RUSTMETRICS
← Back

Privacy Policy

Last updated: September 2026. This policy explains how data is processed when you use RustMetrics (rustmetrics.eu) — a hobby/community tool for tracking Facepunch Rust servers.

1. Controller

Swiss-Shift
Lilienstrasse 114, 4123 Allschwil, Switzerland
Email: info@swiss-shift.ch

Applicable law: Swiss Federal Act on Data Protection (revFADP, 2023). For users residing in the EU/EEA, the EU General Data Protection Regulation (GDPR) applies in addition.

2. Data we process

2.1 When you visit the site (without signing in)

The reverse proxy (Caddy on a server hosted by Hetzner Online GmbH, Germany) logs technically necessary request data: IP address, timestamp, HTTP method, requested URL, HTTP status code, response size, user agent, referrer. These logs are rotated and deleted after 30 days and are used solely for secure operation (error analysis, abuse prevention).

Additionally, the application keeps IP addresses in memory briefly (max 1 hour) for rate limiting. They are not stored persistently.

From these logs we derive daily traffic statistics on our own server: number of requests, number of distinct IP addresses, most visited pages and the domains of referring websites (e.g. reddit.com). No IP addresses, user agents or full referrer URLs are stored — only aggregated per-day numbers that cannot be linked to individuals. The statistics are used to operate and improve the site; no third-party services are involved and no cookies are set. Legal basis: legitimate interest (Art. 6(1)(f) GDPR / Art. 31 revFADP).

2.2 When you sign in with Steam

Sign-in uses Steam OpenID 2.0 (operated by Valve Corporation, USA). You never enter your Steam password on RustMetrics — authentication happens entirely with Steam. After a successful login we receive from Steam:

This data is stored in our database, linked to your account. The display name is refreshed on each login.

2.3 When you use the Watchlist

You may deliberately and manually store the following data in your account:

This data is associated exclusively with your account and is not visible to other users.

Online rhythm: for every player on your watchlist we show a 7-day × 24-hour heatmap of when that player was online. This applies to any public SteamID64 or Steam profile you add — the player does not need to be a RustMetrics user. It is derived from the public player sessions described in section 2.6 and, for players added by SteamID64, from Steam presence sessions: we record only when that SteamID was in Rust (start and end time), not which server it was on. The SteamID part only works if the player's Steam game details are public. The rhythm is shown only to users who have that player on their own watchlist, never on public pages. Sessions are deleted 14 days after they end; sessions that never ended are deleted 14 days after they started.

2.4 Steam friends

When you are signed in and open the app, we query your public Steam friends list and your friends' public profile data (display name, avatar, current game and server address) via the Steam Web API to show which friends are playing Rust right now and on which server. This data is used for display only and is not stored in our database. If your friends list is private on Steam, nothing is retrieved. Legal basis: performance of the use agreement (Art. 6(1)(b) GDPR / Art. 31 revFADP).

2.5 Session cookie

We set exactly one cookie: rm_session. It contains a random opaque token (no tracking, no content). The cookie is HttpOnly, Secure and SameSite=Lax. Lifetime: 30 days by default or until logout. Legal basis: performance of the use agreement (Art. 6(1)(b) GDPR / Art. 31 revFADP); without the cookie no login is possible.

When you sign in, we store the IP address and browser user agent together with the session in our database, so that misuse of sessions can be detected. This data is deleted together with the session when it expires (max. 30 days) or when you log out. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR / Art. 31 revFADP).

2.6 Public data from Rust servers

To show server and player activity, RustMetrics queries the public player lists of Rust servers (Steam server query protocol) and the public BattleMetrics API. From this we store per player: in-game name, previous names, BattleMetrics player ID, the SteamID64 where it is publicly provided, and when the player was first and last seen. This data is already public, is not linked to RustMetrics accounts and is used for public server and player pages. Legal basis: legitimate interest (Art. 6(1)(f) GDPR / Art. 31 revFADP). You can object and request deletion of your player record at any time via info@swiss-shift.ch.

3. Where data is processed

The application runs on a server provided by Hetzner Online GmbH (data centre in Germany). Data is stored only there.

A data transfer to the USA only occurs when you actively sign in with Steam — at that moment your browser sends OpenID verification data to steamcommunity.com (Valve Corporation, USA). Legal basis: Art. 49(1)(b) GDPR (necessary for performance of contract). To show profile data and Steam friends, our server retrieves public data from the Steam Web API (api.steampowered.com), which involves sending your SteamID64.

4. Retention

User account (SteamID, name, avatar):
until deletion by the user.
Sessions, including IP address and user agent:
30 days after last login, or until logout.
Public player records (name, previous names, IDs, first/last seen):
indefinitely; deletion on request.
Server snapshots (pop, map, player list):
rolling 14 days.
Player session diffs (who was on which server, when):
14 days after session end.
Steam presence sessions for watched SteamIDs (online rhythm; start/end time only, no server address):
14 days after session end, or 14 days after start if a session never ended.
Caddy access logs:
30 days.
Daily traffic statistics (aggregated numbers only, no IP addresses):
indefinitely.
Steam friends list:
not stored.

5. Your rights

Both under revFADP (Switzerland) and GDPR (EU) you have the right to:

For requests, simply email info@swiss-shift.ch. We respond within 30 days.

6. Right to complain

You may at any time lodge a complaint with a data-protection supervisory authority. In Switzerland: Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU: your national/local data-protection authority.

7. Technical measures

All connections are TLS-encrypted (HTTPS via Let's Encrypt). The database is only reachable locally from the application server (no external access). SSH access is key-only. Brute-force protection via fail2ban.

8. No ads, no tracking

RustMetrics contains no advertising, no tracking pixels, no third-party analytics, no third-party scripts. The only evaluation is the aggregated traffic statistics described in section 2.1, computed entirely on our own server. The only external resources are: (a) OpenID verification with Steam during login, and (b) the player avatar image hotlinked from the Steam CDN.

9. Changes

We reserve the right to amend this policy as the legal or technical environment evolves. The current version is always available at this URL.