Cookie and Local Storage Policy

1. About this policy

1.1 This policy explains which cookies and browser storage RUST50/50 ("RUST50" or "the site") uses at https://rust50.com, what each one does, how long it lasts and how you can clear or block it. The site is operated by Rust50 Entertainment Ltd ("we" or "us").

1.2 It forms part of our Privacy Policy, which explains how we process personal data more generally, including the IP address and request data your browser sends with every request. If this policy conflicts with another document, the order of precedence in clause 1.2 of the Terms and Conditions applies. Under that order, this policy and the Privacy Policy govern personal data, but a specific promotion's own terms, the Promotions and Referral Terms, the AML and KYC Policy and, wherever it is more protective of you, the Responsible Gambling Policy rank above them for the matters they cover.

1.3 In short: the site uses one cookie of its own, three browser storage keys and, where Cloudflare's security features require them, Cloudflare security cookies. Each of them is strictly necessary for the service, remembers a choice you made, or holds information you brought to the site yourself (a referral code from a link). The site sets no advertising, analytics, social media or tracking cookies.

2. What cookies and browser storage are

2.1 A cookie is a small text file that a website asks your browser to store and to send back with later requests to the same website. Cookies can last only for a browsing session or for a set time.

2.2 Browser storage means storage areas that a website's own pages can use in your browser:

• localStorage keeps data with no expiry date until it is deleted by the site, by you or by your browser; and
• sessionStorage keeps data only for the browser tab in which it was created and is deleted when that tab is closed.

2.3 Unlike cookies, browser storage is not sent to the website automatically with each request. It stays in your browser unless the page's code reads it and sends it on. Data protection and ePrivacy rules treat storing or reading information on your device in the same way whichever technology is used, so this policy covers cookies and browser storage alike.

2.4 A first-party cookie or storage key is set under the address you are visiting (rust50.com). A third-party cookie is set under another address. All items in this policy are set under rust50.com. Cloudflare's cookies are set by Cloudflare as our network provider, but under our address.

3. Cookies and storage we use

3.1 This table lists every cookie and storage key the site uses.

4. The session cookie

4.1 When it is set. The server creates a session and sets the rust50.sid cookie the first time your browser requests any page or file from the site, whether or not you sign in, and replaces it with a new one when you sign in (clause 4.3). The cookie is set on that first visit because every session carries a security token that the site checks before accepting any action, and visitors who are not signed in need that protection too, for example when they start the Steam sign-in.

4.2 What it contains. The cookie itself holds only a random, signed session identifier. It does not contain your SteamID64, display name or any other account data. The data linked to the session is held in the server's memory: the security token, the temporary state value used to protect the Steam sign-in (valid for 10 minutes), and, once you sign in, your account identifier. For the owner, the session is also bound to an owner console sign-in, which lasts up to 12 hours.

4.3 Its settings.

• HttpOnly: scripts running on the page cannot read the cookie, which protects it if a page were ever compromised.
• SameSite=Lax: the browser does not send the cookie with requests that other websites trigger in the background, which helps block cross-site request forgery, while still allowing the normal return from Steam's sign-in page.
• Secure: the browser sends the cookie only over HTTPS.
• Path: on rust50.com the cookie applies to the whole site (Path=/). On the old preview address it was limited to the /rust50 path.
• Lifetime: the cookie expires 24 hours after it is set. When you sign in, the old session is replaced by a new one with a new cookie.

4.4 When the session ends. The session ends when its 24 hours run out or when you sign out. Sessions are currently held only in server memory, so all sessions also end whenever the service restarts; you will then simply need to sign in again. Your browser may keep an expired or ended cookie until it removes it, but the server will no longer accept it.

4.5 If you block it. Without this cookie you cannot sign in, create or join a round, chat, save a trade URL or use the Profile page, because the site cannot check the security token. You will see a message such as "Your session check expired. Refresh the page and try again." You can still view the public lobby and the Round checker.

5. Preferences and other browser storage

How the Preferences dialog settings are stored

5.1 The Preferences dialog, opened from "Preferences" in the site footer, has three settings. They are saved together under the localStorage key rust50.preferences as a short text value in JSON format, for example {"reducedMotion":false,"sound":false,"theme":"dark"}:

• theme (Appearance): "light", "dark" (shown as Night) or "system" (Use device setting). The light and night toggle in the page header changes the same value.
• reducedMotion (Reduced motion): true or false. When true, the coin animation is kept to a minimum. The animation is also reduced if your device asks websites for reduced motion, whatever this setting says. The full animation (a spin followed by a slowing landing) lasts several seconds and is cosmetic: the result is fixed before it starts, so this setting never affects a result.
• sound (Result sound): true or false. When true, a sound plays when one of your own rounds finishes.

5.2 Where it is used. The same key is read by the lobby, the Profile page, the legal pages and the owner console, so your appearance choice applies across the whole site. A small script reads the theme before each page is drawn, so the page does not flash in the wrong colours. If you have the lobby open in several tabs, a change made in one of them is applied in the others.

5.3 It stays in your browser. The site's code does not send rust50.preferences to our server, and we cannot see your settings. They apply only to the browser and device in which you set them, and they are not linked to your account: if you sign in elsewhere, you will need to set them again.

5.4 When it is written. The value is written when you change a setting in the Preferences dialog or use the light and night toggle. At present the lobby page also writes the current values, including the defaults, each time it loads and when your device's light or dark setting changes while the lobby is open.

5.5 Defaults. If the key is missing, for example because you cleared it, the site follows your device's light or dark setting, keeps the full coin animation (unless your device asks for reduced motion) and plays no result sound.

Pending referral code

5.6 When you open a referral link of the form profile.html?ref=CODE, the Profile page stores the code (12 to 32 letters and digits) under the sessionStorage key rust50.pendingReferral and fills it into the referral field. This means the code is not lost if you need to sign in with Steam first. The code is sent to our server only when you choose to apply it. The key is deleted when you close the tab, and the Profile page removes it once a referral has been recorded for your account.

Owner console tab

5.7 The sessionStorage key rust50.adminTab is used only on the owner console, which only the site owner can sign in to. It records the name of the console tab the owner last opened (for example players, rounds or audit log) so that a page refresh returns to it. It is deleted when the tab is closed. Players never receive this key.

If browser storage is unavailable

5.8 If your browser blocks storage, for example in some private browsing modes, the site still works. Your preferences then apply only until you leave the page, and a referral code is kept only in the referral link itself.

6. Cloudflare cookies

6.1 Cloudflare provides the site's DNS, content delivery, HTTPS and protection against attacks and automated bots. To tell people apart from bots and to remember that a browser has passed a security check, Cloudflare may set its own cookies on rust50.com. Cloudflare classes all of the cookies it documents as strictly necessary.

6.2 The Cloudflare cookies we expect on rust50.com are __cf_bm (bot management, which expires after 30 minutes of continuous inactivity) and cf_clearance (proof that a challenge was passed). Depending on which Cloudflare features are switched on, Cloudflare can also set other security cookies, such as cookies used for rate limiting, challenge pages, load balancing or waiting rooms. We will list any such cookie in section 3 before we turn on the feature that sets it. No

6.3 Cloudflare cookies are used for security only. We do not use them to identify you, to track you across websites or for analytics. Cloudflare's own privacy policy and cookie documentation explain how Cloudflare processes this data.

6.4 If you block Cloudflare cookies, you may be shown security challenges more often, and some requests may be refused if Cloudflare cannot tell that your browser is not a bot.

7. Why there is no consent banner

7.1 The rule. In the European Union, the ePrivacy Directive (Art. 5(3)) requires consent before information is stored on, or read from, a user's device, unless the storage is needed only to transmit a communication or is strictly necessary to provide a service the user has explicitly asked for. European regulators apply this rule to cookies, localStorage, sessionStorage and similar technologies alike (EDPB Guidelines 2/2023). In the United Kingdom, the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025, contain similar exceptions; since 5 February 2026 they expressly cover storage that is strictly necessary for security, fraud prevention, automatic authentication and remembering choices or details a user has entered on a website.

7.2 Our items fall within the exceptions. European regulators' guidance treats authentication and session cookies, user-centric security cookies and user-interface customisation storage (such as a remembered display choice) as exempt from consent (Article 29 Working Party Opinion 04/2012). On that basis:

• rust50.sid is strictly necessary for authentication and security: the site cannot keep you signed in or block forged requests without it;
• __cf_bm and cf_clearance are strictly necessary for the site's protection against bots and attacks;
• rust50.preferences is a user-interface customisation item that remembers choices you made in the Preferences dialog (see the drafting note in clause 5.4);
• rust50.pendingReferral keeps a code you brought with you from a referral link until you decide whether to apply it (see the drafting note in clause 5.6); and
• rust50.adminTab is used only by the owner on the owner console.

7.3 Result. Because the site uses only these items, it does not show a cookie consent banner. Instead, it tells you about them in this policy, which is linked from every legal page and from the Privacy Policy. Where Curaçao law applies, these items are also necessary for the performance of our contract with you or reflect a choice you made.

8. What we do not use

8.1 The site does not use:

• advertising, retargeting or affiliate tracking cookies;
• analytics tools or analytics cookies, including Google Analytics. Cloudflare can add a web analytics script to sites on its network, but the site's Content Security Policy only allows scripts from the site's own address, so that script is blocked;
• social media pixels, plug-ins or "like" buttons;
• third-party fonts or embedded videos; or
• browser fingerprinting or any other technique to recognise you without cookies.

8.2 Steam. Item icons and avatars are loaded by your browser from Valve's image servers (for example community.cloudflare.steamstatic.com). Those servers receive your IP address and normal request headers; the site tells your browser not to send the address of the page you are on. We do not ask Valve to set cookies through these requests, and any cookie a Steam address sets is governed by Valve's own policies. When you sign in, you are on Valve's own sign-in page at steamcommunity.com, where Valve's cookie policy applies.

9. If analytics or marketing are ever added

9.1 We have no plans to add analytics or marketing cookies. If we ever do, we will not set them until the following are in place:

• this policy and the Privacy Policy are updated first, naming each new cookie or storage key, its provider, purpose, duration and any data sharing or transfer;
• a consent banner asks for your consent before any non-essential item is set or read, with "Reject" as easy to choose as "Accept", no pre-ticked boxes and a separate choice for each purpose;
• you can see and change your choice at any time from a link on every page, and withdrawing consent is as easy as giving it;
• refusing non-essential cookies never stops you from using the site;
• we keep a record of each consent choice, so that we can show that consent was given; and
• no marketing cookie or tracking is used for anyone who is self-excluded or in a cooling-off period, or who we know or suspect is a minor, in line with the CGA's responsible marketing rules.

9.2 In the United Kingdom, the amended PECR allow some statistical and website-appearance storage without consent if users are given clear information and a free, simple way to object. If we ever rely on that exception for UK users, we will explain it here and provide the objection option before the storage is used.

9.3 If the Cloudflare analytics script is ever allowed to run, we will treat it as analytics under this section, not as strictly necessary.

10. How to clear or block cookies and storage

10.1 Clear the site's data. All modern browsers let you delete the cookies and stored data of one website. Typical steps are:

• Chrome and Edge: click the icon to the left of the address bar while on rust50.com, open the site settings or the cookies and site data section, and delete the data for rust50.com.
• Firefox: click the padlock in the address bar while on rust50.com and choose to clear cookies and site data.
• Safari: open Settings (or Preferences), then Privacy, then Manage Website Data, search for rust50.com and remove it.
• Mobile browsers: use the site settings or website data section in the browser's settings.

10.2 Clearing the site's data deletes rust50.sid (which signs you out), rust50.preferences (which resets your preferences to the defaults in clause 5.5) and any sessionStorage keys, and may remove the Cloudflare cookies. You can also reset preferences without clearing anything else by choosing new settings in the Preferences dialog.

10.3 Block cookies. You can set your browser to block all cookies, or cookies for rust50.com only. If you do, sign-in and all actions that need a session will not work (clause 4.5), and Cloudflare challenges may repeat (clause 6.4).

10.4 Private browsing. In a private or incognito window, the browser deletes the site's cookies and storage when you close the window.

10.5 Signing out. Choosing sign out ends your session on our server straight away, even before the cookie expires.

10.6 The old preview address. Before rust50.com, the preview ran at egirl.sx/rust50, which now redirects to rust50.com. Browsers that used the old address may still hold a rust50.sid cookie and rust50.* storage keys for egirl.sx. Browser storage is kept separately for each website address, so those items are not used by rust50.com. You can delete them by clearing the site data for egirl.sx in the same way.

11. Changes and contact

11.1 We will update this policy before we add, remove or change any cookie or storage key, and the version number and effective date at the top will change. Material changes will also be announced on the site.

11.2 Questions about this policy can be sent to privacy@rust50.com. Our full contact details, and your rights over your personal data, are set out in the Privacy Policy.