Last updated November 2026

Privacy Policy

Who we are

This site is run by Faheem Khaskheli, who is the controller of the data described here. For any data request (access, export, correction or deletion) or privacy question, email faheemkhaskheli9@gmail.com. Use of the site is also covered by the Terms of Service.

What this site collects

Item searches and the farming lists you plan are sent to our API only to calculate results. They are not linked to you and this site sets no cookies of its own. Without an account, your saved targets, inventory, mastery marks, logged progress and logged mission times stay in this browser's local storage and are never uploaded. A plan request carries only the median of your logged times per mission type, the same way it carries your targets.

Optional accounts

An account is optional and only syncs your data between browsers. It stores your email address, a scrypt hash of your password (never the password itself), a fingerprint of each unused recovery code (never the code itself), your sign-in sessions (a fingerprint of each session token, when it started, when it was last used and when it expires, and the browser and system it signed in from, such as “Firefox on Windows”, so you can tell your devices apart) and the data you sync: planner targets and settings, inventory, price watches, favorites, checklist ticks, mastery marks, progress log, mission times and alert settings (fissure filters, a Discord webhook URL, quiet hours and each device's push subscription). Theme and analytics choices are not synced. We never send email, so the address is used only to sign in.

On the account page you can download everything we hold for your account as JSON, and delete the account. Deleting removes the account, its sessions and its synced data from our database at once; the account's saved data in this browser is also removed. Copies in other browsers stay until you clear their site data. Each account's browser data is stored separately: signing out hides it until you sign in again. Anonymous browser data stays separate and is never imported automatically.

If you are signed in and turn on “Share the times I log”, each run time you log afterwards is stored with your account: the mission keys the planner uses, the duration and, for a relic run, the Void Traces you gained. Nothing else about the run is kept. A daily job turns runs from many players into anonymous medians, used only once 20 runs from 5 players agree. Shared runs are deleted after 90 days. Turning sharing off deletes them at once, and the medians drop them the next day. They are part of your export and are deleted with your account.

Our Google Cloud database setup configures daily backups and retains seven backups. A separate GitHub backup workflow, when enabled for a reachable database in a private repository, keeps daily dump artifacts for 14 days. Copies of deleted accounts can remain in those backups until they expire. Backups are used for recovery from failures. Before reopening a restored database, the operator must reapply account deletions made since that backup; this step is not automated.

Children

The site is not directed at children under 13, and you must be at least 13 to create an account. In the EEA and UK, if you are under 16, a parent must agree before you allow the optional analytics or personalised ads. If you think a child under 13 has created an account, email us and we will delete it.

Why we may use your data

For visitors in the UK and EU, we rely on:

You can see your data (export), correct it (edit it in the app) or delete it (delete the account) yourself on the account page. You also have the right to complain to your local data-protection authority.

Who handles data for us

Google AdSense, Discord and your browser's push service are not our processors. Each handles data under its own privacy policy, as described on this page. Some of these providers process data outside your country, including in the US.

Advertising

This site shows ads served by Google AdSense. Google and its partners use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies lets it and its partners serve ads based on your visits to sites on the Internet.

You can opt out of personalised advertising in Google Ads Settings. Learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. Ads on this site are currently non-personalised for every visitor: they are not based on your prior visits.

Optional analytics

Google Analytics is disabled until you choose “Allow analytics.” After opt-in, Google receives page views, browser and device information and connection metadata, and may store analytics cookies to recognise visits. Page addresses sent by our integration exclude query strings and fragments; referrers include only the origin. Google Signals and advertising personalisation are disabled. We do not send account identifiers, item searches or farming plans to Google. Use the Analytics control at the bottom of any page to withdraw consent and stop further collection. Existing cookies may remain until they expire or you clear them in your browser.

Anonymous page-use analytics are disabled by default. If you choose “Allow analytics,” Plausible receives page views so we can understand which pages are useful. A page view includes the page address (for example an item's page); Plausible discards query strings. With your consent it also receives these named events: plan_generated, multiple_targets_used, shared_route_used, session_plan_used, completion_plan_used, farm_vs_buy_used, useful_result, zero_result, planner_shared, saved_target_created, profit_scanner_used and return_visit. The planner section events mean a generated plan showed that section, not that you clicked it. Events carry only counts and the price mode, never item names, slugs, searches or plans. Item searches and farming plans are not sent to Plausible. To count return visits, the day of your last visit (a date, not an identifier) is kept in your browser local storage, only after you opt in. You can change your choice using the Analytics control at the bottom of the page. The setting is stored in your browser local storage.

Error reports

When something breaks, the error and the page address are sent to Sentry so it can be fixed. The address never includes the part after ? or #, which is where searches and shared plans live, and a report carries no visit count and no record of what you clicked, typed or searched for. The report itself includes no IP address; Sentry sees the connection's IP address when it receives one, and our Sentry project is set not to store it. Error reports are not analytics and do not depend on the analytics choice above.

Price watches

Price watches and their alert history stay in this browser's local storage; signed in, the watches also sync to your account, and we check them after each market price refresh. An alert that fires there (item, threshold, price and times) is kept with your account for 30 days so this site can show it on your next visit; it is part of the export and is deleted with the account. Live-event alerts work the same way: signed in, your synced planner targets are checked against Baro Ki'Teer's and Prime Resurgence stock and, if you opt in, the live Void Fissures, and each alert (item, event and times) is kept with your account for 30 days, exported and deleted with it. If you add a Discord webhook, our server also sends the text of new alerts (item, price or event; up to 10 per message) to Discord, which handles it under Discord's own privacy policy. If you turn on push notifications for a device, the same text is sent, encrypted so only that device can read it, through your browser maker's push service (Google, Mozilla, Apple or Microsoft), which learns which site sent a message to the device and when, but not what it says. Signing out turns push off on that device. Checking them requests those items' market prices from our API. Our API does not store your IP address with these requests: its access log records the requested path without an IP, and the IP is used only as a short-lived rate-limit counter key. Our hosting provider may keep its own request logs. Notifications are shown by your browser only if you allow them.

Third-party data

Drop data comes from WFCD and prices from warframe.market. Item icons load from the WFCD image CDN (cdn.warframestat.us), so that host receives your IP address when you search. The currently active Void Fissures come from our own API, which fetches them from api.warframestat.us on the server, so your browser no longer contacts that host and nothing from your plan is sent to it. This is a fan-made tool, not affiliated with or endorsed by Digital Extremes.