RuneScape
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Jagex collects account, game, device and ad IDs, uses third-party ads, and may treat some sharing as a sale you can opt out of.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, game play, device and ad IDs, IP/location, and sometimes data from partners and brokers.
Read the exact line
Privacy policy
“Technical Data commonly known as online identifiers and includes internet protocol (IP) address, unique mobile device identification numbers (such as your Media Access Control (MAC) address, Identifier For Advertising (IDFA), and/or International Mobile Equipment Identity (IMEI)”
Training
They use it to run games, stop cheating, do ads and analytics, and they use AI tools to help those jobs.
Read the exact line
Privacy policy
“We use AI and machine learning technologies to improve our services and provide a better player experience.”
Sharing
Service providers, ad networks, platforms, and sometimes law enforcement; US users can opt out of sale/sharing.
Read the exact line
Privacy policy
“We may sell and may have sold in the last twelve (12) months the following categories of Personal Information: identifiers; Personal Information categories applicable to the processing; commercial information; or internet or other similar network activity.”
Kept
They keep data as long as needed; billing can last six tax years and some ban data six years.
Read the exact line
Privacy policy
“By law, we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six tax years plus the current tax year as part of our legal obligations to do so.”
Controls
You can ask to see, fix, or delete data, opt out of marketing and some ads, and use a do-not-sell page.
Read the exact line
Privacy policy
“You can always:ask us for a copy of the information we have about you;ask us to update the information we have about you;ask us to delete the information we have about you;”
Fine print
Policy is versioned with a changelog; under-13s are not allowed. Terms on suing and refunds are not in this document.
Read the exact line
Privacy policy
“If you are under the age of 13, you are not allowed to use our services.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of sale/sharing of personal information
https://support.runescape.com/hc/en-gb/articles/360001370829
Turn off marketing emails
Log into the website and adjust marketing preference boxes, or use opt-out links in emails, or contact dpo@jagex.com
Ask to access, correct, or delete your data
Contact dpo@jagex.com or use the rights process described in the privacy notice
Reset or limit advertising ID
Device settings: Limit Ad Tracking (iOS) or Opt Out of Ads Personalization (Android); Google Ads Settings for web
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can get your name and contact details from companies that buy and sell lists of people.
Read the exact line
Privacy policy
“Identity and Contact Data from data brokers or aggregators based inside AND outside the UK and the EU.”
For example, a broker list could add your email to Jagex’s records even if you never typed it in the game.
Ad companies can track you across sites and apps to show targeted ads.
Read the exact line
Privacy policy
“We and our third-party vendors use cookies and non-cookie technologies to help us recognize your Device and understand how you use our services so that we can improve our services to reflect your interests and serve you advertisements that are likely to be of more interest to you.”
For example, playing RuneScape could lead to Jagex ads following you on other websites.
Under US privacy law they treat some sharing as a sale, though they also say they do not sell in the everyday sense.
Read the exact line
Privacy policy
“We may sell and may have sold in the last twelve (12) months the following categories of Personal Information: identifiers; Personal Information categories applicable to the processing; commercial information; or internet or other similar network activity.”
For example, sharing your device ID with an ad network may count as a sale you can opt out of.
Even if you leave, some account and payment records can stay for many years.
Read the exact line
Privacy policy
“By law, we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six tax years plus the current tax year as part of our legal obligations to do so.”
For example, your billing identity could still be on file about seven years after you stop playing.
They build guesses about you, such as how you play and whether you look like a cheater.
Read the exact line
Privacy policy
“Inferences drawn from PII: Predictions about fraud likelihood, gaming preferences, hijack and real-world trading detection.”
For example, unusual login patterns could be scored as a hijack risk and lock your account.
They try not to let outside AI companies train on your personal data, but they do use AI themselves.
Read the exact line
Privacy policy
“Wherever possible, we do not allow our service providers, partners, or other third parties to use your Personal Data for the purposes of training their own AI or machine learning models.”
For example, a support chatbot vendor should not feed your tickets into its public model if they follow this rule.
They say they do not collect health, religion, sex life, or biometric ID data.
Read the exact line
Privacy policy
“We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).”
For example, the game should not store a face scan to identify you.
They claim they use security controls and limit who can see your data.
Read the exact line
Privacy policy
“We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorised way, altered, disclosed or being unavailable.”
For example, only staff who need it for support or anti-cheat should be able to look up your account.
Kids under 13 are banned, but the policy does not describe a hard age check.
Read the exact line
Privacy policy
“If you are under the age of 13, you are not allowed to use our services.”
For example, a 12-year-old could still make an account if they type an older birthday.
They need your yes before giving your details to outside companies for those companies’ marketing.
Read the exact line
Privacy policy
“We will get your explicit opt-in consent before we share your Personal Data with any company outside Jagex for marketing purposes.”
For example, they should not hand your email to another game studio’s mailing list unless you agree.
Words to know
Legal words from the lines above, in plain English.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- data broker
- A company that buys, collects and resells information about people, usually without ever meeting them. For example, your phone number and shopping habits can be sold as part of a list to a company you never heard of.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- profiling
- Building a picture of who you are, what you like and what you might do next from your data. For example, an app may guess your income, health or politics from what you watch and tap.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
- sensitive personal information
- Data that could hurt you if exposed, like health, religion, sexuality, race, exact location or bank details. For example, telling a chatbot about a medical condition creates sensitive data that some laws protect more strictly.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- opt in
- Something is off until you actively say yes to it. For example, marketing emails that only start after you tick a box are opt in.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
How we got here · grade D · score 35/100 · 15 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect account and game data plus device IDs, advertising IDs, IP/geolocation, usage, and data from platforms and brokers.
Does it record your voice, face or body, and what happens to that?
They say they do not collect biometric data used to identify you. Event photos are mentioned separately.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use third-party ad networks, cookies, and advertising IDs, with some opt-outs.
Do they sell or share your data, and can you opt out?
They share with providers and ad partners; under US law they may sell identifiers and activity, with a do-not-sell opt-out.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Deletion is mainly by request; billing data can be kept for six tax years and some ban data for six years or more.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They keep profile and game data and draw inferences about preferences and fraud; they do not describe a memory on/off switch.
Do they commit to basic security, and have they leaked data?
They describe access limits, confidentiality, reviews, and breach procedures, but not an independent audit in this notice.
Is there a real age gate, and are teens protected?
Under 13s may not use the services and they say they do not knowingly collect from under 16s, with no age-proof process described.
Will they tell you when the rules change, and is the policy specific?
The notice has a version, changelog, and last-updated line, but retention periods are mostly “upon request.”
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 10,367 words at a professional or legal expert level (Flesch reading ease 0).
