Privacy Policy

RustTrust ("we", "us") provides reputation analysis for Rust players based on publicly available Steam data. This policy explains what personal data we process when you visit RustTrust, sign in with Steam, or analyze a profile.

RustTrust is an independent project and is not affiliated with, endorsed by or sponsored by Valve Corporation or Facepunch Studios.

We keep data collection to the minimum required to operate the service:

• Steam identifiers received through Steam OpenID when you choose to sign in.
• Public Steam profile data of analyzed accounts, retrieved from the Steam Web API.
• Search history: which public profiles were analyzed, with a timestamp and the resulting Trust Score.
• Usage quota data: a per-day counter tied to your Steam ID, or to a hashed, non-reversible representation of your IP address when signed out.
• Technical logs: request metadata used to keep the service secure and available.

We do not collect payment data today. We do not knowingly collect data from children under 13.

Signing in is optional. It exists to raise your daily quotas and to personalize your dashboard. Authentication happens on Valve's servers; we verify the response signature and store a signed session cookie. The only fields we receive are:

• SteamID64 — your public numeric Steam identifier, used as your account key.
• Steam username (persona name) — displayed in the interface.
• Avatar URL — proxied through RustTrust so your browser never contacts Valve's CDN directly.

We never receive your Steam password, email address, friends list credentials or payment information.

Search history records which public profiles were analyzed, when, from which surface (search bar, comparison, leaderboard) and with which resulting score. It powers caching, leaderboards, abuse prevention and aggregate statistics.

Entries are retained for up to 24 months, after which they are deleted or irreversibly aggregated. Favorites are stored locally in your browser (localStorage) and are never uploaded; clearing browser storage removes them permanently.

We measure aggregate product usage — searches performed, popular profiles, coarse device type — to understand which features matter and to size infrastructure.

Analytics data is never sold, never used for advertising and never shared with cross-site profiling networks.

We use strictly necessary cookies for your Steam session and for abuse prevention, plus a small amount of browser local storage for favorites and interface preferences. Full detail, including durations and how to control them, is available in our Cookie Policy.

Data is stored in a managed PostgreSQL database hosted in the European Union, with encrypted storage at rest and encrypted transport. Analyzed profiles are cached for 24 hours to avoid re-querying Steam unnecessarily.

Retention: session cookies until sign-out, quota counters for 30 days, profile cache for 24 hours before refresh, search history for up to 24 months.

Access to stored data is restricted by row-level security policies and service-role credentials, sessions are signed and transmitted over HTTPS only, privileged database functions are limited to backend service roles, and API keys are held server-side and never exposed to the browser.

No online service can guarantee absolute security. If we become aware of a breach affecting your data, we will notify affected users and the relevant authorities as required by law.

We share data only with infrastructure providers acting as processors on our behalf, or where required by law. We never sell personal data.

• Supabase — managed database, storage and authentication infrastructure hosting our application data.
• Steam Web API (Valve Corporation) — source of the public profile data we analyze; your use of Steam data is also governed by the Valve Privacy Policy.
• Stripe — payment processing, reserved for a future premium tier. No payment data is processed today; this policy will be updated with a new date before any billing is enabled.
• Discord — community and support channel. Data you share there is governed by Discord's own privacy policy.

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate information.
• Erasure: request deletion of your account data and search history.
• Restriction and objection: ask us to limit or stop certain processing.
• Portability: receive your data in a structured, machine-readable format.
• Complaint: lodge a complaint with your local data protection authority.

Requests can be sent to privacy@rusttrust.gg. We respond within 30 days and may ask you to prove ownership of the Steam account concerned.

Where the GDPR applies, we rely on legitimate interest to operate and secure the service, on contract performance to deliver features you explicitly request, and on consent where consent is legally required.

You may withdraw consent at any time without affecting the lawfulness of prior processing. Data transfers outside the EEA, where they occur, are covered by Standard Contractual Clauses.

California residents have the right to know which categories of personal information we collect, to request deletion, and to opt out of the sale or sharing of personal information.

RustTrust does not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against users who exercise their rights.

The Trust Score is a statistical estimate computed from publicly available Steam data. It is not evidence of cheating, fraud or any other misconduct, and it is not a decision made by Valve or Facepunch.

Scores may be incomplete or outdated and must never be used as the sole basis for bans or accusations. If you believe a score is inaccurate, you can request a manual review.

Privacy requests: privacy@rusttrust.gg. General support: support@rusttrust.gg. You can also reach us through the contact page.

This policy was last updated on August 2, 2026.