In short
The website and the console set two cookies, both strictly necessary. The website also counts visits, without a cookie and without any identifier, so there is no cookie banner to answer. Every cookie is our own. None is used for advertising, nothing is shared with anyone else, and no other company's script runs on the site.
The cookies we set
- __Host-rot_session keeps you signed in after you sign in with Steam, on the site you signed in on (rustontop.com or console.rustontop.com). It holds a random token that our server matches to your session; your Steam ID is not in it. It is set only when you sign in, it lasts seven days, and signing out deletes it. It is marked Secure, HttpOnly and SameSite=Strict, so no script and no other site can read it.
- __Host-rot_discord_state protects the optional Connect Discord flow against cross-site request forgery. It holds a random one-time value, is set only when you press Connect Discord, and expires after ten minutes.
Counting visits
Every page you open on the website is counted: which page, which site sent you here, and the campaign tags in the address if the link carried any. Pressing Download is counted the same way, with the same three things. The count stores nothing in your browser and holds no identifier and no address, so it cannot be tied to you or followed from one page to the next, even when you are signed in. We use it to see where visitors come from and which pages lead to a download, and for nothing else.
The counting is our own, on our own servers. There is no advertising network and no third-party tracking pixel, and nobody else receives any of it. We keep these records for 13 months. Our web server also keeps short-lived request logs to run the site; those are not cookies and cannot follow you.
The apps
The desktop app and the phone app do not use cookies. The desktop app keeps its sign-in token in the Windows credential store on your computer; the phone app keeps its own on the phone. Both are described in the Privacy Policy.
Other companies' pages you may visit from here
Some steps happen on other companies' sites, which set their own cookies under their own policies: Steam when you sign in, Stripe when you pay or manage billing, and Discord when you authorise the Discord connection. We do not control those cookies.
Managing cookies
You can delete or block cookies in your browser settings. Deleting __Host-rot_session signs you out. The site reads fine without cookies; you only need them to sign in, to manage a subscription and to use the console.
Changes and contact
If we ever add a cookie, we list it here first and, where the law requires it, ask for your consent before setting it.
Questions: richard@rustontop.com or anton@rustontop.com.