Privacy
What this site stores
AutoBuddy hiscores keep only what you opt in to send. This project is not affiliated with Jagex or RuneLite.
Stored
An account has a username and a display name. If you register with a password, the site stores a password hash, not the password itself. If you sign in with Discord, the site stores the Discord profile Auth.js returns for that login: the account id and the name shown on the site.
A plugin connection is an API token. The token you paste into RuneLite is shown once. After that the database keeps a hash and a short prefix so you can recognize the row. Session uploads attached to that token store counters: experience, kills, time, flips, and an estimated GP total when the plugin sends one. A hiscore row is the sum of those counters. You can turn your public name off; the totals can remain labeled Anonymous.
Not stored
The site does not store Jagex passwords, game login secrets, chat, coordinates, or world dumps. Upload stays off until you enable it. Revoke a token or delete the account from Settings, and the tokens and uploaded sessions tied to that account are removed.