Last updated: . Version of the consent texts in the apps: 2026-11-04.1.
On this page:
- For everyone (the UK GDPR and the Data Protection Act 2018): what is collected, why, for how long, who receives it, and your rights.
- Users in the EU (the EU GDPR).
- Users in Turkey (KVKK): a separate Aydınlatma Metni and Açık Rıza Metni, in Turkish.
- Cookies and local storage.
Who is responsible
osb.lol, OSB and OSB Manager are provided by Corevider. Corevider is the controller of the data on this page. For any privacy question: [email protected].
Data is processed under the UK GDPR and the Data Protection Act 2018. Extra rules for the EU and Turkey are in their own sections below.
In short
- Today every feature of our server is switched off: usage statistics, bug reports, screenshots and the feedback form. So the apps send nothing to us at the moment. If we switch these features on later, the apps still send data only after you agree, or when you send a report yourself.
- OSB and OSB Manager send nothing to us until you switch sharing on: no install registration, no check-in, no statistics.
- The one exception: a bug report or feature request that you write, see in the preview and send.
- The apps send only to our own server, api.osb.lol. We do not sell data and use no advertising or analytics tools.
- You can switch sharing off at any time. Your usage data on our server is then deleted, and the apps work the same.
What we collect and why
This website (osb.lol)
| Data | Why, and the lawful basis | Kept for |
|---|---|---|
| Page requests: IP address, browser details, the address requested | To deliver the pages and protect the site. Cloudflare does this for us. Legitimate interests. | We keep nothing. Cloudflare keeps its own records under its terms. |
| The live numbers box: your browser asks api.osb.lol for totals only | To show total usage numbers; the IP address is used in memory only, to limit abuse. Legitimate interests. | 14 days in the server log, with a shortened IP |
The support and feedback form
| Data | Why, and the lawful basis | Kept for |
|---|---|---|
| Message, topic, language, the reference code you get | To read and answer your message and fix problems. Legitimate interests. | While the matter is open, then 6 months. Spam 30 days; entries never handled 90 days. |
| E-mail address, only if you type it | To reply to you. Legitimate interests. | At most 90 days |
| The Turnstile check | To keep bots away from the form. Our server sends the one-time code from Turnstile and your IP address to Cloudflare to verify it. Legitimate interests. | We keep nothing from the check |
| IP address | To limit abuse. Legitimate interests. | Never written to the database; 14 days in the server log, shortened |
OSB and OSB Manager: usage statistics, only if you switch them on
In OSB, sharing starts off in the Privacy section of Settings and runs only if you switch it on. OSB Manager asks once, at first start; if you choose "No thanks", nothing is sent. Both can be switched off at any time in their Privacy section.
| Data | Why, and the lawful basis | Kept for |
|---|---|---|
| Install record: a random install ID, a hash of the install key, the app and its version, operating system, language, the version of the consent text you accepted, first and last seen | To count and group installs, and to prove that an export or delete request comes from you. Consent. | Deleted 90 days after the install was last seen; at once when you switch sharing off |
| State of each game account: an opaque slot code (not your login ID), bot state, level, gold, HP and MP percentage, return and reverse scroll counts, bot version | To see how the software is used and where it gets stuck. Consent. | 45 days after last received |
| Bot session counters: duration, kills, deaths, XP, gold, SoX drops | To see session statistics in our dashboard. Consent. | 45 days after last received |
| Character name and server, only if you also switch on the second option | To see your characters by name in our private dashboard; never shown publicly. Consent. | Removed at once when you switch the option off; otherwise kept with the account state |
While sharing is on, the app sends a small status report about every 10 minutes and reads our server's settings at most every 6 hours. OSB running inside OSB Manager sends no usage statistics; the Manager reports those accounts. The totals on osb.lol are computed from this data; numbers below 10 are hidden and the others are rounded down.
Bug reports and feature requests, only when you press Send
| Data | Why, and the lawful basis | Kept for |
|---|---|---|
| Your description, the report kind, the technical details shown in the preview, app version, operating system, language, the report code | To fix bugs and plan features. You send the report yourself, after seeing all of it. Legitimate interests. | While the matter is open, then 6 months. Spam 30 days; reports never handled 90 days. |
| Screenshot, only if you add one to that report | To see the problem. The server re-encodes the image and drops any metadata in it. Legitimate interests. | 30 days after receipt, or when the report is deleted |
| A link to your install, only if usage statistics are on | To delete and export the report with your install. With statistics off, the report is anonymous. | With the report |
When you press Send, the app first asks our server whether reports are open, then sends the report. OSB does not store a report that could not be sent; it tries up to three times in the same page session. OSB Manager keeps unsent reports in an outbox on your computer for up to 72 hours, then moves them to a "failed" folder, where you can send them again or delete them.
E-mail to [email protected]
We use your address and message to answer you and handle your request. Basis: legitimate interests; for a rights request, a legal obligation. Kept for: as long as we need to handle your request and to show that we did. We have not set a fixed period yet; when we do, it will be written here.
Our own records
| Data | Why, and the lawful basis | Kept for |
|---|---|---|
| Audit log: when we release, block, export or delete an install or a report, the action, the time and the install ID or report code | To show what was done, including your deletion request. Legitimate interests. | 12 months |
| Server log: a shortened IP (the last block of IPv4 and the last 80 bits of IPv6 are removed), the time, the address requested, and the browser or app version string | Security and debugging. Legitimate interests. | 14 days |
| Encrypted backups of the database, on the same server | To restore after a failure. Legitimate interests. | 14 days; a record we delete leaves the backups within 14 days |
What we never collect
Your game login ID, password, real name, account display name, position, party members, chat, item names, file paths, computer name, hardware identifiers and the other software on your computer. We get your e-mail address only if you type it into the form. Please keep passwords and personal details out of messages and reports.
Who receives the data
- Cloudflare, Inc. (USA), on our behalf. It serves the site (Cloudflare Pages), protects api.osb.lol (proxy and firewall), runs Turnstile, forwards e-mail sent to [email protected] to our own mail server (Email Routing) and guards the sign-in to our admin panel (Cloudflare Access).
- Contabo GmbH (Germany), on our behalf. api.osb.lol, the admin panel, the database and its backups run on Contabo's server in Germany.
- GitHub, Inc. (USA), in public. When a report shows a real bug, we may open a public issue in corevider/osb or corevider/osb-manager. We write the issue and read it before it is published. It holds only our own summary, the product and version, and the report code. It never quotes your description or the technical details, and it never contains the install ID, slot code, character or server name, e-mail address or screenshot.
- Mailbox: e-mail to [email protected] is forwarded to our mailbox on our own mail server, hosted in Germany.
- Authorities, only when the law requires it.
Requests that do not go through us: OSB asks GitHub for updates when it starts, and OSB Manager downloads OSB from GitHub. These requests go straight to GitHub, which sees your IP address, and GitHub's privacy terms apply. You can switch OSB's update check off in OSB's Settings with "Check GitHub for OSB updates"; when it is off, OSB sends no request to GitHub. The game's own traffic goes to opensro.online, not to us.
Where the data is, and transfers outside the UK
We are in the UK. Our server, the database and its backups are in Germany, and e-mail to [email protected] is kept on our own mail server in Germany too. The recipients that process your data outside the UK, and the safeguards we rely on:
- Contabo GmbH and our mail server (Germany): Germany is in the EU, and so in the European Economic Area. The UK has adequacy regulations for the EEA countries, so this transfer needs no further safeguard.
- Cloudflare, Inc. (USA): Cloudflare is certified under the EU-US Data Privacy Framework and its UK Extension. Cloudflare's data processing addendum also includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
- GitHub, Inc. (USA), public issue text only: GitHub is certified under the EU-US Data Privacy Framework and its UK Extension.
For users in the EU: our server is in the EU, so data sent to our server does not leave the EU. For the data we, as the controller, access from the UK, the European Commission's adequacy decision for the UK applies.
You can ask for a copy of these safeguards at [email protected].
How long we keep it
| Data | Kept for |
|---|---|
| Account state and session counters | 45 days after last received |
| Install record | 90 days after last seen; at once when you switch sharing off |
| Character and server names | At once when you switch the second option off; otherwise with the account state |
| Reports and form messages | 6 months after the matter closes; spam 30 days; never handled 90 days |
| Screenshots | 30 days |
| E-mail address from the form | At most 90 days |
| Correspondence with [email protected] | As long as needed to handle your request and show that we did; no fixed period yet |
| Audit log | 12 months |
| Server logs (shortened IP) | 14 days |
| Encrypted database backups | 14 days |
Your rights
- Access your data and get a copy of it.
- Have wrong or incomplete data corrected.
- Have your data erased.
- Have the processing restricted.
- Get your data as a machine-readable file (portability).
- Object to processing based on legitimate interests.
- Withdraw your consent at any time. It costs you nothing: the apps work the same with sharing off. Processing before the withdrawal is not affected.
How to use them
- In the app: the Privacy section of Settings in OSB, and the Privacy window in OSB Manager. Switching sharing off deletes your data on the server. "Delete my data" does the same, "Download my data" gives you a JSON file, and "Show what is sent" shows the next report exactly.
- Data on your computer: you delete what the apps keep on your own computer; Cookies and local storage says where it is.
- By e-mail: write to [email protected]. So we can find your records, include the install ID (shown in the Privacy section) or the report code. We cannot find an anonymous report without its code. We answer within one month, free of charge.
Complaints
If you are not happy with our answer, you can complain to the UK's data protection authority, the Information Commissioner's Office (ico.org.uk). The authorities in the EU and Turkey are below.
Automated decisions
We make no automated decisions that have legal or similarly significant effects on you, and we do no profiling. An automatic spam filter keeps new installs and anonymous reports in a separate inbox until we look at them; this has no effect on you or on the apps.
Children
OSB, OSB Manager and osb.lol are not meant for anyone under 16. If you are under 16, do not switch on usage statistics and do not send us a form, a report or an e-mail.
Users in the EU
- If you are in the EU, the EU GDPR also applies to the processing that its Article 3(2) covers.
- Your rights, the lawful bases and the retention periods are the same as above.
- You can complain to the data protection authority of the EU country where you live, work or where the infringement took place. The list of authorities is at edpb.europa.eu.
- Our server is in Germany, in the EU.
- The European Commission renewed its adequacy decision for the UK on 19 December 2025; it runs until 27 December 2031.
- We have not appointed a representative in the EU under Article 27. You can reach us directly at [email protected].
Users in Turkey
For users in Turkey, the information required by the Personal Data Protection Law No. 6698 (KVKK) is in two separate texts, in Turkish:
- Aydınlatma Metni (disclosure notice): who we are, the purposes, the method and legal grounds of collection, to whom and why data is transferred, and your rights under Article 11.
- Açık Rıza Metni (explicit consent text): the consent you give for the optional usage statistics and character names.
Cookies and local storage
osb.lol
The pages of osb.lol set no cookies and do not use your browser's local storage; they load no advertising or analytics tools. Fonts and images are served from osb.lol. Cloudflare, which protects the site, may set its own security cookie (such as __cf_bm) to tell people from bots. Cloudflare's cookie list says these cookies are strictly necessary for the service; __cf_bm expires after 30 minutes without activity.
Turnstile on the support pages
The form loads Cloudflare Turnstile from challenges.cloudflare.com in a frame, on the support pages only. According to Cloudflare's Turnstile privacy addendum, Turnstile reads signals such as the IP address, the TLS fingerprint, the browser details and the site key to tell people from bots, and uses them only for bot detection. Turnstile may also set one of Cloudflare's strictly necessary security cookies, such as cf_clearance. The form is switched off today, so Turnstile is not loaded at all at the moment.
OSB
OSB keeps its settings and session statistics in the game page's browser storage (the local storage of opensro.online). If you switch sharing on, the install ID, the install key, the consent state, the server's last settings and the time of the last send are stored there too. "Delete my data" in the Privacy section removes the ID and the key. To remove everything, uninstall OSB and clear the site data of opensro.online in your browser.
OSB Manager
On Windows in %LOCALAPPDATA%\OSB Manager, on macOS in ~/Library/Application Support/OSB Manager: your accounts, the settings, the privacy file (consent state and install ID), reports waiting to be sent, and the browser data of the game windows. Passwords and the install key are encrypted with DPAPI on Windows and kept in the Keychain on macOS. To remove everything, quit the app and delete that folder; on macOS also delete the OSB Manager items in the Keychain.
Changes
If this page changes, the date at the top changes. If what the apps send changes materially, the consent text gets a new version and the app asks for your consent again before it sends. The terms of use are on their own page. Something wrong? Write to us from the support page or at [email protected].