Privacy policy

Controller and contact

The controller responsible for your personal data under the General Data Protection Regulation (GDPR) is:

For anything about your data, email support@rustfront.com. We answer in German or English. More contact details are in the Impressum.

We have not appointed a data protection officer. RustFront is run by one person and does not reach the thresholds of § 38 of the German Federal Data Protection Act (BDSG), so none is required. Please contact us directly.

Summary

• You can read the whole wiki without an account. Signing in with Steam is optional. You need it, for example, to comment, publish guides, link Discord or become a Wiki Supporter.
• No advertising trackers, no ad networks, no social media plugins, no embedded videos or widgets and no third-party scripts. Our fonts are served by us. Payments open on Stripe's own pages; no Stripe script runs on rustfront.com.
• No cookie banner: we only store what is strictly necessary for a function you use (§ 25 Abs. 2 Nr. 2 TDDDG). Just reading the wiki sets no cookies at all. See Cookies and local storage.
• We measure reach with Vercel Web Analytics, without cookies and without user profiles. It stays off if your browser sends Do Not Track or Global Privacy Control, and you can switch it off under Reach measurement.
• Some images load directly from other servers: skin images and Steam avatars from Valve and Facepunch. See Images from other servers.
• We do not sell data, we send no newsletters and we make no automated decisions about you.

Hosting and server logs

RustFront is hosted by Vercel Inc. (USA). Our server functions run in Vercel's region in Washington, D.C., USA. Static pages are delivered from the location in Vercel's global network that is nearest to you.

Every time you open a page, Vercel processes and logs:

• your IP address,
• the date and time,
• the requested address (path and query),
• your browser's user agent (browser and operating system),
• the HTTP status of the response,
• the Vercel region that handled the request.

Purpose: delivering the site, keeping it secure and preventing abuse. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure site that works. Vercel keeps these logs for one day.

Vercel processes this data for us as a processor under its data processing agreement. For data that its service generates itself, Vercel is an independent controller. On transfers to the USA, see Transfers outside the EU.

Protection against abuse

Some functions limit how often they can be used, to stop abuse. The feedback form and the cancellation, withdrawal and report forms count requests with hashes of IP addresses that exist only in memory and are never stored. The hourly limit of the suggestion form uses the stored daily hash described under Suggest a change. Comments, guides and checkouts are limited per account. Legal basis: Art. 6(1)(f) GDPR (protection of the site against abuse).

Cookies and local storage

We only store information on your device when this is strictly necessary for a function you have asked for (§ 25 Abs. 2 Nr. 2 TDDDG). That needs no consent, which is why there is no cookie banner. Just visiting sets no cookies at all; cookies are only set when you sign in.

The table lists everything we store in your browser. Session storage holds only the source choice in the electricity builder. We use no IndexedDB and no service worker.

Entries in local storage and session storage stay in your browser. You can delete all of them at any time by clearing the site data for rustfront.com in your browser settings. Where an entry contains personal data (the sign-in cookie contains your SteamID64), we process it to provide the account you asked for (Art. 6(1)(b) GDPR).

The Vercel Web Analytics script sets no cookies and writes nothing to your device. It reads a Vercel attribution entry in local storage (__va_attribution) that RustFront never creates.

When you go to Steam, Stripe or Discord to sign in, pay or link your account, those services set their own cookies on their own domains. Their privacy policies apply.

Reach measurement

We use Vercel Web Analytics to see which pages and tools are used. The script is loaded from rustfront.com itself (/_vercel/insights/script.js) and runs only on the live site.

What is sent and stored

For each page view the script sends the page address and the time. With the first page view after you arrive from another website, and with each counted skin market click, it also sends the address of the page you came from (referrer). We remove fragments (the part after #) and all query parameters except simple campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term). A tag is kept only if it is a plain label of at most 64 characters made of letters, digits, dots, hyphens and underscores, with at least one letter and without a Steam ID (17 digits in a row). Pure numbers, email addresses and web addresses are dropped. Form contents are never sent.

From the request, Vercel derives your browser and its version, your operating system and its version, your device type and your approximate location (country, region, city). Vercel counts visitors with a hash created from the incoming request. The hash is valid for one day and then reset, and the visit session is discarded after 24 hours. There are no cookies, no tracking across other websites and no user profile.

Vercel stores for each page view: the time, the page address, the dynamic route, the referrer, the filtered query parameters, country, region and city, operating system and version, browser and version, device type and script version. These data stay available in our reports for 12 months.

Pages we never measure

Account, sign-in, admin, owner, support and ticket pages, payment and moderation pages, player profiles, player reports and ban appeals, the OBS stream overlay, and every page whose address path contains a Steam ID (17 digits in a row).

Clicks on skin market links

When you click a link to a skin marketplace, we count a "Skin market click" with the marketplace and the skin, but no user identifier and not the full target address. These numbers count outgoing clicks, not visits or purchases at the marketplace.

Legal basis and recipient

Art. 6(1)(f) GDPR. Our legitimate interest is knowing which pages and tools are used, so we can improve the wiki. Vercel Inc. processes the data for us as a processor in the USA (see Transfers outside the EU). More from Vercel: Vercel Web Analytics privacy and compliance.

How to switch it off

If your browser sends Do Not Track or Global Privacy Control, the script is not loaded at all. You can also switch measurement off for this browser with the switch below. It saves the entry rustfront.analytics.optout in your browser, and from then on the script is not loaded. If the script is already running on the page when you switch it off, it sends nothing more. Switching off is also how you object to this processing without giving reasons.

Images from other servers

Some images load directly from other servers:

• Skin images come from Valve's Steam servers (community.fastly.steamstatic.com and images.steamusercontent.com, delivered via Fastly and Google Cloud) and from Facepunch (files.facepunch.com, delivered via BunnyCDN in the EU). Pages about Rust updates can also show Facepunch's official update header images from that server, unchanged and without sending it the address of our page.
• Steam avatars next to comments and on your account page come from Valve's servers (delivered via Akamai, Fastly or Cloudflare).

To load them, your browser sends these servers your IP address, information about your browser and "https://rustfront.com" as the referring address. Our pages tell your browser never to send the address of the page you are on (Referrer-Policy "strict-origin").

Why: we are not allowed to copy skin artwork to our own servers, so linking to the official copies is the lawful way to show it. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is showing skins and avatars on the site.

Valve Corporation and Google LLC are certified under the EU-U.S. Data Privacy Framework; Fastly, Akamai and Cloudflare are listed as "Active, re-certification under review". The United Kingdom (Facepunch) has an EU adequacy decision. The pictures on the streamers page are different: they come through rustfront.com (see Streamers page).

Steam sign-in and your account

Signing in is optional. When you sign in, you go to steamcommunity.com, where Valve Corporation (USA) confirms who you are with OpenID 2.0. RustFront never sees your Steam password. Valve processes your sign-in as an independent controller under the Steam privacy policy, which also names Valve's representative in the EU.

After you sign in, we receive your SteamID64 and fetch your public Steam profile through the Steam Web API: your display name (persona name), the address of your avatar and the address of your profile. We store in our database: SteamID64, display name, avatar address, profile address, your role on the site, and the time of your first and your latest sign-in. We refresh the profile data every time you sign in.

Legal basis: Art. 6(1)(b) GDPR; we need the data to provide the account functions you asked for. The profile data does not come from you directly but from the Steam Web API (Art. 14 GDPR). The cookie rvn_session keeps you signed in (see Cookies and local storage).

We keep your account until you ask us to delete it. We then delete your account and anonymise your comments and guides, or delete them too if you ask.

Steam data we keep, and where

• From your sign-in: your SteamID64, display name, avatar address and profile address (see above).
• Your comments, guides, suggestions, supporter records and Discord link are stored with your account.
• From the former game servers, if you played there: the data under Archived game-server data.
• Your skin inventory is looked up only when you ask for it, and we do not store it (see Skin inventory import).

Countries: our database is in Germany (Frankfurt). The server functions that process your requests run in the USA (Vercel, Washington, D.C.). Data from the former game servers may also still be on a server we rent from OVH in Poland (Warsaw), which has been offline since 12 August 2026.

Comments

You need to be signed in to comment. We store the text, the page, the time, any edits and your account. Comments are public and show your Steam display name, your Steam avatar and, while your support is active, a Supporter badge. The avatars load from Valve's servers (see Images from other servers).

Signed-in users can report a comment with the Report button. We then store the reporting account and the reason, and delete the report 12 months after it was made. Notices of illegal content sent with the form that is open to anyone are covered under Cancellation, withdrawal and report forms.

When you delete a comment, it is hidden immediately. We erase its text 90 days after deletion; we keep it that long to handle complaints and legal claims.

When we remove a comment

If we remove your comment, it is hidden immediately and we keep a moderation record: that we removed it and when, the content rule or law we relied on, what led to the removal (a notice of illegal content, a report sent with the Report button or our own initiative) and the explanation we wrote for you. When you are signed in, you see this record in place of the comment until we delete it. Other visitors do not see it.

We erase the text of a removed comment 7 months after the removal. You can contest a removal within six months, and if your complaint is justified we restore the comment, so we keep the text that long plus a month to decide. We keep the moderation record for 3 years after the end of the year of the removal (the regular limitation period for claims about the decision) and then delete it. The comment then stays hidden like a comment you deleted yourself.

Legal basis: Art. 6(1)(b) GDPR for publishing your comment under our terms of use. Moderation is based on Art. 6(1)(f) GDPR (keeping the wiki free of abuse) and on our legal duties under the Digital Services Act (Art. 6(1)(c) GDPR), which include giving you the reasons for a removal (Art. 17 Digital Services Act). We keep the moderation record on the basis of Art. 6(1)(f) GDPR, to be able to defend the decision against legal claims.

Guides

Electricity guides are published under your Steam display name, with a Supporter badge while your support is active. We store every revision. If you archive (delete) a guide, it is hidden.

Base guides are published without your name; we store your account internally. They cannot be edited after publishing.

Legal basis: Art. 6(1)(b) GDPR (publishing what you asked us to publish). We delete guides on request: write to support@rustfront.com.

If we remove one of your guides because it is illegal or breaks our terms of use, we send you the reasons by email or as a Discord message if we know your email address or you linked Discord. Legal basis: Art. 6(1)(c) GDPR, because Art. 17 Digital Services Act obliges us to give you the reasons.

Suggest a change

Anyone can suggest a change to a wiki page, with or without an account. We store the suggestion, the page, a contact (email address or Discord name) if you give one, your account if you are signed in, and a pseudonymous daily hash of your IP address (SHA-256 of the IP address, the date and a secret) to stop spam.

Suggestions are never published; we review them. The IP hash is erased after 30 days. Suggestions, including any contact you gave, are deleted 12 months after they were sent.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a correct wiki and protection against spam.

Site feedback

The feedback box and the feedback button in the footer send your message through a webhook to a private channel on our Discord server. With your message we send the page address (without query and fragment), the language, where you opened the form, a contact if you give one and, if you are signed in, your SteamID64 and a link to your Steam profile. RustFront does not store feedback itself.

Recipient: Discord (Discord Netherlands B.V. for users in the EEA; the processing is done by Discord, Inc. in the USA). Discord acts as an independent controller for its platform. Discord, Inc. is listed under the EU-U.S. Data Privacy Framework as "Active, re-certification under review", and uses standard contractual clauses according to its privacy policy.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is reading and answering feedback to improve the site. Messages are deleted from the channel after 12 months at the latest.

What the feedback box stores in your browser: see rustfront.feedback.nudge.v1 under Cookies and local storage.

Cancellation, withdrawal and report forms

Three forms work without an account: cancel a contract, withdraw from a contract and report illegal content. We process what you enter, plus the time of receipt and a receipt number:

• cancellation: your name and email address, the contract, the kind of cancellation and when it should take effect, the reason for a cancellation for good cause and, if you give them, a receipt number and your Steam profile link;
• withdrawal: your name and email address, the contract and, if you give them, details of the purchase;
• report: the page address, the content ID if the report link filled it in or you give it, the category, your explanation and, if you give them, your name and email address. We use the email address for the confirmation of receipt and to tell you our decision.

Confirmations by email are sent through Resend (Plus Five Five, Inc., trading as Resend, USA), with a copy to our mailbox billing@rustfront.com at Proton. Resend stores email metadata and logs in the USA for 30 days. Each submission also goes to a private channel on our Discord server (as with feedback), together with what we did at Stripe for a cancellation and whether the confirmation email went out. If that post fails, we send the same by email through Resend to billing@rustfront.com instead.

How a cancellation reaches Stripe

To carry out an ordinary cancellation of the monthly plan at the earliest possible date, we look up your contract at Stripe: through your account if you are signed in, and through the email address you entered. We compare the email address and name you entered with those Stripe holds for the contract. If exactly one subscription matches, we end it at Stripe at the end of the paid month. In every other case, and for a cancellation for good cause or on a date you choose, a person handles it. For one-time support there is nothing to cancel; we look up your badge in our records (through your account) and at Stripe (through the email address you entered) only to tell you when it ends. Stripe acts as our processor for this.

Legal basis: Art. 6(1)(c) GDPR, because the law requires us to accept and confirm these declarations (§ 312k and § 356a of the German Civil Code (BGB), Art. 16 Digital Services Act), and Art. 6(1)(f) GDPR, because we must be able to prove what we received. Carrying out your cancellation at Stripe is also based on Art. 6(1)(b) GDPR (ending the contract). We keep submissions for 3 years after the end of the year in which we received them (the statutory limitation period) and then delete them.

To prevent abuse, the forms limit how often one IP address can send them or start a search at Stripe, and how many confirmations go to one inbox. This uses hashes of your IP address and email address that are kept in memory only and never stored.

Wiki Supporter payments

You can support the wiki with a one-time payment or a monthly Wiki Supporter plan. You sign in with Steam first. The contract terms are in the supporter terms.

Payment (Stripe Checkout), receipts and subscription management run on pages hosted by Stripe. Our contract partner is Stripe Payments Europe, Limited (Ireland). Stripe collects your payment details, email address and name. Stripe acts as our processor for the payment and as an independent controller for fraud prevention, anti-money-laundering checks and its own legal duties. RustFront never sees your card details. Stripe transfers data to Stripe, LLC in the USA under the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback (Stripe's Data Transfers Addendum). More in the Stripe privacy policy.

So that a payment can be matched to your account, we give Stripe internal references to your RustFront account and to your order, the kind of support and whether you chose the supporters wall. We do not send Stripe your SteamID64 or your Steam name.

We store: your account; Stripe's IDs for you as a customer and for the checkout session, subscription and payment; amount, currency and status; start, end of the current period and badge expiry; and whether you want to appear on the supporters wall. Stripe's notifications to us (webhook events) are stored with personal fields removed and deleted 90 days after we have processed them, or 90 days after they arrived if they could not be processed.

You place the order on rustfront.com with the button "Order with obligation to pay" and then pay on Stripe's page. With the order, we record at Stripe the label of that button, the version of our terms, the time of your click and the language of the order, to document the order. If you do not complete the payment, Stripe closes the payment page after about 30 minutes and the order is cancelled; you owe nothing.

We only take orders while the contract confirmation can be sent by email. For the confirmation, we receive your email address from Stripe when Stripe reports the completed checkout, and we do not store it. The email goes out through Resend, which keeps delivery logs for 30 days (see Recipients and processors).

If the confirmation email cannot be sent, a notice goes to a private staff channel on our Discord server, so that a person can send you the confirmation by hand. The notice contains Stripe's ID for your checkout, the product, the amount, the language, when your support started, why the email did not go out and the text of the confirmation (or, where that text cannot be put together, the order details). It does not contain your name or your email address. Our internal alert log in our database also records the checkout ID, why the email did not go out and whether the notice reached Discord.

What is public

• While your support is active, a Supporter badge appears next to your name on comments and guides. It is part of what you pay for.
• Your Steam display name appears on the supporters wall only if you choose that. This is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time on your account page, with effect for the future.
• Monthly supporters who link Discord get the Wiki Supporter role on our Discord server (see Linking your Discord account).

Legal basis: Art. 6(1)(b) GDPR (the contract), Art. 6(1)(c) GDPR (tax law, and the contract confirmation that § 312f of the German Civil Code (BGB) requires) and Art. 6(1)(a) GDPR (supporters wall). We keep payment records as long as tax law requires, currently 8 or 10 years (§ 147 AO, § 14b UStG). Other supporter data is deleted when we no longer need it.

Linking your Discord account

When you are signed in, you can link your Discord account on your account page. We only ask Discord for the scope "identify". We store your Discord user ID and username and revoke the Discord access token immediately. Our Discord bot uses the link to give monthly supporters the Wiki Supporter role. Unlinking deletes the link. The bot runs on a server we rent from OVH in Warsaw, Poland, which has been offline since 12 August 2026.

The cookie rf_discord_state protects this process against forged requests. Discord processes the sign-in on discord.com under its own privacy policy. Legal basis: Art. 6(1)(b) GDPR.

Skin inventory import

When you are signed in, you can import your skin inventory on the skins pages. Only when you click, our server sends your SteamID64 to SCMM (scmm.app), an independent Rust skin database, and asks it which skins you own. SCMM then fetches your public Steam inventory and keeps it under its own terms (see the SCMM privacy policy). We show you the result and do not store it.

We do not know where SCMM is established. Its terms are governed by New Zealand law, and its interface is delivered through Cloudflare, Inc. (USA). So we cannot name an adequacy decision or other safeguards for this transfer. We only make it when you ask for the import, which cannot work without it. Legal basis: Art. 6(1)(b) GDPR (the lookup you asked for).

Streamers page

The streamers page lists Rust streams on Twitch. We fetch public data about them from the Twitch API: streamer name, avatar, stream title, broadcast language, viewer count and thumbnails, and for channels that streamed Rust in the past 7 days, when and for how long and how many views those broadcasts had. We use the viewer and view counts to order the list. This concerns the streamers, not you as a visitor. The data comes from Twitch (Art. 14 GDPR).

The pictures are loaded through rustfront.com, so your browser does not contact Twitch. They are cached for at most 24 hours, as Twitch's developer terms require. The stream data is kept only in our server's memory: at most 10 minutes for live streams and at most 6 hours for the weekly list.

We also keep a short, reviewed list of channels that we leave out or mark, for example because the Rust search returned a stream of another game: the channel's Twitch ID and login and our reason. An entry stays until we no longer need it or the streamer asks us to remove it.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is showing who streams Rust. Streamers can ask to be removed by writing to support@rustfront.com.

Reddit answer bot

We run a Reddit answer bot, which is currently paused. When it runs, it reads new public posts and comments in selected subreddits and may store the Reddit username, the link, the title and a short excerpt to draft an answer from the wiki. Normally a person approves every answer before it is posted, but the bot also has an automatic mode in which it posts answers without that review. Each reply says that it comes from a bot and explains how to opt out.

The bot also reads replies and private messages sent to its Reddit account. It records the usernames of people who opt out. It keeps no copy of other messages: they stay unread in its Reddit inbox for a person to read. The data comes from Reddit (Art. 14 GDPR).

Drafts and the post data behind them are deleted after 90 days. We keep the usernames of people who opted out for as long as the bot runs, so it never replies to them again. The bot runs on a server we rent from OVH in Warsaw, Poland, which has been offline since 12 August 2026.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is answering questions about Rust on Reddit and respecting opt-outs.

Archived game-server data

RustFront ran Rust game servers from May to August 2026. The servers are shut down. If you played on them or used their features, we still hold:

• your SteamID64 and in-game names,
• statistics (kills, playtime, gathering),
• chat logs and positions,
• support tickets, with an email address or Discord ID if you gave one,
• reports, bans, mutes and appeals,
• VIP and Supporter purchases made through PayNow (PayNow was the seller),
• raffle entries and Steam trade URLs,
• map votes.

This data is no longer shown publicly or used.

We keep it only in case the servers return and to handle legal claims. We will review it and delete it by 31 August 2027 at the latest, except records that tax law requires us to keep. Legal basis: Art. 6(1)(f) GDPR (a possible return of the servers and legal claims) and, for tax records, Art. 6(1)(c) GDPR. You can ask for access or deletion at any time.

Email contact

If you email us, we process your message and your address to answer you. Our @rustfront.com mailboxes are hosted by Proton AG in Switzerland; the EU has an adequacy decision for Switzerland. The mailbox of the address in the Impressum is hosted by Google (Google Workspace); where Google processes it in the USA, the EU-U.S. Data Privacy Framework applies (Google LLC is certified).

Legal basis: Art. 6(1)(f) GDPR (answering your message) or, if your email is about a contract, Art. 6(1)(b) GDPR. We delete emails when they are no longer needed; business letters are kept for 6 years, as tax law requires.

AI-written news

The news and devblog digests are written by an AI model (Anthropic's Claude) from public Facepunch sources. No visitor data is sent to Anthropic. These pages carry a visible "Written with AI" label.

Recipients and processors

Within RustFront, your data is seen only by the operator and by people we give admin access to on the site or on our Discord server (for example to moderate comments), and only as far as their task requires. The following recipients also receive personal data:

Authorities receive data only where the law requires it. For example, we must report threats to a person's life or safety to the Federal Criminal Police Office (BKA) under Art. 18 Digital Services Act.

What you publish is visible to everyone: comments, electricity guides with your name, base guides, the Supporter badge and, if you choose it, your name on the supporters wall.

Transfers outside the EU

Some recipients are outside the EU and the EEA. These are the grounds for the transfers:

• The EU-U.S. Data Privacy Framework, an adequacy decision of the European Commission (Art. 45 GDPR, Implementing Decision (EU) 2023/1795). We checked the official list on 29 September 2026: Vercel Inc., Stripe, LLC, Valve Corporation and Google LLC are listed as "Active"; Discord, Inc., Plus Five Five, Inc. (Resend), Fastly, Inc., Akamai Technologies, Inc. and Cloudflare, Inc. as "Active, re-certification under review". Where a provider also uses standard contractual clauses (Art. 46(2)(c) GDPR), they serve as a fallback: in Vercel's data processing agreement, Stripe's Data Transfers Addendum and Resend's data processing agreement, and according to their privacy policies at Discord and Valve.
• Standard contractual clauses (Art. 46(2)(c) GDPR): Supabase Pte. Ltd. (Singapore) is not certified under the Data Privacy Framework. Our database is stored in Frankfurt; access from outside the EU by Supabase or its US support team (Supabase, Inc.) is covered by the standard contractual clauses (Module 2) in Supabase's data processing agreement.
• Adequacy decisions of the European Commission for Switzerland (Proton) and the United Kingdom (Facepunch).
• SCMM: we do not know where SCMM is established, so we cannot name an adequacy decision or other safeguards. We send your SteamID64 there only when you ask for the inventory import, which cannot work without it (see Skin inventory import).

Twitch receives no data about visitors: the pictures on the streamers page come through rustfront.com.

You can get a copy of the standard contractual clauses from us at support@rustfront.com. The current list of certified companies is at dataprivacyframework.gov.

How long we keep data

We delete personal data when it is no longer needed for its purpose and no law requires us to keep it. The periods in detail:

Your rights

Under the GDPR you have the right to:

• access your data (Art. 15),
• have wrong data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict the processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to the processing (Art. 21, see the box below),
• withdraw your consent at any time with effect for the future (Art. 7(3)), for example for the supporters wall,
• complain to a supervisory authority (Art. 77, see Right to complain).

To use your rights, email support@rustfront.com. We may ask you to confirm that you own the Steam account concerned, for example by signing in. We answer within one month.

Deleting your account: on request we delete your account and anonymise your comments and guides, or delete them as well if you ask.

Right to complain

If you think that our processing of your data breaks data protection law, you can complain to a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. You may turn to any EU authority. The authority responsible for us is:

Other information

Do you have to give us data?

You can read RustFront without giving us any data beyond what your browser sends to load pages. Everything else is voluntary: signing in, comments, guides, suggestions, feedback and support. Some functions only work with certain data: without signing in with Steam you cannot comment or become a supporter, and an order for support is cancelled if you do not pay through Stripe. The cancellation and withdrawal forms need your name and email address so we can find the contract and send you a confirmation.

No automated decisions

We make no automated decisions and do no profiling within the meaning of Art. 22 GDPR. We do not sell data and send no newsletters.

Children and young people

Signing in uses your Steam account, so Steam's minimum age applies. If you are under 18, please ask a parent or guardian before you become a Wiki Supporter. Parents and guardians can contact us at support@rustfront.com.

Links to other websites

When you follow a link to another website, that website's privacy policy applies. Skin marketplace links that are labelled as affiliate links carry a RustFront referral code, so the marketplace can pay us a commission if you buy something. The code identifies RustFront, not you, and we pass no information about you to the marketplace.

Changes to this policy

We update this policy when our services or the law change. The current version is always on this page. This version is dated 29 September 2026.