Privacy Policy

Controller within the meaning of the GDPR for this website and the Rust server “Tortuga”:

Volodymyr Solontsov
Pressather Str. 152A
92637 Weiden i.d.OPf.
Deutschland
Email: rust.tortuga@gmail.com

• No ads, no analytics or tracking services, no cookie banner needed: we only set strictly necessary cookies.
• Fonts are hosted on our own server; your browser does not contact Google services when you open the site.
• We never receive payment data (card, PayPal etc.) — payment happens entirely at PayNow.

The website is delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. On every request Cloudflare processes technically necessary data, in particular your IP address, date and time, the requested address, browser identifier and — derived from the IP address — your country. The purpose is delivering the pages and defending against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and fast operation). Technical logs of our server functions are kept for at most 7 days.

Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA rely on the European Commission’s adequacy decision. A data processing agreement is in place with Cloudflare.

We only set cookies that are strictly necessary for the service you request (§ 25(2) no. 2 TDDDG):

• __Host-tortuga — sign-in: your SteamID64, Steam name and Steam avatar address, cryptographically signed. Set only after sign-in, valid for 7 days, removed by “Sign out”.
• steam_state — one-time code protecting sign-in against misuse, 10 minutes.
• lang — the language you chose in the language menu, 1 year. Set only when you pick a language.

Legal basis for the related processing: Art. 6(1)(b) GDPR (sign-in and purchase at your request) and (f) (security).

When you choose “Sign in with Steam”, you are redirected to Steam (Valve Corporation, 10400 NE 4th St., Bellevue, WA 98004, USA) and sign in there. Steam confirms your SteamID64 to us; we never learn your password. We then fetch your public Steam name and avatar to show them in the header. Your browser loads the avatar directly from Valve servers (steamstatic.com), which gives Valve your IP address. Legal basis: Art. 6(1)(b) GDPR. The transfer to the USA takes place at your request for sign-in (Art. 49(1)(b) GDPR).

When you click “Buy”, we send PayNow Services, Inc. (Pennsylvania, USA) your SteamID64, the selected product, your IP address and your country. PayNow needs the IP address and country for VAT and fraud prevention. The payment itself happens on PayNow’s page; PayNow is an independent controller for it. From PayNow we only receive the order (product, SteamID64, status) to deliver it in game. Legal basis: Art. 6(1)(b) GDPR. PayNow privacy policy: https://paynow.gg/legal/privacy-policy.

The game server is operated by GTXGaming in a data centre in Frankfurt am Main. When you play on the server, we process:

• SteamID64 and player names,
• IP address on connection (connection log),
• the country derived from the IP address — using a local database on our server, without passing it to third parties — and your game language,
• playtime and session times,
• chat messages (all channels including team chat) and commands you enter,
• reports via /report, moderation decisions and bans,
• the contents of your in-game cart and the durations of purchased or earned perks,
• your Discord ID if you link your account to Discord.

Purposes: running the game, delivering purchases, protection against cheaters, moderation and security. Legal bases: Art. 6(1)(b) GDPR (providing the game) and (f) (security, enforcing the rules).

Storage location and retention: this data is stored on the game server at our hosting provider GTXGaming in Frankfurt am Main. It is deleted as soon as it is no longer needed for running, moderating and securing the server, or at your request, unless there are reasons to keep it longer. Ban records are kept for as long as the ban applies.

Easy Anti-Cheat and sign-in to the game are the responsibility of Facepunch Studios Ltd. and Valve; we have no influence on them.

Links to our Discord server only open Discord (Discord Inc., 444 De Haro St., Suite 200, San Francisco, CA 94107, USA) when you click them. Our game server sends to internal channels on our Discord server that only the administration can see: connection notices (player name, SteamID64, status, session length), chat messages and commands. The purpose is moderation (Art. 6(1)(f) GDPR). Discord is certified under the EU-US Data Privacy Framework.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to rust.tortuga@gmail.com and include your SteamID64. You may also lodge a complaint with a data protection supervisory authority, in particular in your country of residence.

You do not have to provide any data to visit the website. Without Steam sign-in you cannot buy anything, because we would not know whom to credit the purchase to in game.