signing in

  Database

• Backups of all of the above

  Kept: 14 days of snapshots; eight weeks of weekly copies

  The host's volume snapshots, and one weekly copy off it

Every secret in that table is stored as a SHA-256 and nothing else: the device cookie, the invite tokens, the RuneLite codes. The one exception is the last four characters of an invite, kept in the clear so the person who made it can tell one open link from thirty and withdraw the right one.

Three lines this site holds regardless of what the rules would allow:

• No stored position history. A name beside a live location is the dataset that scouts, scammers and harassers want. Positions are in memory for minutes and are never written down, so there is nothing to hand over or to lose.
• No lookup by name. A character name is a label on a dot inside one group, sent only while the plugin’s own toggle is on. Nothing here is searched, joined or indexed by it.
• No game-account identifier is uploaded. The plugin uses RuneLite’s local character profile to keep loot histories separate. That local profile key never reaches this site; no server row is tied to a permanent Jagex account identifier.

There is also no email address anywhere — not even from signing in — no password, no payment details, and no public directory of groups or players.

Your own settings are readable by your browser, and by your other browsers if you signed in on them. Nobody else can ask for them.

Inside a group, everyone in it sees what the members’ plugins send: position, world, levels and whatever else each player has that plugin sharing, plus a name if that toggle is on. That is the point of a group, and the way in is an invite link somebody chose to give you — knowing a group’s six-character code is not enough.

Outside a group, nothing. There is no page, no search and no API that answers a question about a person, and the server has no way to look one up.

The site is one small machine run by one person. Nobody else has an account on it, nothing is sold or shared, and the only automated copies are the backups in the table above.

Signing in with Discord is optional and does exactly two things: it makes your favourites, pins, travel profile and groups appear on every browser you sign in on, and it gets them back if a browser is cleared. Everything on this site works without it.

What is stored is your Discord user id, your display name and your avatar hash. Not your email — the sign-in asks Discord only for the “identify” scope, which does not include one. The access token from the sign-in is used once to read that name and is then discarded; it is never stored, logged or sent to your browser. Your Discord password never touches this site.

A session is a cookie signed by this server that says which account you are. It lasts 30 days and is HttpOnly. Signing out ends it and detaches this browser from the account, so it stops acting for you on the server as well as in the page, and a copy of the cookie taken from this browser stops working with it — what it keeps is what it holds in its own right: the groups it joined itself, and the dot bound to it. Signing back in re-attaches it in one press.

Your avatar picture is loaded from Discord’s own image servers when the account card is on screen, so Discord sees that request. Nothing else on this site loads anything from them.

The optional RuneLite companion plugin is what puts your dot on the map. It sends what it sends only while you have paired it with a group, and its own README and its settings describe every field — including a Show what’s sent button that prints the exact payload before it leaves your client. Nothing about your game account is sent unless that plugin is installed, enabled and paired; leaving the group in the plugin stops it immediately.

Separate switches cover permanent travel unlocks and your house town, STASH construction, birdhouse observations, hunter rumours, Mahogany Homes, farming contracts and the full quest log. They start off. STASH sharing reports construction, not stored equipment; assignment readers send the recognised task, not its dialogue. Birdhouse timers are estimates from RuneLite Time Tracking. These facts are visible to your group under the same memory-only lifetime as other live companion data; they are not added to its saved activity feed. Sharing travel quests does not enable sharing the full quest log.

There are three doors, because there are three things you can own here.

• Forget this browser — no account needed. It deletes this browser’s row, takes it out of every group, cuts loose any dot bound to it, closes any group it was the only owner of, and clears the cookie. Your own settings go with the browser data you clear alongside it.
• Delete my account — in Settings once you are signed in. It is the above for every browser signed into the account, plus the account itself and every setting it was syncing. One transaction, irreversible. Download my data sits beside it and gives you everything the server holds about you as one JSON file first.
• Close my group — for an owner. It deletes the group’s members, browsers, invites and meetups, tells every paired plugin why, and leaves only the tombstone that stops the code being reused.

A deletion reaches the backups as they age out: the volume snapshots roll over within 14 days and the weekly copies within eight weeks. Nothing is restored from a backup except to recover from a failure.

Three other services are involved in loading these pages, and none of them is given anything about you beyond the request itself.

• The map tiles and place photographs come from an object store on Cloudflare R2, and the site is served through Cloudflare and Fly.io, which see the ordinary things a web server sees — an address, a browser, a page.
• The live star list comes from the community Star Miners feed. This server fetches it once for everybody; your browser never talks to them.
• The hiscores lookup, if you use it, asks Jagex’s public hiscores for the name you typed. That name is stored in your browser only.

This site is unofficial and not affiliated with Jagex. Questions, corrections and deletion requests are best sent as an issue on the repository, which is also where every claim on this page can be checked against the code that makes it true.

When what the site keeps changes, this page changes in the same commit as the code — that is a rule the project holds itself to rather than a promise to review it annually.

The canonical address of this page is https://shootingstarsmap.com/privacy.