Faux Bingo is a scoreboard for a community Old School RuneScape event. It is run by a clan volunteer, not a company, and it exists for the length of an event and the people playing in it. This notice says exactly what it stores about you, why, who else sees it, and how to get it removed.
If you only read one paragraph: there is no analytics, no advertising, no tracking pixel, and nothing is sold or shared with anyone outside the event. The data that does exist is your Discord identity, whichever RuneScape accounts you register, the drops the plugin reports, and the screenshots you or the plugin upload.
Who is responsible
Faux Bingo is operated by Daniel Goudie ("we", "us"), the site administrator, as the data controller for the purposes of the UK and EU GDPR.
Contact: admin@fauxbingo.com
What is collected
From Discord, when you sign in
Signing in uses Discord OAuth with the identify and guilds.members.read
scopes. From that we store:
| What | Why |
|---|---|
| Your Discord user ID | The only stable key that identifies you across sessions |
| Your display name at the moment you first sign in | Shown as your name on the site. It is captured once and never overwritten, so an admin's correction is not undone by a later login |
| Your avatar reference | Shown beside your name |
Your roles in the event's Discord server are checked but not stored. They are read to decide whether you are an admin, a captain, or a member of a team, and the answer is held in memory for at most 60 seconds before being read again.
Signing in also issues you a player token (a string beginning fbp_). It is
the credential the game plugin uses, and it is stored so the plugin can be
recognised. Treat it like a password.
From the RuneLite plugin, if you install it
The plugin is optional. Nothing in this section exists unless you install it and enter your player token. If you do, it reports:
accountHash— a stable identifier for a RuneScape account, provided by the game client. This, not your character name, is the key we store an account under, so a name change updates the display name in place.- Your character name, account type, world number, and world flags at the time of each event.
- Drop, collection log, pet and death events — the item names, item IDs, quantities and timestamps involved.
- The complete original event message, stored verbatim as JSON. This is kept so that a later version of the scoring engine can re-read events it did not understand at the time, rather than silently losing them.
- Play sessions — when a session started, when the plugin last checked in, and how many check-ins it made. This is how playtime is derived.
- Screenshots captured automatically at the moment of a qualifying drop.
A screenshot is a picture of your game client. It may incidentally contain your character name, your chat, private messages, or anything else on screen at that instant. Please treat it as public within the event.
From you directly
- Verification images you upload to prove a starting state.
- Tile images uploaded by you or your team captain as evidence for a tile.
Technical data
Two cookies, both strictly necessary, plus one that only appears if you connect an AI assistant:
| Cookie | Purpose | Lifetime |
|---|---|---|
faux-bingo-jwt | Your signed-in session. HTTP-only, so page scripts cannot read it | 7 days |
discord_oauth_state | Prevents a forged login callback (CSRF) | 10 minutes |
mcp_oauth_pending | Only set while authorising an MCP client | The length of that authorisation |
There are no analytics, advertising, or tracking cookies, which is why the site does not ask you for cookie consent — the ones above are exempt as strictly necessary. As with any web server, ordinary infrastructure logs may briefly record the IP address a request came from; nothing is built on top of them.
We do not knowingly collect special category data. Please do not put any in a screenshot.
Why, and on what legal basis
| Purpose | Basis |
|---|---|
| Signing you in, resolving which team you are on, and showing your name | Legitimate interests — running an event you asked to take part in |
| Scoring: matching drops to tiles, totalling team points, ranking players | Legitimate interests, for the same reason |
| Everything the plugin reports, including screenshots and playtime | Consent — you install the plugin and enter your token deliberately, and you can withdraw by removing it |
| Verification and tile images you upload | Consent — you choose what to upload |
| Keeping evidence so a disputed tile can be settled | Legitimate interests — the event has to be adjudicable |
Withdrawing consent for the plugin is uninstalling it or clearing your token. That stops any further collection; to remove what was already collected, use the erasure route below.
Who else sees it
- Other players, and anyone with the link. The board, the standings, team pages and the verification gallery are public. Your name, your team, your registered character names, your playtime and your tile evidence are visible there, and no sign-in is needed to see them. Tile evidence includes the screenshots the plugin captured for you, not only the ones somebody chose to upload — they are listed on the home page and on your team's board beside the drop they are proof of. A captain or an admin can delete any of them.
- Event admins and your team captain. Captains can manage their own team's evidence; admins can see and manage everything.
- Discord. Signing in happens on Discord's systems under Discord's own privacy policy. Separately, if your team has configured a screenshot webhook, the plugin posts your drop screenshots straight from your computer into that Discord channel. That upload does not pass through this site — the site never calls the webhook — but the result is that those images land in Discord, and Discord's retention applies to them, not ours.
- The scoring service. Events are handed to a companion service that decides which drops match which tiles. It is run by the same operator, on the same infrastructure, against the same database. It is not a third party in any meaningful sense, and it does not send your data anywhere else.
That is the complete list. Nothing is sold, rented, or shared for advertising, and there is no third-party analytics provider of any kind. Under US state privacy laws, we do not "sell" or "share" personal information, and there is no targeted advertising to opt out of.
Data is stored on a server in the United States. If you are in the UK or EEA, taking part means your data is transferred there. Given the scale — a single clan event — we rely on the transfer being necessary for the service you have asked us to provide.
How long it is kept
| Data | Kept |
|---|---|
| Your account, name, and registered characters | While the event runs, and while the site stays up afterwards so results remain readable |
| Drop events and their original messages | The same |
| Screenshots and uploaded images | The same |
| Play sessions | The same |
| Sign-in session cookie | 7 days, then it expires |
The site has no scheduled job that runs on its own, so retention is enforced by an admin acting deliberately rather than by a timer — we would rather say that plainly than promise an automatic purge that does not exist. When an event is over and the site is retired, the database behind it is deleted.
Ask sooner and it will be done sooner. See below.
Your rights
If you are in the UK or EEA, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how it is used, to receive a copy in a portable form, and to withdraw consent at any time. If you are elsewhere, we will honour the same requests regardless.
To exercise any of them, email admin@fauxbingo.com or message an event admin on Discord. Because your identity here is your Discord account, asking from the Discord account in question is how a request is verified. We aim to respond within 30 days.
Erasure is a real operation rather than a promise: an admin can erase a member, which removes the account, every registered character, every play session, every drop event including the stored original messages, and every image uploaded by or captured for that person. Team scores are deliberately left alone, so removing yourself does not rewrite the scoreboard for everyone else.
One thing to know: if you are erased but remain in the event's Discord server with a team role, signing in again creates a fresh account, because that is what signing in does. To leave for good, leave the Discord server or ask an admin to remove the role first.
If you think we have handled your data badly, please tell us first — but you have the right to complain to your data protection authority, which in the UK is the Information Commissioner's Office (ico.org.uk).
Children
This site is not for anyone under 18, in line with the Terms of Use, and we do not knowingly collect anything from a child. If you believe a minor has an account here, email admin@fauxbingo.com and it will be removed.
Changes
This notice is versioned in the site's public source repository, so every change to it is a dated, readable diff. Material changes will be announced in the event's Discord server.