Privacy policy

Data we process

For your account, we store an identifier, email address for email registration, protected password hash, role, account status, and creation and last-activity dates. When you sign in through Steam, we store your Steam ID.

Your profile contains information you choose to provide: nickname, avatar, region, languages, Rust hours, roles, playstyle, description, visibility settings, age, and contact details.

We also store clan and wipe listings, participation and applications, contact requests, messages, notifications, reviews, feedback, and reports. Warnings, restrictions, internal notes, and an action log are used for moderation.

Why we use data

Data is needed for sign-in, matching players and teams, displaying listings, communication, processing applications, notifications, moderation, abuse prevention, and wallet operation. Connected integrations use the information required for their functions.

Public and restricted data

An active published profile is available in the catalog and on its public page. It may show your nickname, avatar, gaming preferences, description, Steam link, reputation, and activity information. Age is shown when its visibility setting is enabled.

A profile's Discord contact is available to its owner and users with an approved mutual contact. Clan contacts have separate access rules. A hidden, expired, or moderation-restricted profile is not shown as a normal active listing.

Your account email, password and password hash, session tokens, and internal moderator notes are not public fields. Access to messages and applications is limited to their participants and applicable system permissions. Moderators receive data according to their permissions.

Steam and Discord

Steam sign-in uses Steam OpenID: you enter your Steam password on Steam. RUST TEAM validates the response and links the Steam ID to your account.

Discord connection uses OAuth with the identify scope. We store the Discord ID, name, avatar, connection status, and connection time. The OAuth exchange uses a temporary access token; it is not stored as a permanent token in the connection table.

The bot syncs supported listings and processes related applications and notifications. Discord message identifiers and technical sync records are stored for this purpose. Disconnecting changes the connection status and does not guarantee deletion of all historical records.

Images and user content

An uploaded avatar is stored with profile data. Uploaded clan logos and banners are stored in the database. Public images are available with the corresponding listing.

If you provide an external image URL, your browser may contact its host. That service receives technical request data under its own rules. Do not upload images or text containing another person's private data.

Technical data and logs

The system stores activity times, moderation events, technical integration events, and request-limit counters. Depending on proxy configuration, an IP address may be used to form a hashed request-limiting key.

Application errors are written to server logs. The hosting provider may process network and technical request data. The application code does not define one retention period for all such logs.

Internal analytics is built from platform records. Assistant events contain a signed-in user identifier, conversation identifier, search type, result count, match score, provider, processing time, and token usage. Query text is not written to this event table.

MVK and purchases

The wallet stores purchased and bonus MVK balances, transactions, purchases, granted features, and their expiry dates. Financial history uses an immutable transaction ledger.

The current implementation includes a disabled payment mode and a test provider that does not create real production payments. RUST TEAM code does not contain a form that stores payment card details. This page does not claim that real payments are enabled.

Cookies and browser storage

The rust_session cookie is used for sign-in and lasts up to 30 days. It is HttpOnly and SameSite=Lax; Secure is used in production. A hash of the session token is stored on the server. Signing out ends the current session.

Steam sign-in uses a short-lived state cookie. The selected theme is stored in localStorage under rtf-theme. The sidebar component supports the sidebar_state cookie for its position.

The current assistant conversation and its criteria stay in interface state rather than a permanent application chat history. No separate external advertising or tracking SDK was found in the reviewed implementation.

First-party traffic analytics

RUST TEAM provides first-party traffic analytics without Google Analytics, advertising pixels, or third-party tracking SDKs. For each view, the system stores the path without an arbitrary query string, time, source category, and only permitted campaign parameters: utm_source, utm_medium, and utm_campaign. The full referrer URL is not stored; only a sanitized hostname is used.

Without analytics permission, the application does not create a persistent guest identifier and may only increment anonymous aggregate page-view totals. In this mode, no persistent visitor-ID cookie is created or read, no user account is loaded, and IP is not used as a visitor identifier. A protective rate limit uses only a one-way key that changes hourly. With explicit permission, the server issues a random first-party visitor ID. It contains no user ID, email, Steam ID, or Discord ID, is not derived from IP or User-Agent, and is stored in an HttpOnly, SameSite=Lax cookie with Secure in production. For a signed-in user who allows analytics, multiple consented devices are deduplicated by account identity. Different signed-out devices remain separate identifiers; this is not a count of physical people.

Analytics tables do not contain raw IP addresses or the full User-Agent. Raw page views have a configurable retention period of 90 days by default; event receipts used for duplicate-delivery protection are retained for up to 72 hours, while daily aggregates are retained longer. Declining or withdrawing permission deletes the visitor cookie, active analytics sessions, and account link without changing already produced anonymous totals. Granting permission again creates a new visitor ID.

You can change your choice without signing out: Analytics preferences. The final wording of this section requires separate legal review and is not a statement of compliance with any particular legal regime.

External services and the assistant

The project configuration uses Render to host the application and PostgreSQL to store data. Steam and Discord process data when you use their integrations. When email delivery is configured, the SMTP service receives the recipient address and email content.

If the assistant uses OpenAI, your message text and previous structured search criteria are sent to OpenAI to parse the request. The request includes store: false; this does not mean that no data is sent to the external service or that the service has no retention periods of its own.

Do not enter passwords, tokens, or sensitive information into the assistant. No OpenAI request is made in local deterministic parsing mode. External services also process data under their own terms.

Retention periods

Sessions, sign-in confirmations, publications, and digital features have expiry periods. Expiry does not necessarily delete a database record.

The application does not define one automatic deletion period for all account data, moderation history, MVK operations, integrations, and backups. Data may remain after a listing is hidden or an account is deleted. Questions about a specific record and its retention can be sent to the project team.

Security

The application uses password and session-token hashing, server-side permission checks, request limits, and input validation. These measures reduce the risk of unauthorized access but are not a promise of absolute security.

Managing your data

You can edit your profile and its visibility and manage contacts and blocks in your account. Settings include Discord connection management and the notification preferences supported by the system.

For questions about access, correction, or deletion of specific data, use feedback. Do not include secrets in your message. This text describes available tools and does not replace applicable user rights.

Account deletion

Deletion is available in settings with confirmation. It disables the account, clears email, password, and Steam ID, replaces the profile with anonymized data, and ends sessions.

Related notifications, authenticated feedback, and email records are deleted; memberships and participation are removed, and some messages, reviews, and applications are cleared or anonymized. Not all related history is deleted: moderation, wallet, Discord, and created-content records may remain. Anonymous feedback is not linked to an account and is not automatically deleted with it.

Hiding a listing and deleting an account are different actions. Copies of public content saved by other people or external services are not automatically removed by this action.

Changes to this policy

This description of data processing is updated when the implementation and integrations change. The current version is published on this page.

Contact RUST TEAM

Use the feedback form. It is also available to guests. For a request about your account, sending it after signing in makes it easier for the team to associate it with the account.