Privacy Policy · Rust On Top

In short

We collect as little as we can. You sign in with Steam, so we hold your Steam ID and your public Steam profile. To show your team, your deaths and your map we keep game data about the servers you play on. Stripe handles payments on the website, and Apple or Google handles payments in the phone app; your card never touches our servers. Everything we store lives on our own servers in the EU.

Two things leave your computer beyond that, each behind its own switch in the app's Settings, on for a new account until you turn it off: a small strip of your death screen, read by an AI service to name your killer on servers we do not run, and game map files from your Rust install when we cannot identify a server's map any other way. Neither is used for anything else and the strip is never stored.

Who we are

Rust On Top is built and operated by Dreamfire AB, a Swedish limited company (org.nr 559539-8297) with registered address Rådmansgatan 80A, 113 60 Stockholm, Sweden. Dreamfire AB is the data controller for the personal data described here, except where this policy says an operator is.

Questions about this policy or your data: richard@rustontop.com or anton@rustontop.com.

What this policy covers

One policy covers the whole product: the Rust On Top desktop app for Windows, the rustontop.com website and your account there, the console at console.rustontop.com that server operators use, the Rust On Top Discord bot, the ROT Raid Alarm phone app, and the RotLink plugin that runs on game servers. Where something applies to only one of them, we say so.

Visiting the website

The website and everything behind it run on servers we rent from Hetzner in Germany and Finland. Like nearly every website, the web server keeps short-lived technical logs of requests (IP address, browser type) to run the site, prevent abuse and diagnose problems.

We count visits to the website ourselves: which page was opened, which site sent you here, the campaign tags a link carried, and a press on Download. The count stores nothing in your browser and holds no identifier and no address, so it cannot be tied to you or followed from one page to the next, even when you are signed in. There is no advertising network and no third-party tracking pixel, and nobody else receives any of it. The Cookie Policy lists the two cookies the site does set.

Signing in with Steam

You sign in to the website, the console, the app and the phone app with your Steam account, on Steam's own pages, through Steam's OpenID service. We never see your Steam password.

The sign-in gives us your verified 64-bit Steam ID, which is what your Rust On Top account is. We then look up your public Steam profile through the Steam Web API and keep a copy: your display name, the address of your avatar picture, your profile address, whether the profile is public, the country and account creation date if the profile shows them, and your Rust playtime if it is public. We refresh that copy from time to time. The avatar itself is shown from Steam's own address and is never copied to our servers.

A sign-in on the website or the console sets one cookie, described in our Cookie Policy. The desktop app keeps its sign-in token in the Windows credential store on your own computer; the phone app keeps its own on the phone.

What we store on your device

The desktop app keeps your sign-in token in the Windows Credential Manager, as a credential named session.rustontop-companion. Sign out revokes it on our servers and removes it; uninstalling the app does not. Your Rust+ token is not kept on the computer; it goes to our servers, as described below.

In its own folders under your Windows profile the app keeps the window's size and position, a few preferences it remembers on that machine (the night and ground switches, which release notes you have seen, and the breeder's scan sound, auto-discard and the letter samples it learns from your own gene scans), 64-pixel copies of the item icons it has drawn, and a random install identifier that the app and the launcher use for staged updates. The launcher keeps the app's installed versions beside them. Uninstalling does not remove these folders.

To find the game it reads where Steam is installed, from the one entry Steam keeps for that in the Windows registry, and Steam's list of library folders. From your Rust install it reads the item icons under the game's Bundles folder and, with the map file switch on, the game's maps folder. It reads nothing else of the registry or the install, and the game's own log only when you press Send diagnostics.

To hear the panic key while you are in the game, the app listens for that one key through a Windows keyboard hook whenever a server's Tools are loaded. It compares each key press against the chosen key and ignores every other, stores nothing you type, and acts only when Rust is the program in front.

Scan genes, in the breeder, asks Windows for a screen capture each time you press it; the frames are read for gene letters on your computer and never leave it as pictures.

Everything else you set in the app, the two switches, the panic key, your card, your map layers, your server pick, your plans and pools, is stored on our servers, so it follows your account to another computer.

Servers we run, and servers that run RotLink

Some Rust servers are ours, and other operators can run our RotLink plugin on theirs. On such a server the plugin records what happens in the game for every player on it: connects and disconnects, deaths and damage, team changes, chat, building, looting, smart devices, vending, and player positions sampled every few seconds. This is the same class of record any server keeps to run itself and to moderate, and the operator of that server decides what it is used for. We process it on the operator's behalf.

A player's IP address is not stored as such: the plugin keeps it as a keyed hash that cannot be turned back into the address. The raw address is opened only for a moderation case, kept in a separate table for at most 30 days, and every such read is logged.

The companion app and the Discord bot show you a part of that record: your own team, your own deaths, the world events every player on the server can see. That is our use, and we are the controller for it. It is limited by one rule: the app shows you nothing about other players that you could not already see by playing on that server.

Servers we do not run: your Rust+ connection

For a community server that does not run RotLink, the app works the way the official Rust+ mobile app works. When you press Connect Rust+, the app opens Facepunch's own Rust+ login page in a window of its own. Facepunch's page hands the app a Rust+ token, which the app sends to our servers together with your Steam ID. We store that token encrypted, under a key our web servers cannot read.

With that token our servers register one companion device for your account with Facepunch's Rust+ service, through Google's push service, so that pairing notifications and your sleeper's death notifications reach us. When you pair a server in the game, its pairing token arrives that way and is stored encrypted as well.

Our servers then keep the Rust+ connection to each paired server open around the clock, so your team, your map, your alarms and the Discord feeds keep working while your computer is off. What they ask the server is what the Rust+ app itself asks: your team every two seconds, the server's time and info every minute, your paired smart devices, your team chat, and a map when the server has none we know. They cannot touch your Steam account, your items or your purchases.

Forgetting a server in the app's settings deletes its pairing. A pairing token the server no longer accepts is marked as refused and the app tells you. Pressing Re-register in the game's Rust+ menu invalidates every Rust+ token Facepunch has issued for you, including ours.

What we store on our servers

So that the features work across your devices and your team, our database holds:

Your Steam ID and the copy of your public Steam profile described above.
Your teams: who is in your team on each server this wipe, who your team's poster is, and which announcements your team has muted. On a server we do not run this comes from Rust+ and includes your teammates' names and last positions.
Your deaths: when and where you died and, when it is known, who or what killed you. On a server we do not run, the killer's name comes from Facepunch's own death notification when you were asleep in the game, or from your death screen when you were playing and have the switch on.
Players and groups your team tracks: the Steam ID and name of each tracked player and, for a public profile, Steam's word on whether they are online, in Rust, and on which server, refreshed every minute and replaced each time. A tracked player need not be a Rust On Top user.
Your own tools: decay timers and team timers, the key you use for the panic button, your breeder pools, the map overlays you switched on or off, the look you chose for your card, and the server you last picked.
Smart devices you paired in the game: the device's id, kind and name, and its state.
Your ROT Pro billing record: your Stripe customer and subscription identifiers, the subscription's status and plan, its period and trial dates, whether it is set to cancel, and the number of team seats. For a plan bought in the phone app it holds the store (App Store or Google Play) and the product instead of the Stripe identifiers, and we keep a random identifier for you that we give RevenueCat in place of your Steam ID. Never your card.
Team seats: which Steam account gave a seat and which holds it.
Your Discord link, if you connect one: your Discord user id, your Discord username, and whether the ROT Pro role and the Mobile Beta role have been granted.
Your mobile beta signup, if you join the waitlist: the phone you will test on (iPhone or Android), the email address the invite goes to, and when we sent the invite.
Your map votes, if you vote on the next map.
For the phone app: the push token that lets us ring your phone, and the alarms and notices we sent it.
On a server we do not run: the encrypted Rust+ credentials described above.
Your two switches: the death screen read and map file sharing.
A random identifier for each install of the desktop app, used only to decide which installs get a staged update first.

Death screen reading (Google Gemini)

On a server we do not run, Rust+ never says who killed you while you were playing. When you die there and the switch "Read my death screen for the killer" is on, the app captures the top band of the death screen on your own display (the strip showing KILLED BY): seven frames over four seconds, cut to the top seven percent of the screen's height, of which only the one that shows the banner is kept, as one JPEG under 512 KB, sent to our server. Our server sends it to Google's Gemini service, which reads the text and returns the name. The band is cut from the monitor Rust is on, and a frame is taken only while the game itself shows where the banner is: when another window covers that band, nothing is captured.

The strip is used once, for that, and discarded: it is not saved on your computer, not saved on our servers, and not used to train any model. Only the name is written next to your death. The process is automated end to end; nobody at Rust On Top or Google looks at your screen.

The switch is on for a new account. It is enforced where the picture is taken: with it off the app captures nothing, and our server refuses a strip from an account whose switch is off. On a server that runs RotLink the plugin knows the killer and no capture is made.

Map files from your Rust install

A server's map can usually be identified from the server's public information. When it cannot, the map files your own game downloaded to join servers are the one way left. With the switch "Share map files from my Rust install" on, the app reads the maps folder of your Rust install when our server asks for a map: it takes a fingerprint of the newest map files there, up to sixteen, sends the fingerprints so our server can tell which it already holds, and uploads the ones it lacks, up to four, never a file over 250 MB. Our servers render an uploaded file into the map the app shows and count its resource spawns.

A map file is the game's own description of a world's terrain and monuments. It holds nothing about you. It is kept as a rendered map for as long as that map is in use on any server.

Other services we contact on your behalf

Steam (Valve): sign-in, your public profile, the public presence of players your team tracks, and, in the console, the public VAC and game ban counts of players on a server.
The server you play on: its public query port, which any Steam client can ask, for the map's name and the public list of players online. That list is names only and is replaced every minute.
Facepunch's Rust+ service, as described above, for servers we do not run.
Discord, if you connect it or use the bot.
The Steam item store's public price feed, for the app's Item Store screen. Nothing of yours is sent for it.

Connecting Discord, and the Discord bot

On your account page you can connect a Discord account to receive the ROT Pro role on the Rust On Top Discord server. The authorisation happens on Discord's own pages; we never see your Discord password. If you connect, we store your Discord user id and username with your Steam ID and whether the role is granted, and our bot adds or removes the role as your subscription starts and ends. Disconnecting on your account page deletes the link and removes the role. If you are on the mobile beta waitlist, the bot also gives you the Mobile Beta role, and disconnecting removes that too.

If you add the Rust On Top bot to a Discord server of your own, the bot stores that server's id, the Discord id and Steam account of whoever installed it, the Rust server it is bound to, the channel it posts in and the feeds you switched on. The commands you run through the bot are kept as rows, the command and its answer, so that what was asked and answered is on record. A player runs /connect in Discord to tie a Discord account to a Steam account; the link is made only after a Steam sign-in.

The console, for server operators

Server operators manage their servers in the console at console.rustontop.com. For an operator's organisation we store the operators' Steam IDs and roles, each server's address and its RCON password, and the organisation's RustMaps API key if one is entered. Passwords and keys are stored encrypted; the web servers can write them and cannot read them back. Every command an operator sends to a server through the console is logged with who sent it and when, as is every read of a player's raw address. Notes and flags operators write about players, and bans, belong to the operator's own moderation record.

An owner or admin of an organisation can also make API keys for the organisation's own website. With a key, that website can read its own servers' map vote and leaderboards, which carry the names, Steam IDs and game stats of the players on those servers, and record a vote for a player it has signed in with Steam. Only a fingerprint of each key is stored, and a key reaches no other organisation's servers. A player erased from Rust On Top no longer appears in those answers. Copies a website already made are the operator's.

The mobile beta waitlist

ROT Pro members can join the waitlist for the phone app's beta at rustontop.com/testflight. We store the phone you will test on and the email address the invite goes to, with your Steam account, and we use that address only to invite you. We invite testers by hand: we enter the address in Apple's App Store Connect for TestFlight (iPhone) or in Google Play Console for closed testing (Android, which needs a Gmail address), and Apple or Google then sends the invite under its own privacy policy.

If your Discord account is connected, our bot gives you the Mobile Beta role on the Rust On Top Discord server while you are on the waitlist, and removes it when you disconnect Discord. To leave the waitlist, email us; deleting your account removes your signup too.

The phone app

The ROT Raid Alarm phone app rings your phone when a paired smart alarm fires. To do that we store a push token for your phone (Apple or Google), and a record of each alarm and notice we sent. The push carries the alarm's name and the server's, and nothing else about you. The app keeps your sign-in token in the phone's own secure store. Unless you switch it off in Settings (Share usage and fault reports, on from the start), it sends us which screens you open and for how long, which server you pick, when you test a ring, a heartbeat every five minutes while it is open, and the errors it runs into, with a random per-install identifier, the app's version, the phone's operating system and, when you are signed in, your account; usage is kept for 13 months and errors for 90 days. It keeps a log of what it does, about 512 kB on the phone, and never writes your sign-in token or your Rust+ token into it. When you press Send diagnostics, and only then, it sends what it is showing (the screen, the server, whether notifications are allowed and how many alarms are paired) and the last part of that log, and gives you a code for support. On each launch it asks Expo's update service for a newer app bundle, sending a random per-install identifier, the platform and the app version. When you open ROT Pro's plans, or buy or restore a subscription, it talks to RevenueCat, which handles the purchase with Apple or Google under a random identifier we give it, never your Steam ID or name. Expo and RevenueCat are the only third parties the phone app itself talks to.

Delete account and data, in the app's Settings, removes the phone from our servers at once and, if the phone is the only place you ever signed in, the whole account within a minute. The account deletion page says exactly what goes.

Diagnostics

The desktop app keeps a log of what it does on your computer, two files of at most 1 MB each in the RustOnTop folder of your local app data, and never writes your Rust+ token, your sign-in token or a password into it. Unless you switch it off in Settings (Share usage and fault reports, on from the start), it sends us which screens you open and for how long, which tools you use, which map layers you turn on or off, a heartbeat every five minutes while it is open, and the errors and warnings it runs into, with the random install identifier, the app's version and release channel, the operating system and, when you are signed in, your account. We use this to fix the app and to see what people use; usage is kept for 13 months and errors for 90 days. Under the same switch, the Dreamfire Launcher, which installs and updates the app, tells us when it installed a new version of the app and how that version's first start went, with the same install identifier and the launcher's own version; it asks our server for the switch first and sends nothing when it is off. When you press Send diagnostics, and only then, it sends what it is showing, the last part of its log and the last part of the game's own log, which can name the servers you joined, and gives you a code for support; that report is kept for 90 days. Every five minutes it also asks for updates, sending the app's name, its release channel, the operating system and the random install identifier, so that a new version can be rolled out to a share of installs first.

What we don't store

We do not store your real name, postal address, phone number, or any sensitive information such as health, religion, biometrics or precise real-world location. We do not store your payment card; that goes to Stripe, Apple or Google. We do not store death screen strips. We do not sell your data, show you ads, or use your data to train AI models.

Who processes data for us

We use a small number of service providers: Hetzner Online (our servers in Germany and Finland, and the object storage that holds rendered map tiles); Stripe (payments and billing on the website); RevenueCat (subscriptions bought in the phone app: it gets the random identifier we give it, the store's record of the purchase, and your country and currency); Google (Gemini, to read the death screen strip; Firebase Cloud Messaging, to ring Android phones and to receive Rust+ notifications on your behalf); and Apple (to ring iPhones). Apple and Google also take the payment for a subscription bought in the phone app, under their own privacy policies. When we invite you to the phone app's beta, Apple (TestFlight) or Google (Google Play's testing program) receives the email address we enter.

We also interact, on your behalf, with Facepunch's Rust+ service, Steam (Valve) and Discord. Each has its own privacy policy.

Why we are allowed to process your data

Under the GDPR we rely on: performance of our agreement with you, to provide the features you ask for (sign-in, your team and your map, the Rust+ connection, ROT Pro and team seats, the Discord roles, the phone alarm, the mobile beta waitlist, the death screen read and map file sharing); our legal obligations, such as keeping billing records for bookkeeping and tax law; our legitimate interests, to keep the product secure, working and free of abuse, and to count visits to the website without identifying anyone; and your consent where a feature is optional and you switch it on, such as the Discord connection.

The death screen read and map file sharing are on for a new account, under the terms you accept when you sign in to the app ("By continuing, you agree to our Terms of Service and Privacy Policy"). Each has a switch in the app's Settings, and a switch you turn off stops the feature that moment. For anything else, contact us.

For a server's own game record the operator of that server is the controller and we process it for them. Our companion use of that record rests on our agreement with the operator and on the rule that you are shown only what you could already see in the game.

International transfers

Our servers are in the EU. Some of the providers above (Google, Apple, Stripe, RevenueCat, Discord, Valve, Facepunch) may process data outside the European Economic Area, including in the United States. Where that happens the transfer is protected by an appropriate safeguard, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep your data

The game record of a server (deaths, damage, connects, chat, team changes and the rest): 180 days, then dropped. Player positions: 30 days. A raw IP address opened for a moderation case: 30 days.
Rows that belong to one wipe of a server (your team, your team's poster and mutes, tracked players, timers): they end with the wipe and are dropped 30 days after it.
The copy of your Steam profile and the presence of tracked players: refreshed while in use, deleted when the account is erased.
Death screen strips: not kept at all. Rendered maps: kept as long as the map is in use.
A website or console sign-in: seven days, or until you sign out.
The count of website visits: 13 months.
Billing records: bookkeeping and tax law requires us to keep invoicing and transaction data, in Sweden generally for seven years. Stripe keeps the payment records it must hold under its own obligations.
Your Discord link: until you disconnect it or ask us to delete your account.
Your mobile beta signup: until you ask us to remove it or delete your account.
Support emails: around 12 months. Server logs: up to 90 days.

Your rights

You have the right to access the data we hold about you, to correct it, to delete it, to restrict or object to our use of it, to data portability, and to withdraw any consent you have given.

To use any of these rights, email richard@rustontop.com or anton@rustontop.com. We respond within one month.

How to delete your data

Email richard@rustontop.com or anton@rustontop.com with your Steam ID and we erase the account within 30 days. If the ROT Raid Alarm phone app is the only place you ever signed in, deletion is built in: Settings, then Delete account and data, and it runs within a minute. The account deletion page says exactly what goes.

If you have a running subscription, set it to end first from your account page (Manage billing opens Stripe's portal), or, for a plan bought in the phone app, in your Apple ID settings or Google Play's subscriptions; an account whose subscription is not set to end cannot be erased, so that nobody goes on charging an account we have forgotten.

Erasure makes your account unattributable: your Steam ID and name are removed, your sessions, credentials, pairings, tracked rows, tools, plans, votes, Discord link, phone tokens and seats are deleted, and the game record keeps its shape but no longer points at you. Bans on servers we run stay against the anonymous row, because a ban that a deletion request undid would be no ban. Bookkeeping records are kept for their legal period, pointed at the anonymous row, and Stripe keeps its own records of your payments, including the Steam ID given at checkout. Backups hold erased data for up to 30 days more.

You can also cut the app's access at any time by signing out and uninstalling it, and cut our Rust+ access by pressing Re-register in the game's Rust+ menu.

Someone who has never used Rust On Top but has played on a server that runs RotLink can ask for the same erasure at the same address; no account is needed.

Children

Rust On Top is not intended for children. Rust is rated PEGI 16 / ESRB Mature, and you should be old enough to use Rust and its companion tools in your country. We do not knowingly collect data from children.

To subscribe to ROT Pro you must be old enough to enter into a paid agreement in your country, or have a parent's or guardian's permission.

Complaints

If you are unhappy with how we handle your data, you can complain to your local data protection authority. In Sweden that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Changes to this policy

We may update this policy from time to time. We change the date above and, for important changes, tell you in the app or on the website.

Questions: richard@rustontop.com or anton@rustontop.com.