Privacy policy

Last updated: 2026-10-16
Effective date: 2026-10-16
Applies to: the RuneNative app (Android, and iOS later), the RuneNative plugin for RuneLite, and the relay we run at relay.runenative.com

Who we are

RuneNative is a free, unofficial fan project. The RuneNative plugin is open source; the app and the relay are not. Created using intellectual property belonging to Jagex Limited under the terms of Jagex's Fan Content Policy. This content is not endorsed by or affiliated with Jagex. RuneNative is not endorsed by or affiliated with the RuneLite project.

RuneNative is run by RuneNative LLC, a limited liability company registered in Iowa, USA. RuneNative LLC is responsible for the personal data described in this policy (the "controller"). "We" and "us" in this policy mean RuneNative LLC.

Contact: privacy@runenative.com, or by post: RuneNative LLC, 6701 Corporate Dr Ste N, Johnston, IA 50131, USA.

The short version

Your game data is end-to-end encrypted between your RuneLite and your phone. We cannot read it.
The relay sees routing metadata: which link a message belongs to, its type, its timing and size, and whether you are logged in.
Your phone's push token and a random install id are stored so the relay can reach your phone. They are used only to run RuneNative.
The relay and its hosting provider see your IP address when you connect. The relay doesn't store it.
Screenshots, if you turn them on, are stored encrypted until your phone downloads them, and deleted automatically after about 7 days if it never does.
No accounts. No analytics. No ads. We don't sell or share your data.

How RuneNative works

You install the RuneNative plugin in RuneLite on your PC and the RuneNative app on your phone.
You pair them with a one-time code. During pairing, the plugin and the app agree on an encryption key that only they hold.
While you play, the plugin sends your RuneLite notifications, game status, timers and (if you turn it on) screenshots through our relay to your phone.
While the app is connected, messages arrive over a live connection. Otherwise the relay asks Google (Android) or Apple (iOS) to deliver a push message, which the app decrypts on the phone.

The phone never sends input to the game. It can only change the RuneNative plugin's own settings, and only if you allow that in RuneLite.

End-to-end encryption

At pairing, the plugin creates a random 256-bit key and wraps it for your phone using X25519 key agreement and HKDF-SHA256.
Every message body, every push payload and every screenshot is encrypted with AES-256-GCM using that key.
Only your phone and your RuneLite hold the key. If your RuneLite profile syncs to a RuneLite account, the key syncs with your other RuneLite settings to RuneLite's servers (see "What stays on your devices"). The relay, Google and Apple never have it.
Both sides show a 6-digit safety number while pairing. If the numbers match, nobody swapped the keys.

What is inside the encryption (the relay cannot read it):

notification text, and the name of the plugin that raised it
game status: hitpoints, prayer, run energy, inventory slots used, world, activity (Active, In combat or Idle), idle-logout countdown, session length, last XP drop, and whether the RuneLite window is focused
your character name, only if you turn that on
logout and disconnect alerts and their reasons
Time Tracking timers (farming, birdhouses and similar)
screenshot images, and the folder name and category attached to them

One exception, iOS Live Activities (opt-in). iOS draws a Live Activity on the lock screen from the push message itself, so its content can't be encrypted end to end. If you turn on the Live Activity status on iOS, the fields you choose (for example hitpoints and the idle countdown) travel in plain text through our relay to Apple. The relay keeps the latest of them with your latest status (see below). Nothing is sent this way unless you turn it on, and only the fields you pick. Android status stays encrypted.

What the relay stores

The relay needs some information in the clear to route messages. This is everything it stores.

Data	Why	How long
Link id and device ids	To send each message to the right phone and PC	While the link exists. After you unlink, a record that the link existed (its link id, both device ids and dates) is kept so the ids are never reused.
Link tokens, stored only as a SHA-256 hash	To check that a connection belongs to your link	Until you unlink
Install id: a random id the app creates when installed, and creates again after a reinstall	To start pairing, and to remove your older link when the same phone pairs again	Until you unlink
Platform (`android` or `ios`) and the app's version	To choose Google or Apple for push, and to tell an old app to update	Until you unlink
Push token: on Android a Firebase installation id, which FCM uses as the push address; on iOS an APNs device token and Live Activity push tokens	To deliver push messages	Until you unlink, or until Google or Apple reports it is no longer valid, which the relay learns the next time it tries to push
Pairing record: the pairing code (only as a hash), the install id, both sides' public keys, the PC's label, the safety number, and the link key wrapped so only your phone can open it	To finish pairing	The code works for 10 minutes. The record is deleted about a day after pairing started.
The PC's label, such as "RuneLite on Windows"	To show which PC is linked	Until you unlink
The plugin's version, its instance id, when it was last connected, and whether you are logged in	To tell an old plugin to update, and to notice when your PC goes quiet while you're logged in	Until you unlink
Message headers: type, plugin instance id, sequence number, timestamps, event id, and whether you are logged in	To order and de-duplicate messages, and to decide when to push	The last 256 event ids per link
Your latest status, session and timers messages, and up to 200 notices of screenshots waiting for your phone	So your phone can catch up when it reconnects	Until replaced, until your phone confirms it, or until you unlink. Their contents are encrypted, apart from Live Activity fields if you turned those on.
Counts of pushes and screenshot uploads	To limit abuse	Until you unlink
The plugin's settings, including the names of the notification sources you muted, in plain text	The relay checks setting changes against a fixed list before passing them on	Until you unlink

From timestamps alone, the relay could work out roughly when you play and how often you get notifications. We don't analyse this.

IP addresses

Every connection to the relay reveals your IP address, from both your PC and your phone.
The relay doesn't store IP addresses. To limit pairing attempts (30 pairing starts and 20 failed codes per address per hour), it stores a one-way hash of your address, keyed with a secret, along with the time of the attempt. These are deleted after about an hour.
The relay's own logs record errors and undelivered pushes, with link and device ids. They never contain IP addresses or message content. Cloudflare keeps them for up to 7 days.
Cloudflare, which hosts the relay, processes IP addresses to run its network, under its own privacy policy. That includes short-lived counters per address, which block anyone sending far more requests than the app and plugin ever do.
The plugin warns you, when you press Pair and on its Plugin Hub listing, that it sends your IP address to a third-party server.

Screenshots

Screenshots are only sent if you turn on the plugin's screenshot setting. It is off by default.
The plugin encrypts each screenshot on your PC before upload. The relay stores the encrypted file in Cloudflare R2 storage.
The relay deletes the file as soon as your phone confirms it has it.
Any file not confirmed is deleted automatically 7 days after upload. Cloudflare carries out these deletions within about a day of the 7-day mark, so a file can last up to about 8 days.
On your phone, the app saves screenshots to your gallery, in a RuneNative folder sorted by character and category. From then on they are your files, under your control.

Push notifications

Android uses Firebase Cloud Messaging (FCM), run by Google.
- The push payload is the encrypted message plus its routing header. Google cannot read the content.
- The Firebase Messaging library on your phone also sends Google a Firebase installation id, the app version and basic device and SDK information, so that FCM can deliver messages.
iOS uses the Apple Push Notification service (APNs), run by Apple. The relay sends iOS pushes directly to Apple.
- Alert pushes carry a generic placeholder text and the encrypted message. The app replaces the placeholder with the real text on your phone.
- Live Activity updates are the plain-text exception described above.

What we don't do

No accounts, sign-in, email address or phone number.
No analytics, crash reporting or tracking libraries.
No advertising.
No selling, renting or sharing of data, apart from the service providers below.
No location, coordinates or map regions. No other players' data. No chat log.
No input to the game, ever.

Service providers

Provider	What it does for RuneNative	Its privacy policy
Cloudflare	Hosts the relay (Workers, Durable Objects, D1 and R2 storage) and our website	https://www.cloudflare.com/privacypolicy/
Google (Firebase Cloud Messaging)	Delivers push messages to Android phones	https://firebase.google.com/support/privacy
Apple (Apple Push Notification service)	Delivers push messages to iPhones	https://www.apple.com/legal/privacy/

What stays on your devices

Phone: your notifications, status, timers and settings, the link token and the encryption key.
- The token and key are encrypted with a key held in the Android Keystore (or kept in the iOS Keychain), and are excluded from device backups.
- Your other app data may be included in your phone's own Android backup to your Google account.
PC: the link token, the encryption key and the plugin's private key are stored as hidden RuneLite settings.
- If your RuneLite profile syncs to a RuneLite account, they sync with it to RuneLite's servers. Anyone who can open that profile could then read what RuneNative sends to your phone, if they could also get hold of it.
- To keep the keys on this PC only, use RuneNative with a RuneLite profile that doesn't sync.
The plugin keeps unsent events in memory only, for at most 10 minutes. It writes no files of its own. RuneLite's log records the link id when you pair.

Deleting your data

Unlink, from the app or from the plugin. The relay:
- revokes every token on the link;
- deletes the link's stored data: push tokens, settings, the cached status, session and timers, and any screenshots still waiting;
- forgets the app's install id.
It keeps only the record that the link existed. If the relay can't be reached when you unlink, both sides forget the link anyway, and it stays on the relay holding only the data above.
Uninstall the app. This deletes the app's data from your phone, apart from screenshots saved to your gallery.
- The link stays on the relay until you unlink it from the plugin, because links don't expire.
- The relay drops your phone's push token once Google or Apple reports it is no longer valid.
- If you pair the same PC again, the old link is removed.
Lost both your phone and your RuneLite profile? Nobody can use the link any more: its contents are encrypted with a key only those held.
- To have it deleted, email us the link id from RuneLite's log (client.log, the line "RuneNative paired with link …") if you still have it, and we will delete the link.

Children

RuneNative is made for Old School RuneScape players. It is not directed at children under 13, and it does not ask for or knowingly collect personal information from anyone.

Changes to this policy

We will post any change here with a new date. If a change affects what the relay can see, the app will tell you before it takes effect.

Contact

privacy@runenative.com