1. WHO WE ARE

Last Stand Rust ("we", "us", "our") operates community-run Rust game servers and an associated digital store for purchasing in-game Virtual Goods.

We are committed to protecting your privacy and being transparent about how we collect, use, and store your information. This Privacy Policy explains our practices when you access our website, link your Steam account, make purchases, or interact with our Discord community.

For questions regarding this policy, please contact us through our Discord support system.

2. WHAT LAST STAND RUST DOES

Last Stand Rust provides a community gaming experience anchored by Rust game servers. Our website offers: (a) server status information and community content; (b) a digital store for purchasing in-game Virtual Goods; (c) cheater reporting and ban appeal systems; (d) Steam-linked user accounts for tracking purchases and roles; and (e) integration with our Discord community for support and communication.

Use of our basic website features does not require an account. Making purchases or submitting reports and appeals requires linking your Steam account for identity purposes.

3. INFORMATION WE COLLECT

We collect only the information necessary to provide and improve our Service.

WHAT WE DO NOT COLLECT: - We do not collect your real name, home address, or phone number - We do not collect precise location data beyond country-level geolocation - We do not collect or store full payment card numbers or bank account details - We do not collect biometric data or sensitive personal data - We do not sell your personal information to third parties

DATA YOU PROVIDE TO US: - Steam Profile Information: When you authenticate via Steam OpenID, we receive your Steam ID (64-bit), display name, and avatar URL. This is the minimum required to link your purchases and in-game roles to your identity. - Discord Identity: If you interact with our support team or community, you may choose to provide your Discord username for communication purposes. - Payment Information: When you make a purchase, payment is processed by PayMob or NOWPayments. We receive a payment confirmation with a transaction ID and the items purchased but do not see or store your full card number or crypto wallet credentials. - Submitted Content: When you submit a cheater report or ban appeal, we collect the information you voluntarily provide, including player names, Steam IDs, evidence URLs, and descriptions. - Communications: If you contact us through Discord or any other channel, we retain the content of your communications for support and record-keeping purposes.

AUTOMATICALLY COLLECTED DATA: - Server Logs: Our web server automatically logs IP addresses, browser user agent strings, referring URLs, and page access timestamps. These logs are retained for security analysis and debugging. - Analytics: We use Google Analytics to collect aggregate data about page views, session duration, device type, browser, and country-level location. This data does not identify individual users. - Cookies: We use essential session cookies and analytics cookies. See our Cookie section below for details. - Game Server Data: When you connect to our Rust servers, your Steam ID and in-game activity are recorded for anti-cheat, moderation, and operational purposes.

4. HOW WE USE INFORMATION

We use the information we collect for the following purposes:

Service Provision: To authenticate your identity via Steam, process purchases, grant in-game roles, maintain server operations, and provide customer support.

Service Improvement: To analyze usage patterns, diagnose technical issues, optimize server performance, and improve the user experience.

Security and Moderation: To detect and prevent cheating, ban evasion, fraud, abuse, and violations of our Terms of Service. This includes monitoring in-game behavior and investigating reports.

Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from authorities, and enforce our Terms of Service.

Communications: To respond to your inquiries, support tickets, and ban appeals.

We do not use your personal information for automated decision-making that produces legal effects concerning you. We do not use your data to train AI models.

5. COOKIES

Our website uses cookies and similar technologies to function properly and to understand how our service is used.

ESSENTIAL COOKIES: | Cookie | Purpose | Duration | |--------|---------|----------| | has_session | Indicates whether you have an active session (after Steam login) | Session | | admin_token / auth_token | Stores authentication tokens for API requests | Session |

ANALYTICS COOKIES: | Cookie | Purpose | Duration | How to Opt Out | |--------|---------|----------|----------------| | _ga, _ga_* | Google Analytics — aggregate usage measurement | Up to 2 years | Install the Google Analytics Opt-Out Browser Add-On or block third-party cookies in your browser settings |

We do not use advertising cookies, cross-site tracking cookies, or any cookies for marketing purposes. We do not respond to Do Not Track (DNT) signals as there is no consistent industry standard for interpreting them.

You may control cookie settings through your browser preferences. Disabling essential cookies may prevent certain features of the Service from functioning properly.

6. THIRD-PARTY PROCESSORS

We use the following third-party service providers to operate and improve our Service:

| Provider | Purpose | Privacy Policy | |----------|---------|----------------| | Valve Corporation (Steam) | User authentication via Steam OpenID | https://store.steampowered.com/privacy_agreement/ | | Discord Inc. | Community platform and support communications | https://discord.com/privacy | | PayMob | Payment processing (card, wallet) | https://paymob.com/privacy-policy | | NOWPayments | Cryptocurrency payment processing | https://nowpayments.io/privacy-policy | | Google Analytics | Website usage analytics | https://policies.google.com/privacy | | GitHub, Inc. | Source code hosting and CI/CD | https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement | | Cloudflare or similar CDN | Content delivery and DDoS protection | https://www.cloudflare.com/privacypolicy/ |

Each provider processes your data in accordance with its own privacy policy and applicable data protection agreements. We have data processing agreements in place where required by applicable law.

7. DATA RETENTION

We retain your personal information only as long as necessary to fulfill the purposes described in this policy, or as required by law.

Account Data (Steam ID, display name, purchase history): Retained for as long as your account is active and for a reasonable period thereafter to enforce our Terms of Service, prevent ban evasion, and comply with legal obligations. If you request deletion, we will remove or anonymize your identifiable data within 30 days, subject to legal retention requirements.

Payment Records: Transaction records are retained for financial record-keeping, tax compliance, and fraud prevention purposes. Retention period is governed by applicable financial regulations, typically 5-7 years.

Server Access Logs (IP addresses, user agents): Retained for 30 days for security monitoring, debugging, and abuse investigation, after which they are automatically deleted or anonymized.

Analytics Data: Google Analytics data is retained for 14 months before automatic deletion.

Submitted Reports and Appeals: Retained for the duration necessary to investigate and process the submission, plus a reasonable period for record-keeping and pattern analysis.

Communications (Discord, support tickets): Retained for the duration of the support interaction and up to 90 days thereafter, unless relevant to an ongoing investigation.

8. YOUR RIGHTS

Depending on your jurisdiction, you may have the following rights regarding your personal information:

GDPR (European Economic Area and United Kingdom): - Right to Access: You may request a copy of the personal data we hold about you. - Right to Rectification: You may request correction of inaccurate or incomplete data. - Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. - Right to Restrict Processing: You may request restriction of processing in certain circumstances. - Right to Data Portability: You may request a copy of your data in a structured, machine-readable format. - Right to Object: You may object to processing based on legitimate interests, including analytics. - Legal Basis: Our legal bases for processing are: (a) performance of a contract (providing the Service you access); (b) our legitimate interests (security, fraud prevention, Service improvement); and (c) your consent (cookies). - Right to Complain: You have the right to lodge a complaint with your local data protection supervisory authority.

CCPA (California Residents): - Right to Know: You may request details about the personal information we have collected about you in the preceding 12 months. - Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions. - Right to Correct: You may request correction of inaccurate personal information. - Right to Opt-Out: We do not sell personal information. We do not share personal information for cross-context behavioral advertising. - Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights, please contact us through our Discord support system with the subject line "Privacy Request". We will respond within 30 days. We may need to verify your identity before processing your request. Because we use Steam authentication, we may require you to verify ownership of the Steam ID associated with your account.

9. INTERNATIONAL TRANSFERS

Our Service is operated from servers located in [Hosting Region]. Your personal data may be transferred to, stored, and processed in countries other than your country of residence.

When we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not received an adequacy decision from the relevant authority, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

Your data may transit through other countries as part of standard internet routing. Steam, Discord, Google Analytics, and our payment processors may process data in jurisdictions including but not limited to the United States, Canada, Ireland, and Singapore. We encourage you to review their respective privacy policies for details on their data transfer practices.

10. CHILDREN

Our Service is not directed to children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us through our Discord support system. We will take steps to delete such information promptly.

Rust is rated PEGI 16 and ESRB M (Mature 17+). The Service is intended for users who meet the age requirements established by these ratings and applicable law.

11. SECURITY

We take the security of your information seriously and implement appropriate technical and organizational measures to protect it.

Measures include: - All communications with our website and API are encrypted using TLS/HTTPS in transit. - Authentication tokens are stored as HttpOnly cookies with SameSite restrictions. - Payment processing is handled entirely by PCI-compliant third-party processors (PayMob, NOWPayments). We do not store full payment card numbers or crypto wallet private keys. - Password hashing uses bcrypt for administrative accounts. - Rate limiting and IP banning mechanisms protect against abuse and brute-force attacks. - Server access logs are retained for a limited period and access is restricted to authorized personnel. - Database servers are isolated from public internet access.

No Security Guarantee: Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

Breach Notification: If we become aware of a data breach that affects your personal information, we will notify you as required by applicable law through our website, Discord, or other appropriate channels.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs.

When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that affect your rights, we may provide additional notice through our website banner, Discord announcements, or other communication channels.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

13. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through the following channels:

Discord: Join our official Discord server and open a support ticket with the subject "Privacy Inquiry".

We will acknowledge your request within 5 business days and respond substantively within 30 days. If we need additional information to verify your identity or process your request, we will inform you promptly.