Privacy Policy

The data controller for this website is Apex Rust ("we", "us"). You can reach our data protection team at [email protected].

We collect the following categories of personal data:

• Steam account data: SteamID, display name, and avatar URL (provided by Steam OpenID).
• Authentication tokens: short-lived session cookies used to keep you signed in.
• In-game activity: rewards claimed, points balance, wheel spins, leaderboard rank, and battle pass progress.
• Purchase data: order history, items purchased, and the last 4 digits of payment cards (we never see full card numbers).
• Support tickets: any data you choose to share when contacting us.
• Technical data: IP address, browser type, and timestamps for security and rate limiting.

We process your data on the following legal bases under the GDPR:

• Contract (Art. 6(1)(b)): to deliver purchased packages, fulfill rewards, and operate your account.
• Legitimate interest (Art. 6(1)(f)): to keep the services secure, prevent fraud, and run anti-cheat.
• Legal obligation (Art. 6(1)(c)): to keep tax and accounting records of purchases.
• Consent (Art. 6(1)(a)): for non-essential cookies, analytics, and marketing emails. You can withdraw consent at any time.

We keep account data for as long as your account is active. After account deletion, we erase or anonymize your data within 30 days, except where retention is required by law (e.g. invoices are kept for 10 years under German tax law).

We never sell your data. We only share data with the following categories of processors, each bound by a data processing agreement:

• Payment providers: Stripe and PayPal (for processing payments).
• Hosting: our server and database provider, located in the EU.
• Discord: if you choose to link or contact us through Discord.
• Game server hosts: the Rust server you connect to receives your SteamID for authentication.

We use essential cookies to keep you signed in and remember your language. We do not use advertising trackers. You can review the cookies we set on our cookie policy page.

Under the GDPR you have the right to: access your data, correct inaccurate data, request deletion, restrict or object to processing, data portability, and lodge a complaint with a supervisory authority. To exercise any of these rights, email [email protected] and we will respond within 30 days.

We protect your data with TLS encryption, hashed passwords, prepared statements against SQL injection, rate limiting, and strict server access controls. No system is 100% secure, but we continuously work to keep your data safe.

We may update this Privacy Policy from time to time. The "Last updated" date will reflect the most recent change. We will notify you of material changes on our Discord.

For any privacy-related request, contact [email protected]. You can also reach our postal address listed in the imprint.