Privacy Policy
Last updated 7 October 2026
This policy describes what CerebRUST collects, why, who we share it with and how long we keep it.
It covers the dashboard at app.cerebrust.xyz, the API, the Discord bot and the Cerebrust.cs plugin.
CerebRUST is operated by a sole trader in the United Kingdom. For data protection questions, contact support@cerebrust.xyz.
1. Who is responsible for your data
There are two different situations, and they matter:
- Your CerebRUST account. When you sign in with Steam, link Discord, or buy something, CerebRUST is the data controller.
- Telemetry from a Rust server. When a server owner installs our plugin, they decide to collect data about the people playing on their server and they instruct us to process it. For that data the server owner is the controller and CerebRUST is the processor. If you play on a server and want that data removed, the owner of that server is the person who decides — though you can contact us and we will pass it on and help.
- Derived statistics shared with another organisation. If both your server's owner and another CerebRUST organisation opt into cross-network player signals, we compute an arithmetic summary from your telemetry (percentiles and counts — never a name, a note, a ban, or which server it came from) and show it to admins on that other organisation's servers. CerebRUST remains the controller for that summary — it is our own derived claim about you, not raw telemetry handed to a third party. See §5 for what that switch does and does not share.
2. What we collect
2.1 Account data
| Data | Where it comes from |
|---|---|
| Steam ID, display name, avatar | Steam, when you sign in |
| Steam VAC / game ban status, community ban flag | Steam's public API |
| Steam friends list | Steam's public API, where your profile allows it |
| Discord user ID, username, display name | Discord, only if you choose to link it |
| Session cookies | Set by us when you sign in |
| When your account was created and when you last used it | Recorded by us when you first sign in, and at most once an hour while you use the dashboard |
We keep a history of Steam name and avatar changes. On a game where players rename themselves to evade bans, that history is part of what makes the tool useful to moderators.
2.2 Telemetry from Rust servers
When a server runs our plugin, we receive data about play on that server. If you play on a CerebRUST-enabled server, this includes you:
- Sessions — when you connect and disconnect, and for how long.
- Connection IP address, and information derived from it: country, region, network operator, and whether it appears to be a VPN or proxy along with a risk score.
- In-game position, recorded periodically so the live map and activity history work.
- In-game chat — global and team messages, including the message text and who sent it.
- Gameplay events — deaths, kills, raids, base ownership and tool cupboard authorisations, resource gathering, and similar activity.
- Bans and moderation actions taken on that server.
We do not receive your Steam password, your email address, your payment details, or any private communication outside the game.
2.3 Payment data
Payments are handled by Stripe. Card details go directly to Stripe and never reach our servers. We store the Stripe identifiers needed to link a payment to your account, what you bought, and its status. If you sell VIP, Stripe collects your identity and bank details directly for verification — we never see them.
2.4 Public server directory
We maintain a directory of Rust servers built from Steam's public server listings. This covers servers that have never installed our plugin and contains only server information — name, address, player counts, description — not player data.
2.5 Website visits
We count page views on app.cerebrust.xyz and docs.cerebrust.xyz so we can see how busy the sites are and which pages people read. We do this ourselves rather than embedding Google Analytics or a similar service, so your browsing is not shared with anyone.
There is no cookie and no tracking identifier, which is why this site asks you
for no cookie consent. For each page view we record the site, the page path, and the host that
referred you — the host only, such as google.com, never the full address of the page
you came from. We do not store your IP address or your browser's user-agent string: they are
combined with a secret that changes every day into a one-way code that lets us tell two visitors
apart within a single day and cannot be tied back to you, cannot be linked to your CerebRUST
account, and does not match you to yourself the next day.
Numeric parts of a page address are removed before it is stored, so a visit to a specific server's
page is recorded as /servers/:id rather than naming the server. Query strings are discarded
entirely.
3. Why we process it, and our lawful basis
| Purpose | Basis |
|---|---|
| Running your account and the dashboard | Performance of a contract |
| Taking payment and preventing payment fraud | Performance of a contract; legal obligation |
| Providing server administration and moderation tools to owners | Legitimate interests of the server owner in running their server safely and fairly |
| Detecting VPN/proxy use and ban evasion | Legitimate interests — preventing cheating and abuse on the server |
| Keeping the service secure and available | Legitimate interests |
| Counting page views on our own websites | Legitimate interests — understanding how the sites are used. No cookie or identifier is stored on your device, so no consent is required |
| Discord role delivery and alerts you opt into | Consent, which you can withdraw by unlinking Discord |
4. How long we keep it
| Data | Retention |
|---|---|
| In-game position history | Progressively thinned from 6 hours onwards, and deleted entirely after 7 days |
| Public server statistics (player counts) | 40 days |
| Dashboard notifications | 90 days |
| Internal job and error logs | 30 days |
| Individual page views | 90 days, after which only daily totals per page remain — counts with nothing left that could relate to a visitor |
| Chat, sessions, deaths, raids and other gameplay history | Kept while the server remains on the platform, so owners can review past wipes |
| Account records (including when it was created and last used) and payment records | Kept while your account exists; payment records for 6 years after, as UK tax law requires |
Position history is the most sensitive thing we hold and it has the shortest life by design. Nothing reads it beyond a week, so nothing keeps it beyond a week.
5. Who we share it with
We do not sell your data. We share it only with the services needed to run CerebRUST:
| Who | What for |
|---|---|
| Amazon Web Services (London, eu-west-2) | Hosting and storage, and the AI parsing of public server descriptions (Amazon Bedrock). Player data is never sent to the AI. All CerebRUST data lives in the UK. |
| Stripe | Payments, and identity verification for owners who sell VIP |
| Steam / Valve | Sign-in, and looking up public profile and ban information |
| Discord | Account linking, role delivery, and alerts — only if you link Discord |
| proxycheck.io | Checking whether a connection IP is a VPN or proxy |
| Other CerebRUST organisations (opt-in, off by default) | If your server's owner turns on "Share and receive player signals" and at least two other organisations have too, arithmetic summaries of your play (percentiles and counts, never a name, a note or a ban) are shown to their admins — see below. |
Server owners and their moderators can see the telemetry for their own server. That is the entire point of the product — if you play on a server, its staff can see your activity on it. They cannot see your activity on anyone else's server.
The one exception is the opt-in cross-network signal above. If your server's owner and at least two other CerebRUST organisations have all turned it on, admins on those other organisations' servers may see a summary of your play there — but only arithmetic they compute themselves (percentiles, counts, the size of the sample), and never which server it came from, never a note, a flag, a warning or a ban. If you have never played on a server whose owner opted in, nothing about you is ever shared this way. You can see this exact summary about yourself from your own account, and any admin you have played for can exclude you from it permanently.
Some of these providers process data outside the UK. Where they do, transfers rely on the UK International Data Transfer Addendum or an adequacy decision.
6. Your rights
Under UK GDPR you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything inaccurate;
- delete your data, where we do not have to keep it;
- restrict or object to how we use it, including profiling;
- hand over data you gave us in a portable format.
Email support@cerebrust.xyz. We will respond within one month.
For telemetry from a specific Rust server, the server owner is the controller, so a deletion request is ultimately theirs to decide. We will forward your request and tell you who it went to.
If you are unhappy with how we handle it, you can complain to the Information Commissioner's Office.
7. Cookies
We use cookies only to keep you signed in. There is no advertising, no analytics and no third-party tracking on the dashboard, so there is no cookie banner to click. Clearing cookies signs you out.
8. Children
CerebRUST is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child's data is held here, contact us and we will remove it.
9. Changes
We will update this policy as the service changes, and post the new date at the top. Material changes will be announced in the community Discord before they take effect.