Privacy Policy

The data controller for Rust-a-Man is ITWILLROCK Sp. z o.o., a company registered in Poland, represented by Artem Panfilov.

Privacy contact: privacy@rust-a-man.com (or legal@rust-a-man.com). Full company details are on our Imprint.

Rust-a-Man is currently an informational tool. We deliberately keep data collection minimal:

• Local browser storage — your acknowledgement of our terms, your saved watchlist, and your Plant Genetics Planner seeds are stored in your own browser (localStorage) and are not transmitted to us.
• Cookieless, anonymous analytics — Vercel Web Analytics records aggregated, non-identifying traffic (visit counts, approximate country, which pages and tools are used). It sets no cookies, stores nothing on your device, and does not identify you or track you across sites, so it runs without a consent prompt. See our Cookie Policy.
• Server logs — our hosting provider (Vercel) processes standard request metadata (IP address, user-agent, timestamp) transiently to deliver the site and protect against abuse.

Some features described in the product are not yet active. When account sign-in and Rust+ server pairing are enabled, we will additionally process:

• Steam identifier (SteamID64) obtained via Steam OpenID. We never see or store your Steam password.
• Rust+ pairing token returned by Facepunch when you pair a server, stored encrypted and revocable by you at any time.
• Your preferences and saved data — paired servers, display settings, and saved routes.

This section is published in advance for transparency; it applies only once the corresponding features go live.

• Contract (Art. 6(1)(b)) — providing account and server-pairing features you request.
• Legitimate interests (Art. 6(1)(f)) — running cookieless, anonymous analytics to understand aggregate usage, and securing the service and preventing abuse, balanced against your rights.

We do not sell personal data. We share data only with processors that help us run the service under data-processing agreements:

• Vercel Inc. — hosting and Web Analytics.
• Facepunch Studios — only the Rust+ Companion API you explicitly pair with, using the token you authorise.
• Planned infrastructure (database and cache) will be added to this list before any personal data is stored server-side.

Some processors operate outside the European Economic Area. Where that is the case we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) to protect your data.

Your terms acknowledgement and saved preferences live in your browser until you clear them. Aggregated analytics are retained for a limited period by our analytics provider. Account and pairing data, once that feature exists, are kept until you delete your account or revoke pairing.

Under the GDPR you have the right to:

• access your data (Art. 15) and receive a portable copy (Art. 20);
• rectify inaccurate data (Art. 16);
• erase your data (Art. 17);
• restrict or object to processing (Art. 18, 21) — including our legitimate-interest analytics.

To exercise any of these, email privacy@rust-a-man.com. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

Rust-a-Man is not directed to children under 13, and you must meet the minimum age required to play Rust in your jurisdiction to use it.

We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above.