Privacy Policy
Last updated 4 August 2026
This policy describes what CerebRUST collects, why, who we share it with and how long we keep it.
It covers the dashboard at app.cerebrust.xyz, the API, the Discord bot and the Cerebrust.cs plugin.
CerebRUST is operated by a sole trader in the United Kingdom. For data protection questions, contact support@cerebrust.xyz.
1. Who is responsible for your data
There are two different situations, and they matter:
- Your CerebRUST account. When you sign in with Steam, link Discord, or buy something, CerebRUST is the data controller.
- Telemetry from a Rust server. When a server owner installs our plugin, they decide to collect data about the people playing on their server and they instruct us to process it. For that data the server owner is the controller and CerebRUST is the processor. If you play on a server and want that data removed, the owner of that server is the person who decides — though you can contact us and we will pass it on and help.
2. What we collect
2.1 Account data
| Data | Where it comes from |
|---|---|
| Steam ID, display name, avatar | Steam, when you sign in |
| Steam VAC / game ban status, community ban flag | Steam's public API |
| Steam friends list | Steam's public API, where your profile allows it |
| Discord user ID, username, display name | Discord, only if you choose to link it |
| Session cookies | Set by us when you sign in |
We keep a history of Steam name and avatar changes. On a game where players rename themselves to evade bans, that history is part of what makes the tool useful to moderators.
2.2 Telemetry from Rust servers
When a server runs our plugin, we receive data about play on that server. If you play on a CerebRUST-enabled server, this includes you:
- Sessions — when you connect and disconnect, and for how long.
- Connection IP address, and information derived from it: country, region, network operator, and whether it appears to be a VPN or proxy along with a risk score.
- In-game position, recorded periodically so the live map and activity history work.
- In-game chat — global and team messages, including the message text and who sent it.
- Gameplay events — deaths, kills, raids, base ownership and tool cupboard authorisations, resource gathering, and similar activity.
- Bans and moderation actions taken on that server.
We do not receive your Steam password, your email address, your payment details, or any private communication outside the game.
2.3 Payment data
Payments are handled by Stripe. Card details go directly to Stripe and never reach our servers. We store the Stripe identifiers needed to link a payment to your account, what you bought, and its status. If you sell VIP, Stripe collects your identity and bank details directly for verification — we never see them.
2.4 Public server directory
We maintain a directory of Rust servers built from Steam's public server listings. This covers servers that have never installed our plugin and contains only server information — name, address, player counts, description — not player data.
3. Why we process it, and our lawful basis
| Purpose | Basis |
|---|---|
| Running your account and the dashboard | Performance of a contract |
| Taking payment and preventing payment fraud | Performance of a contract; legal obligation |
| Providing server administration and moderation tools to owners | Legitimate interests of the server owner in running their server safely and fairly |
| Detecting VPN/proxy use and ban evasion | Legitimate interests — preventing cheating and abuse on the server |
| Keeping the service secure and available | Legitimate interests |
| Discord role delivery and alerts you opt into | Consent, which you can withdraw by unlinking Discord |
4. How long we keep it
| Data | Retention |
|---|---|
| In-game position history | Progressively thinned from 6 hours onwards, and deleted entirely after 7 days |
| Public server statistics (player counts) | 40 days |
| Dashboard notifications | 90 days |
| Internal job and error logs | 30 days |
| Chat, sessions, deaths, raids and other gameplay history | Kept while the server remains on the platform, so owners can review past wipes |
| Account and payment records | Kept while your account exists; payment records for 6 years after, as UK tax law requires |
Position history is the most sensitive thing we hold and it has the shortest life by design. Nothing reads it beyond a week, so nothing keeps it beyond a week.
5. Who we share it with
We do not sell your data. We share it only with the services needed to run CerebRUST:
| Who | What for |
|---|---|
| Amazon Web Services (London, eu-west-2) | Hosting and storage. All CerebRUST data lives in the UK. |
| Stripe | Payments, and identity verification for owners who sell VIP |
| Steam / Valve | Sign-in, and looking up public profile and ban information |
| Discord | Account linking, role delivery, and alerts — only if you link Discord |
| proxycheck.io | Checking whether a connection IP is a VPN or proxy |
| NVIDIA (build.nvidia.com) | AI parsing of public server descriptions. Player data is never sent. |
Server owners and their moderators can see the telemetry for their own server. That is the entire point of the product — if you play on a server, its staff can see your activity on it. They cannot see your activity on anyone else's server.
Some of these providers process data outside the UK. Where they do, transfers rely on the UK International Data Transfer Addendum or an adequacy decision.
6. Your rights
Under UK GDPR you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything inaccurate;
- delete your data, where we do not have to keep it;
- restrict or object to how we use it, including profiling;
- hand over data you gave us in a portable format.
Email support@cerebrust.xyz. We will respond within one month.
For telemetry from a specific Rust server, the server owner is the controller, so a deletion request is ultimately theirs to decide. We will forward your request and tell you who it went to.
If you are unhappy with how we handle it, you can complain to the Information Commissioner's Office.
7. Cookies
We use cookies only to keep you signed in. There is no advertising, no analytics and no third-party tracking on the dashboard, so there is no cookie banner to click. Clearing cookies signs you out.
8. Children
CerebRUST is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child's data is held here, contact us and we will remove it.
9. Changes
We will update this policy as the service changes, and post the new date at the top. Material changes will be announced in the community Discord before they take effect.