This Privacy Policy explains what data RustCommander collects, how it is used, and the choices you have. It applies to the marketing website, dashboard portal, API, and RustCommander plugin workflows. RustCommander is an independent tool not affiliated with Facepunch Studios or RustMaps.
All official Rust game assets displayed, rendered, or referenced through the Service—including 3D models, props, prefabs, monuments, textures, names, and icons—remain the property of Facepunch Studios and/or their respective rights holders. RustCommander claims no ownership of these materials. Their use is limited to descriptive, visualization, interoperability, and server-administration purposes and does not imply affiliation, sponsorship, or endorsement by Facepunch Studios.
Data Controller and Contact
RustCommander is the controller of the personal data described in this Policy. For privacy questions or to exercise your rights, contact [email protected].
1. Data We Collect
| Data | Why we collect it |
|---|---|
| Name & email address | Account creation, identification, communication, and recovery |
| Linked sign-in identity (Google subject, Discord user ID, or SteamID64) | To authenticate you and keep your provider linked to the correct RustCommander account |
| Marketing email preference and consent record | To send product news, offers, and discounts only when you opt in |
| Password, when email sign-in is used (hashed) | Authentication — passwords are never stored in plain text |
| Short-lived OAuth/OpenID state, login tickets, and provider access tokens | To securely complete social sign-in and prevent forged or replayed login attempts |
| Short-lived email verification record and hashed verification code | To prove control of an email before creating an account or linking Steam to an existing account |
| Server connection details (IP, port, RCON credentials) | To connect to and manage your Rust server |
| Server data (players, maps, plugins, VIPs, chat logs) | To provide the dashboard features you use |
| Subscription, license, and payment status | To manage plans, checkout, renewals, and active server licenses |
| Team invitation emails | To invite members and verify that invitations are opened by the intended email |
| RustMaps API key and optional organization ID (if provided, stored for the selected server) | To authenticate map generation, configuration, limit, and status requests for that server |
| Discord bot token (if provided) | To connect the Discord status bot to your Discord server on your behalf |
| Cookie consent preference | To remember your cookie choice across rustcommander.app and panel.rustcommander.app |
| Authenticated account presence | To show service availability and provide operational support and security |
We do not currently collect advertising data or third-party analytics cookies.
2. How We Use Your Data
- To authenticate you by email, Google, Discord, or Steam and provide access to the dashboard.
- When you choose Discord sign-in, to add your Discord account to the official RustCommander community server using the permission shown by Discord.
- To connect to your Rust server via RCON and sync requested data.
- To cache server data (players, maps, plugins) so repeated operations are faster.
- To display your server's information within your account scope only.
- To process subscriptions, licenses, invoices, and team invitations.
- To send product news and offers when you have chosen to receive them.
- To identify accounts currently using the dashboard for operational support and security. Identifiable presence is available only to RustCommander superadministrators.
We do not sell, share, or transfer your data to third parties for commercial purposes. Server data is scoped to your account and is not visible to other users.
We process short-lived authenticated presence on the basis of our legitimate interests in operating, supporting, and securing RustCommander. Access is restricted to superadministrators and limited to account identity, role, and latest activity time.
Legal Bases for Processing
- Performance of our agreement with you: creating and authenticating your account, providing dashboard features, managing subscriptions, and delivering requested integrations.
- Your consent: optional marketing emails. You may withdraw this consent at any time without affecting earlier lawful processing.
- Our legitimate interests: securing and operating the Service, preventing abuse, diagnosing failures, and providing support, where those interests are not overridden by your rights.
- Compliance with legal obligations: retaining records required for accounting, tax, fraud prevention, dispute handling, or lawful requests.
The account email and authentication identifier are required to create and maintain an account. Marketing consent and optional integration credentials are not required to use the basic Service. RustCommander does not make decisions producing legal or similarly significant effects based solely on automated processing.
3. Data Storage
All data is stored in a PostgreSQL database. RCON credentials, API keys, and Discord bot tokens are stored encrypted at rest using AES-256-GCM. Access to the database is restricted to the RustCommander application and its administrators.
A saved RustMaps API key is associated with the server for which you configured it and is never returned to your browser. RustCommander decrypts it only when needed to perform the RustMaps actions you request for that server.
RustCommander stores the identifier returned by your chosen sign-in provider and the provider email when one is supplied. Google and Discord access tokens used during sign-in are not stored. The short-lived Discord access token requested for community membership is sent only to RustCommander's private bot service to complete that action. Steam OpenID does not provide an email address, so the email entered during the second step is verified by a code sent through our email provider. The code is stored only as a one-way hash, expires after 10 minutes, and is deleted when successfully used. The verified email is stored as the account email for a new account, or used to link Steam to the existing account that already owns that email.
4. Third-Party Services
If you sign in with Google, Discord, or Steam, the selected provider processes the authentication request and returns an account identifier. Google and Discord may also return your name and verified email. Steam returns your SteamID64 and, when a Steam Web API key is configured, RustCommander may request your public Steam display name. These providers process data under their own privacy policies: Google, Discord, and Steam.
When you connect RustMaps for a server, RustCommander stores the API key you provide in encrypted form on the RustCommander backend and associates it with that server. Each server can have independent RustMaps credentials. The browser sends the key only when you save or replace it; the stored value is not returned to the browser. RustCommander decrypts it only when needed to make server-to-server requests to RustMaps for map generation, saved configurations, account limits, and generation status. The optional RustMaps organization ID, generation settings, and returned map metadata, preview images, URLs, generation state, seed, and size may also be stored for the selected server so the requested workflow can continue after you leave the page. Your RustMaps license, usage limits, billing, availability, and map output are governed by RustMaps' own privacy policy. RustCommander is not affiliated with RustMaps.
Stripe processes checkout and payment information. Resend may process transactional emails such as team invitations or account notices, and marketing emails when you have opted in.
Separately from Discord account sign-in, if you configure the optional Discord status bot, your bot token is stored encrypted and used solely to maintain a persistent connection to the Discord Gateway on your behalf, in order to display a live player count as the bot's presence status. Bot presence data is sent to Discord's API and is subject to Discord's Privacy Policy. The status bot does not read messages or unrelated Discord data. The official RustCommander community bot processes the Discord user ID and temporary access token needed to add a user who selected Discord sign-in.
Relevant data may be processed by infrastructure, authentication, email, payment, and integration providers such as Google, Discord, Valve/Steam, Stripe, Resend, RustMaps, and RustCommander's hosting providers. Some providers may process data outside the European Economic Area under their applicable privacy terms and legally recognized transfer safeguards. RustCommander does not sell personal data.
5. Cookies and Browser Storage
RustCommander uses necessary cookies and browser storage for authentication, social sign-in security state, payment checkout state, and cookie preferences. Cookie consent is stored in rustcommander_cookie_consent and shared across the landing website and portal using the .rustcommander.app domain where available. See the Cookie Policy for details.
6. Data Retention
Your data is retained for as long as your account is active. If you wish to delete your account and all associated data, email [email protected] or contact us through the Discord community and we will process the request within 30 days.
OAuth state expires after 10 minutes, browser login and account-link tickets after 60 seconds, and Steam registration-completion and email-verification records after 10 minutes. Verification codes allow no more than five failed attempts. Provider access tokens used for sign-in are not retained. Linked provider identifiers are retained with the account until the account or link is removed, subject to any legal retention obligations.
RustMaps API keys and organization IDs are retained until you replace or remove the integration, delete the associated server, or delete the account. Other optional integration credentials, including Discord bot tokens, are retained until you replace or remove the integration or delete the account, subject to backup cycles and any legal retention obligations.
An account is shown as currently active only when authenticated activity has been recorded during the previous 90 seconds. The latest account activity timestamp may be retained for account security and inactive Free server retention. The active-user view does not include IP addresses or the pages a user visits.
7. Security
We take reasonable measures to protect your data, including password hashing, encrypted storage of sensitive credentials, and server-scoped data isolation. However, no system is completely secure. Use a strong, unique password and keep your RCON credentials confidential.
8. Your Rights
Subject to applicable law, you may request access, rectification, erasure, restriction, portability, or object to the processing of your personal data. You can withdraw marketing consent at any time from your profile settings without affecting processing carried out before withdrawal. To exercise any of these rights, email [email protected] or reach us via the RustCommander Discord.
If you are in Spain, you may also lodge a complaint with the Spanish Data Protection Agency (AEPD). If you are elsewhere in the EEA, you may contact your local supervisory authority.
9. Changes to This Policy
We may update this Privacy Policy as the Service evolves. For material changes, we may display an in-product notice and ask you to acknowledge that you have seen the updated Policy. We may record your account ID, the Policy version, and the acknowledgement time so that the notice is shown only when required. The effective date appears at the top of this page.
© 2026 RustCommander. All rights reserved.