RUSTMETRICS
← Back

Privacy Policy

Last updated: May 2026. This policy explains how data is processed when you use RustMetrics (rustmetrics.eu) — a hobby/community tool for tracking Facepunch Rust servers.

1. Controller

Swiss-Shift
Lilienstrasse 114, 4123 Allschwil, Switzerland
Email: info@swiss-shift.ch

Applicable law: Swiss Federal Act on Data Protection (revFADP, 2023). For users residing in the EU/EEA, the EU General Data Protection Regulation (GDPR) applies in addition.

2. Data we process

2.1 When you visit the site (without signing in)

The reverse proxy (Caddy on a server hosted by Hetzner Online GmbH, Germany) logs technically necessary request data: IP address, timestamp, HTTP method, requested URL, HTTP status code, response size, user agent, referrer. These logs are rotated and deleted after 30 days and are used solely for secure operation (error analysis, abuse prevention).

Additionally, the application keeps IP addresses in memory briefly (max 1 hour) for rate limiting. They are not stored persistently.

2.2 When you sign in with Steam

Sign-in uses Steam OpenID 2.0 (operated by Valve Corporation, USA). You never enter your Steam password on RustMetrics — authentication happens entirely with Steam. After a successful login we receive from Steam:

This data is stored in our database, linked to your account. The display name is refreshed on each login.

2.3 When you use the Watchlist

You may deliberately and manually store the following data in your account:

This data is associated exclusively with your account and is not visible to other users.

2.4 Session cookie

We set exactly one cookie: rm_session. It contains a random opaque token (no tracking, no content). The cookie is HttpOnly, Secure and SameSite=Lax. Lifetime: 30 days by default or until logout. Legal basis: performance of the use agreement (Art. 6(1)(b) GDPR / Art. 31 revFADP); without the cookie no login is possible.

3. Where data is processed

The application runs on a server provided by Hetzner Online GmbH (data centre in Germany). Data is stored only there.

A data transfer to the USA only occurs when you actively sign in with Steam — at that moment your browser sends OpenID verification data to steamcommunity.com (Valve Corporation, USA). Legal basis: Art. 49(1)(b) GDPR (necessary for performance of contract).

4. Retention

User account (SteamID, name, avatar):
until deletion by the user.
Sessions:
30 days after last login, or until logout.
Server snapshots (pop, map, player list):
rolling 14 days.
Player session diffs (who was on which server, when):
14 days after session end.
Caddy access logs:
30 days.

5. Your rights

Both under revFADP (Switzerland) and GDPR (EU) you have the right to:

For requests, simply email info@swiss-shift.ch. We respond within 30 days.

6. Right to complain

You may at any time lodge a complaint with a data-protection supervisory authority. In Switzerland: Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU: your national/local data-protection authority.

7. Technical measures

All connections are TLS-encrypted (HTTPS via Let's Encrypt). The database is only reachable locally from the application server (no external access). SSH access is key-only. Brute-force protection via fail2ban.

8. No ads, no tracking

RustMetrics contains no advertising, no tracking pixels, no analytics, no third-party scripts. The only external resources are: (a) OpenID verification with Steam during login, and (b) the player avatar image hotlinked from the Steam CDN.

9. Changes

We reserve the right to amend this policy as the legal or technical environment evolves. The current version is always available at this URL.