Privacy Policy

1. Who we are

1.1 This Privacy Policy explains how Rust50 Entertainment Ltd ("we", "us", "our" or "the operator") collects, uses, shares, stores and protects personal data when you use RUST50/50 ("RUST50" or "the site") at https://rust50.com. It covers the coinflip lobby, the Profile page, the Round checker, the public chat, these legal pages and any other page served from rust50.com. The earlier preview address egirl.sx/rust50 now redirects to rust50.com, and this policy also covers personal data that was collected through that address.

1.2 Controller. Rust50 Entertainment Ltd is the controller of the personal data described in this policy. This means we decide why and how that data is processed and we are responsible for it. The operator is registered with the Curaçao Chamber of Commerce under number HE 452139 and its registered address is 28 Omonias Avenue, 1010 Nicosia, Cyprus.

1.3 Privacy contact. For any question about this policy or your personal data, or to exercise any of the rights in section 18, write to privacy@rust50.com. Other contact points are:

• general support and help with rounds or trades: support@rust50.com;
• identity checks, anti-money-laundering (AML) and know-your-customer (KYC) questions: compliance@rust50.com;
• responsible gambling, limits and self-exclusion: responsible-gambling@rust50.com;
• formal complaints, including complaints about how we handle your data: complaints@rust50.com.

1.4 Representatives in the EU and the UK. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to us (see section 8.3), we will appoint a representative in the European Union and in the United Kingdom as those laws require. Our EU representative is Rust50 Entertainment Ltd, Nicosia, Cyprus and our UK representative is Not applicable. You may contact them instead of us about any matter covered by this policy.

1.5 Licence. When the operator holds a licence from the Curaçao Gaming Authority (CGA), its details, including licence number HE 452139, its issue date 5 November 2026 and the validation link https://www.nba.gov.cy, will be published on the Operator and Licence page. Some of the processing described below as happening "at launch" exists because a gaming licence and Curaçao law require it.

1.6 No affiliation with Valve or Facepunch. RUST50 is not affiliated with, endorsed by or sponsored by Valve Corporation or Facepunch Studios. Steam is a trademark of Valve Corporation and Rust is a trademark of Facepunch Studios. Valve is a separate, independent controller of the data it holds about your Steam account (see section 10).

2. Scope and status of this policy

2.1 Who this policy covers. This policy applies to:

• visitors who browse the site without signing in;
• players who sign in with Steam or, in the current test mode, enter the test lobby with a temporary test identity;
• anyone who contacts us by email or through a complaint, request or dispute; and
• the site owner and any staff who use the owner console, to the limited extent described in clause 5.16.

2.2 What this policy does not cover. It does not cover how Valve processes data on Steam (including the Steam sign-in page, Steam inventories, trade offers, Steam Guard and the Steam Community Market), any processing that Cloudflare carries out for its own purposes under its own privacy policy, websites you reach through links on the site, or what other users do with information they see in the public lobby or chat.

2.3 Two stages: the current test mode and launch. The site currently runs as a public test mode. In test mode:

• real Steam trading is disabled: the site does not send or accept Steam trade offers, does not take custody of any item and does not pay out any item;
• rounds are played with simulated items that have no value, cannot be traded and cannot be withdrawn;
• item values are owner reference prices, not live market quotes;
• a visitor can enter the test lobby with a temporary test identity instead of a Steam account; and
• the lobby can show labelled test bots and sample rounds. These are synthetic identities created by the site, not real players, and they never take part in a real-value round or a real draw.

2.4 At launch, real Steam items will be staked and paid out by Steam trade offers, and the law will require additional processing, such as identity verification, age verification, AML screening and responsible-gambling controls. Where this policy describes processing that only happens at launch, it says so ("At launch"). We will update this policy and give notice under section 23 before any such processing starts.

2.5 Other documents. This policy should be read with the Terms and Conditions (the "Terms"), the Cookie and Local Storage Policy, the Anti-Money Laundering and Know Your Customer Policy (the "AML and KYC Policy"), the Responsible Gambling Policy, the Complaints and Dispute Resolution procedure, the Promotions and Referral Terms and the Fairness and Round Verification page. The Terms govern your use of the service. If this policy conflicts with another of these documents, the order of precedence in clause 1.2 of the Terms decides which one applies: (a) a specific promotion's own terms, for that promotion; (b) the Promotions and Referral Terms, for promotions and referrals; (c) the AML and KYC Policy, for identification, screening, monitoring, reporting and record keeping; (d) the Responsible Gambling Policy, wherever it is more protective of you; (e) this policy and the Cookie and Local Storage Policy, for personal data; (f) the Complaints and Dispute Resolution procedure, for complaint handling; and otherwise the Terms.

2.6 Language. This policy is written in English. Where we offer the site to players in a market whose language is not English, we will publish this policy in that language as well. If the versions differ, the English version applies unless the law of your country requires otherwise.

3. Definitions

3.1 In this policy:

• Personal data means any information relating to an identified or identifiable living person, such as a SteamID64, a display name linked to an account, an IP address or the items a particular account staked.
• Processing means anything done with personal data, including collecting, storing, using, disclosing, publishing and deleting it.
• Processor means a company that processes personal data on our behalf and only on our instructions, such as our hosting provider.
• Independent controller means an organisation that decides for itself why and how it processes data, such as Valve for your Steam account.
• SteamID64 means the 17-digit public number that identifies a Steam account.
• Display name and avatar mean the public profile name and profile picture of your Steam account (or, in test mode, the name you choose for a test identity).
• Trade URL means the Steam trade offer link you can save on the site so that trade offers can be sent to your Steam account. It contains your Steam account's partner number and a token.
• Round means one coinflip game between a creator and a joiner. Each round has a random ten-digit public round number.
• Server seed, client seed, nonce and roll are the values used by the provably fair calculation described on the Fairness and Round Verification page.
• Test mode means the current public test mode described in clause 2.3. Launch means the point at which real Steam trading is enabled.
• GDPR means Regulation (EU) 2016/679. UK GDPR means the version of the GDPR that applies in the United Kingdom.
• Curaçao data protection ordinance means the Curaçao National Ordinance Personal Data Protection (Landsverordening bescherming persoonsgegevens), A.B. 2010 no. 84.
• LOK means the National Ordinance on Games of Chance (Landsverordening op de kansspelen), P.B. 2024 no. 157. CGA means the Curaçao Gaming Authority, the licensing authority and supervisor for games of chance in and from Curaçao.
• NOIS means the National Ordinance on Identification of Clients when Rendering Services (Landsverordening identificatie bij dienstverlening), P.B. 2017 no. 92, as amended, and NORUT means the National Ordinance on the Reporting of Unusual Transactions (Landsverordening melding ongebruikelijke transacties), P.B. 2017 no. 99, as amended. FIU means the Financial Intelligence Unit of Curaçao (FIU Curaçao).
• CGA AML Regulations means the CGA Regulations for the Combating of Money Laundering, the Financing of Terrorism and Proliferation (November 2026).
• KYC and CDD (customer due diligence) mean checks of who a player is, where they live and, where required, the source of their funds.

4. Summary

4.1 This summary is for convenience only; the full policy below applies.

• You sign in on Steam's own page. We never see or store your Steam password or Steam Guard codes.
• Rounds and chat are public by design: your display name, avatar, items, values and results are visible to anyone, and your SteamID64 is included in the public round data.
• We use one session cookie and three browser storage keys, and no advertising or analytics cookies. Cloudflare, our network provider, may also set security cookies.
• At launch, Curaçao AML law requires us to keep identity and transaction records for at least five years.
• We do not sell personal data or send marketing. You can exercise your rights by writing to privacy@rust50.com.

5. Personal data we collect

5.1 The table below lists every category of personal data the site processes today and the additional categories that will be processed at launch. Clauses 5.2 to 5.19 explain each category in detail.

Data processed now

5.2 Steam account data. When you choose "Sign in with Steam", your browser is sent to Steam's own sign-in page at steamcommunity.com. You enter your Steam credentials there, on Valve's site, never on ours. Steam then sends your browser back to us with a signed OpenID confirmation of your SteamID64. Our server checks that confirmation against a one-time state value that was stored in your session and is valid for 10 minutes. If it is valid, our server asks the Steam Web API for your public profile summary and stores:

• your SteamID64;
• your Steam display name, with control and text-direction characters removed and cut to 80 characters;
• the address of your Steam avatar image, accepted only if it is a secure link on Steam's image servers;
• the time your account record was created on our site and the time of your most recent sign-in; and
• the time your Steam identity was verified through this sign-in process.

Your display name and avatar are refreshed each time you sign in. The Steam Web API's profile summary can also contain other fields that you have chosen to make public on Steam, such as a real name or a country; our server reads only the display name and avatar from it and does not store or use the other fields. We do not receive your Steam password, Steam Guard codes, the email address or phone number registered with Steam, your Steam friends list, your Steam Wallet balance or any payment information held by Valve.

5.3 Test identity data (test mode only). In test mode, "Enter test lobby" creates a temporary test identity that is not linked to Steam. We store a random identifier, the test display name you type (up to 20 letters, digits, spaces, underscores or hyphens), a generic avatar, a placeholder trade URL that cannot receive items, and the creation and last sign-in times. Please do not use your real name or any other private information as a test display name, because it is shown publicly.

5.4 Trade URL. You may save your Steam trade URL on the Profile page so that, at launch, trade offers can be sent to your Steam account. The trade URL identifies your Steam account and contains a token that allows trade offers to be sent to you. We store only the latest trade URL you save; saving a new one replaces the old one. Your trade URL is visible only to you and to the operator. A trade URL must belong to your signed-in Steam account: the site checks that its partner number matches your SteamID64. In the current test mode, the Profile page does not offer trade URL entry and no trade offer is ever sent to a saved trade URL.

5.5 Account status and moderation data. For each account we store whether it is banned and, if it is muted in chat, the time the mute ends. Mutes last 1 hour, 24 hours or 7 days. Every mute, ban or reversal is written to an audit log together with the account it concerns, the reason written by the owner (up to 500 characters), the account status before and after the action, the time and the identity of the owner who acted. A reason may describe or quote the chat message or behaviour that led to the action.

5.6 Inventory data. When you open your inventory on the site, our server requests your Rust inventory (Steam app 252490, context 2) from Steam's public inventory endpoint using your SteamID64. Steam returns, for each item, its asset ID, class ID and instance ID, its name and market name, its icon and whether it is tradable. We attach a USD value from our pricing source, the Steam Community Market; in the current test mode that value is an owner reference price, not a live market quote. The inventory is held in server memory for up to 60 seconds so that repeated views do not overload Steam. It is not written to our database unless you stake items in a round (clause 5.7). Your Steam inventory must be set to public on Steam for this to work. In test mode, a Steam-verified player's real inventory can be read for display only; no item is moved and real items cannot be staked.

5.7 Round records. For every round we store:

• the round number and an internal round ID;
• the account identifiers (SteamID64 or test identifier) of the creator, the joiner and the winner, and the side the creator picked;
• each item staked by each side: asset IDs, class and instance IDs, names, icons and the USD value used, and whether it was taken as part of the house fee;
• each side's total value, from which the pot value and each player's win chance are calculated;
• the server seed, its SHA-256 hash (published before the round), the client seed, the nonce and the roll;
• the fee value, the payout value and, at launch, the IDs of the deposit, join, refund and payout trade offers; and
• the times the round was created, opened, joined, started its countdown and finished, the deposit and join deadlines, and any error or review status.

Round records are the evidence that a round was played fairly and settled correctly. Their fairness values (seeds, nonce, roll, values and result) are never rewritten after the round. See clause 13.4 for how we reconcile this with deleting personal data.

5.8 Trade offer records. At launch, for each Steam trade offer that the operator's bot accounts send or receive, we store the Steam offer ID, the round it belongs to, your SteamID64, the type of offer (deposit, join, refund or payout), its state (for example sent, accepted, declined or failed), the value of the items and the times it was created and last updated. If a payout offer fails or is not accepted within 3 days, the record shows this so that the payout can be resent.

5.9 Referral data. Each account has a referral code, created automatically the first time you open your Profile page, which is shown there and in a referral link of the form profile.html?ref=CODE. We store the code, the account it belongs to and the time it was created. When a new account applies another user's code, we record which account referred which, and when. A code can be applied only once per account, and self-referrals and repeat applications are refused. The referrer sees only the number of accounts that applied their code; the referred user sees only the code they applied. A "2.5%" promotional eligibility field exists in the code but is inactive: no rewards are credited and it never changes odds.

5.10 Steam display-name checks. On the Profile page, a Steam-verified player can ask us to check whether their Steam display name contains the tag "rust50.com". When you ask, our server reads your current public display name from the Steam Web API and stores your SteamID64, the name it read, the result (tag present, tag missing or Steam unavailable) and the time. Only your latest check is kept; a new check overwrites it. A result counts as current for 5 minutes, and you can repeat the check after 60 seconds. The check exists only for possible future promotion eligibility. No promotion is attached to it and it gives no reward. It is not available for test identities.

5.11 Chat messages. When you send a chat message, we process your display name, the message text (1 to 280 characters, no links), the time and a random message ID. Messages are broadcast at once to everyone connected to the lobby. The server keeps only the latest 50 messages, in memory, so that people who connect can see recent chat. Older messages are dropped as new ones arrive, and all messages disappear when the service restarts. Chat messages are not written to our database. To enforce the limit of 3 messages per 10 seconds, the server keeps a short-lived counter linked to your IP address (clause 5.12).

5.12 Technical and security data. Every time your browser connects to the site, the following data is processed:

• Network data: your IP address, the time of the request, the page or API path requested together with any query string (which can contain, for example, a referral code from a referral link, or the Steam sign-in return data that includes your SteamID64), the HTTP method, the response status and size, and the user agent string sent by your browser. Cloudflare processes this data first (section 11), and our web server and reverse proxy record it in access logs.
• Rate-limit counters: to stop abuse, the server counts requests per IP address in memory for short windows: 20 sign-in and sign-out requests per minute, 30 round actions, trade URL saves and requests to the public verification endpoint per minute, 20 Profile changes per minute, 20 inventory requests per minute and 3 chat messages per 10 seconds. These counters expire with their window and are lost when the service restarts.
• Live connection data: the lobby uses a live connection to show rounds and chat in real time. The server sees the IP address of each connection. It publishes only the total number of connections ("connected"), never who is connected.
• Application error logs: if a request fails, the server writes a short technical message. These logs are designed not to record request bodies, sign-in codes or trade URLs.

5.13 Session data. On your first visit, the server creates a session and sends your browser the rust50.sid cookie, which is replaced with a new one when you sign in (see the Cookie and Local Storage Policy). The session is held in server memory and contains a random session identifier, a security token used to block cross-site request forgery (CSRF), the temporary Steam sign-in state value and, once you sign in, your account identifier. Sessions last up to 24 hours and end when you sign out. Because sessions are currently held only in server memory, they also end whenever the service restarts.

5.14 Browser storage. The site stores your display preferences (theme, reduced motion and result sound), a referral code waiting to be applied and, for the owner only, the last owner console tab. This data stays in your browser and the site does not send it to our server. A referral code is sent to us only when you choose to apply it. Details are in the Cookie and Local Storage Policy.

5.15 Correspondence. When you email us, we process your email address, the name you use, the content of your message, any attachments and any account details you give us, such as your SteamID64 or round numbers. We also keep our replies.

5.16 Owner console data. The owner console is used only by the site owner. To sign in, the owner requests a one-time code that is emailed to the owner's address. We store a hashed copy of the code, its expiry (5 minutes), the number of attempts and a hashed binding to the owner's browser session; an owner session lasts up to 12 hours. Unauthenticated owner sign-in attempts are limited per IP address, using a keyed hash of the IP address rather than the address itself, for 15 minutes. Owner sign-ins and sign-outs are also written to the audit log. This data concerns the owner, not players. The owner console lets the owner view the player list (display name, SteamID64 or test identifier, avatar, ban and mute status, and account creation and last sign-in times), mute and ban players with a recorded reason, view rounds read-only and view the audit log. It cannot change results, odds, seeds, item values, balances or payouts. In test mode only, it also has test tools that create simulated items and simulated test events for the owner's own test account; these never involve real items or real players.

Data processed at launch

5.17 Identity and age verification. At launch, Curaçao AML rules require us to collect at least your full name, permanent residential address and date of birth when you open an account for real-value play, and to verify your identity once the thresholds in the AML and KYC Policy are reached. Verification may involve: a passport, identity card or driving licence; your place of birth, nationality and identity number; proof of address issued within the last 6 months; and a live photo or video with liveness detection that is matched against your document photo. We will use an EU-approved identity verification provider to carry out these checks. Face matching creates biometric data, which receives extra protection (clause 8.7). Accounts that were used in test mode must complete this onboarding before any real trade.

5.18 AML, sanctions and fraud data. At launch we will screen players against sanctions lists (including the UN Security Council Consolidated List, the EU consolidated list and the Dutch national terrorism list) and politically exposed person (PEP) lists when they register, periodically afterwards and before payouts. We will monitor the value of items you deposit, win and withdraw, and keep records of alerts, reviews, enhanced due diligence (for example source-of-funds or source-of-wealth information and declarations), and any decision to freeze, block or close an account. Where the law requires it, we report unusual transactions to the FIU. We also record signals of fraud and collusion, such as multiple accounts used by one person, linked accounts that repeatedly play each other, and repeated create-and-cancel cycles.

5.19 Responsible gambling, Terms acceptance and promotions. At launch we will also process: the player-protection tools described in the Responsible Gambling Policy that you set or that are applied to you, namely deposit, loss, single-stake and session limits, reality checks, cooling-off periods (time-outs) and self-exclusions (including the identifiers used to stop excluded players from opening new accounts, such as SteamID64 and trade URL), indicators of risky play and records of any contact or intervention by our staff; a record of each version of the Terms you accepted or refused and when; and, if any promotion is launched, your entries, eligibility and any prize. The planned "Mazalito" giveaway exists only as a test feature in the preview; in the preview it stores test entries (account identifier, display name, entry time and a flag marking labelled test bots) and draws a test winner from them. In the preview, only labelled test bots and the owner's own test account can enter, because the qualifying deposit can only be simulated by the owner; no prize has any value. Labelled test bots will never enter a real draw.

Data we do not collect

5.20 We do not collect or store: your Steam password or Steam Guard codes; payment card, bank account or cryptocurrency wallet details (the site accepts items only and has no cash or crypto deposits or withdrawals); your precise location; your contacts or Steam friends list; advertising identifiers; or data from analytics, advertising or social media trackers. We do not use browser fingerprinting. At launch we may use the country associated with your IP address to apply restricted-territory rules (clause 7.9).

6. Where personal data comes from

6.1 We obtain personal data from the following sources:

• You, when you sign in, choose a test display name, save a trade URL, select items, create or join a round, choose a client seed, apply a referral code, send a chat message, change your preferences or contact us.
• Valve (Steam), which confirms your SteamID64 at sign-in, returns your public display name and avatar through the Steam Web API, returns your public Rust inventory and, at launch, reports the state of trade offers and any trade holds on your account.
• Your device and browser, which automatically send your IP address, user agent and request details with every request.
• Our own systems, which generate round numbers, server seeds, rolls, results, fee selections, referral codes, rate-limit counters, session identifiers and security tokens.
• The owner, who records moderation actions and reasons.
• Other users, for example when another user shares a referral link that leads you to apply their code, or when a user reports your conduct in chat to us.
• At launch, an EU-approved identity verification provider, sanctions and PEP screening sources, and public sources used for enhanced due diligence.
• Authorities, such as the CGA, the FIU, police or courts, when they send us a lawful request or instruction about an account.

7. How we use personal data

7.1 To provide your account. We use your Steam account data or test identity to sign you in, keep you signed in for up to 24 hours, show your display name and avatar in the lobby and on your Profile page, and show you your own rounds in "My games".

7.2 To run rounds. We use your inventory data, item values and round records to let you pick up to 25 items per side, check that the creator's stake is between USD 1 and USD 5,000 in item value, check that a joiner's stake is within 6% above or below the creator's stake (so a joiner's stake of roughly USD 0.94 to USD 5,300 is possible), apply the 90-second deadline for accepting deposit and join trade offers, run the 4-second countdown and the coin animation (a spin followed by a slowing landing; the animation lasts several seconds and is cosmetic, because the result is fixed before it starts), determine the winner with the provably fair calculation, select the house fee items (whole items from the pot worth as close as possible to, but not more than, 8% of the pot value, with the 8% cap calculated to the nearest cent; the fee can be lower, including zero) and pay out the rest of the pot to the winner. We also use these records to remove a round when you decline its deposit trade offer in Steam or let it expire after 90 seconds (nothing is staked in that case), to return items when you cancel your own open round with the "Cancel round" button, and to return items when a round cannot be completed.

7.3 To prove fairness. We publish the SHA-256 hash of the server seed before each round and the server seed itself after it, together with the client seed, nonce, roll and values, so that anyone can recompute the result with the public Round checker. This requires the round record, including the participants' values, to remain available and unchanged.

7.4 To hold and transfer items (at launch). We use your SteamID64, trade URL and trade offer records to send deposit and join trade offers from the operator's bot accounts, credit items only after Steam has settled the trade, hold items during a round, send payouts and refunds, resend failed payouts and reconcile the items held by each bot account.

7.5 To show the public lobby. We use round records and your display name and avatar to show open, live and recently finished rounds and recent results to all visitors. See section 9.

7.6 To run and moderate chat. We use chat messages to show them to everyone in the lobby, enforce the chat rules (1 to 280 characters, no links, at most 3 messages per 10 seconds) and, where needed, mute a player for 1 hour, 24 hours or 7 days or ban them, recording the reason.

7.7 To run referrals and check promotion eligibility. We use referral data to show you your code and the real number of accounts that applied it, to apply a code once, and to refuse self-referrals and repeats. We use Steam name checks only to record whether your display name carries the "rust50.com" tag, for possible future promotion eligibility. Neither currently gives any reward.

7.8 To keep the site secure and prevent abuse. We use technical data, session data and rate-limit counters to protect accounts and the service against automated abuse, cross-site request forgery, denial of service and fraud; to investigate incidents; and to enforce bans. At launch we will also use round, trade and account data to detect collusion, multiple accounts, account takeovers and attempts to move value between linked accounts.

7.9 To comply with the law (at launch). We will use identity, AML, responsible-gambling and transaction data to: verify that you are at least 18 (or the higher age that applies where you live); carry out KYC and CDD under NOIS and the CGA AML Regulations; screen against sanctions and PEP lists; monitor transactions and report unusual transactions to the FIU under NORUT; apply limits, cooling-off and self-exclusion under the LOK and the CGA Responsible Gaming Policy; keep the records and make the reports the CGA requires; block players from restricted territories; and handle complaints and alternative dispute resolution (ADR) under LOK art. 5.3.

7.10 To answer you. We use correspondence to answer questions, resolve trade problems, handle complaints and respond to requests under this policy.

7.11 To remember your preferences. Your browser uses the stored preferences to apply your theme, reduced motion and result sound settings. This happens in your browser; we do not receive these settings.

7.12 To maintain and fix the service. We use access and error logs to find and fix faults and to understand load. We do not use analytics or tracking tools for this.

7.13 To establish, exercise or defend legal claims, including disputes about rounds, trades, fees, bans or payouts.

7.14 Business changes. If the operator's business is sold, merged or restructured, personal data may be transferred to the buyer or successor, which must continue to protect it in line with this policy and the law. Where a gaming licence is involved, such a change may need prior CGA consent.

7.15 What we do not do. We do not sell or rent personal data, we do not use it for advertising, we do not build marketing profiles and we do not send marketing messages (section 21).

8. Legal bases

Curaçao law

8.1 Our processing is governed by the Curaçao data protection ordinance, and a CGA licence requires player personal data and transactions to be processed and stored securely in line with it. That ordinance permits processing on grounds that include the unambiguous consent of the person concerned, the performance of a contract with that person, and compliance with a legal obligation of the controller. The ordinance is modelled on the former Dutch personal data protection act.

8.2 The table in clause 8.3 shows the Curaçao ground we rely on for each purpose. Where Curaçao law allows it, we also rely on our legitimate interests in security, fraud prevention and defending claims.

EU GDPR and UK GDPR

8.3 The GDPR can apply to a controller outside the EU, such as the operator, when it offers services to people who are in the EU or monitors their behaviour there (GDPR Art. 3(2)). The UK GDPR has an equivalent rule for people in the United Kingdom. If you are in the EU or the UK and those rules apply to our processing of your data, the legal bases in the table below apply in addition to Curaçao law. The Terms list the countries from which play is not permitted.

8.4 Our legitimate interests. Where we rely on legitimate interests, those interests are: keeping the service and its users safe from fraud, abuse, account takeover and attacks; making every round independently verifiable; keeping chat usable and free from abuse; meeting the conditions of our gaming licence and the expectations of the CGA; protecting players, including vulnerable players and minors; and establishing or defending legal claims. We have weighed these interests against your rights. We limit the data to what each purpose needs, keep access to the owner and authorised staff, and apply the retention periods in section 13. You can object to processing based on legitimate interests (clause 18.8).

8.5 Curaçao legal obligations and the GDPR. Under the GDPR, the "legal obligation" basis can only be used for obligations laid down by EU law or the law of an EU member state (GDPR Art. 6(3)). Curaçao's AML and gaming laws are neither. For players to whom the GDPR applies, we therefore rely on our legitimate interests, and on the necessity of the processing for our contract with you, to carry out the KYC, AML, sanctions, age-verification, responsible-gambling and regulatory processing that Curaçao law requires of us. We have documented why this processing is needed and proportionate. The UK GDPR has an equivalent rule.

8.6 Consent. Where we rely on your consent, we will ask for it clearly and separately, and you can withdraw it at any time by writing to privacy@rust50.com or, where offered, through a setting on the site. Withdrawing consent does not affect processing that took place before you withdrew it.

8.7 Special category and criminal offence data. Biometric data used to identify you, such as a face match against your identity document, is special category data under the GDPR. We will only use it with your explicit consent (GDPR Art. 9(2)(a)) and, where the law allows, we will offer an alternative verification method that does not use biometrics. Sanctions screening and enhanced due diligence can reveal information about alleged criminal offences. The GDPR restricts the processing of such data (GDPR Art. 10). We will process it only as far as Curaçao AML law requires, keep it strictly confidential and limit access to our compliance officer.

8.8 If you do not provide data. Signing in with Steam is necessary to play with real items; without it you can only browse the public lobby (or, in test mode, use a test identity). At launch, if you do not provide the identity information the law requires, we cannot let you deposit, play or withdraw, and where AML rules require it we must freeze or close the account. Giving a trade URL is necessary to receive payouts at launch.

9. What other users can see

9.1 RUST50 is a public peer-to-peer game. The following information is visible to anyone who visits the lobby or uses the Round checker, whether or not they are signed in:

• for each open, live or recently finished round: the round number, the display name and avatar of the creator and of the joiner, the side each player is on, the items each side staked with their names, icons and values, each side's total, the pot value and each player's win chance;
• the round's status, countdown and deadlines;
• after the round: the winner's display name and avatar, the fee value, the payout value and which items were taken as the fee; and
• the round's fairness data: the server seed hash before the round, and after it the revealed server seed, client seed, nonce and roll.

9.2 SteamID64 in public round data. The round data that the site sends to every visitor's browser includes the SteamID64 of the creator, the joiner and the winner, even where the page does not display it. A SteamID64 is already public on Steam and can be used to find your public Steam profile. If you do not want your Steam account to be linked to your play on RUST50, do not play.

9.3 History and Round checker. The lobby shows completed public rounds from the last 10 minutes and a short list of recent results. The Round checker lets anyone look up any round by its ten-digit round number for as long as the round record is kept (section 13), and shows the commitment before the result and the revealed seed after it.

9.4 Chat. Chat messages, with your display name and the time, are shown to everyone in the lobby as soon as you send them. Anyone can copy or screenshot them, and we cannot recall a message once it has been sent, even after it has dropped out of the latest 50 messages.

9.5 Connection count. The lobby shows the total number of live connections. It does not show who is connected.

9.6 What is not public. We do not show other users your trade URL, your moderation history, the reasons for any mute or ban, the referral relationships of your account, the results of your Steam name checks, your browser preferences, your session data, your correspondence with us or (at launch) any identity, AML or responsible-gambling data. Other users can, however, notice that a muted player is not chatting or that a banned player is absent. The site does not show your Steam inventory to other users, but Steam itself may show it if your inventory is public on Steam.

9.7 Referral links. Your referral link contains your referral code. Anyone you share it with can see the code, and a user who applies it is shown the code, not your display name, on their Profile page.

9.8 Your display name. Your display name comes from Steam. If you change your Steam display name and sign in again, the site stores the new name and generally shows it on your rounds from then on, including older rounds. Choose a display name you are comfortable showing publicly, and do not put private information in it.

9.9 Test identities. In test mode, the lobby can show labelled test bots and sample rounds. They are synthetic identities created by the site to demonstrate the game. They do not relate to any real person and they are never shown as real players. The Mazalito test panel shows visitors the display names of the current and most recent test entrants and the test winner, each labelled as a test entry.

10. Steam, Valve and Facepunch

10.1 Valve is an independent controller. Valve Corporation operates Steam and decides for itself how it processes the data in your Steam account, on its sign-in page, in your inventory, in trade offers, in Steam Guard and on the Steam Community Market. Valve's own privacy policy and terms govern that processing. We are not responsible for it and we cannot change it.

10.2 What we receive from Valve. We receive your SteamID64 (confirmed through OpenID), your public display name and avatar (from the Steam Web API), your public Rust inventory (from Steam's public inventory endpoint), the result of any display-name check you request and, at launch, the state of trade offers and information about trade holds or restrictions that affect them.

10.3 What Valve can learn from your use of the site. Valve can see that you started a sign-in to RUST50 from its sign-in page, because the request names our site as the place to return to. At launch, Valve will see every trade offer between your Steam account and the operator's bot accounts, because those trades take place on Steam and must be confirmed by you with Steam Guard. Item icons and avatars on the site are loaded by your browser directly from Valve's image servers (for example community.cloudflare.steamstatic.com), so those servers receive your IP address and normal request headers. The site tells browsers not to send the address of the page you are viewing to other websites as a referrer.

10.4 Steam trade rules. Trades need Steam Guard confirmation, and Steam trade holds or restrictions on your account can delay or block deposits and payouts. Valve may restrict, delay or reverse trades or restrict accounts under its own terms, which we do not control. The Terms explain what this means for your rounds and items.

10.5 Steam Web API terms. We use the Steam Web API under Valve's terms of use. In line with those terms, we never ask for, intercept or store your Steam password, we tell you in this policy which Steam data we store (clauses 5.2 to 5.10), and we store Steam data only in the countries listed in clause 12.1.

10.6 Facepunch. Rust items are created by Facepunch Studios. We do not share personal data with Facepunch, and Facepunch does not share personal data with us.

11. Who we share personal data with

11.1 We share personal data only with the recipients below, only as far as each one needs it, and only for the purposes described in this policy.

11.2 Regulators and authorities. At launch, we will share personal data with:

• the CGA, which licenses and supervises the operator. It may inspect player, game and financial records, and we must send it periodic reports, incident reports and, on request, records about specific players or rounds;
• the FIU, to which we must report unusual transactions without delay;
• police, prosecutors and courts, when they make a lawful request or order; and
• data protection supervisory authorities, when they investigate a complaint or exercise their powers.

11.3 Dispute resolution. If you escalate a complaint to alternative dispute resolution, we will share the relevant records (for example your account details, the round and trade records and our correspondence) with the Cyprus Consumer Protection Service (Ministry of Energy, Commerce and Industry), which handles the dispute independently and free of charge to you.

11.4 Testing, audit and advisers. At launch, a CGA-approved testing laboratory engaged to certify our game (the game has not been certified yet), the independent auditor of our AML programme, the independent experts the CGA may require, our compliance officer (who may be an outsourced professional), and our lawyers and accountants may see personal data where their work requires it. They are bound by confidentiality.

11.5 Other users. The public information described in section 9 is shared with everyone who visits the site.

11.6 Business transfers. See clause 7.14.

11.7 Requests from authorities. We check that each request from an authority has a legal basis and disclose only what it requires. Where the law forbids it, we will not tell you about a request or a report. In particular, Curaçao AML law prohibits us from telling anyone that an unusual transaction report has been or will be made.

11.8 No sale of data. We do not sell, rent or trade personal data, and we do not share it with advertisers, data brokers or social media platforms.

12. International transfers and storage locations

12.1 Where data is stored. Personal data processed by the site is stored or handled in the following places:

• the European Union, where our server and database are hosted by an EU data centre operator;
• Cloudflare's global network, which passes and protects all traffic and may briefly process it in the data centre nearest to you;
• the United States, where Valve holds the Steam data it controls;
• at launch, Curaçao, because the CGA requires critical player, game and financial records to be accessible to it through a server in a Tier-IV certified data centre in Curaçao; and
• at launch, the locations used by an EU-approved identity verification provider, which we will list here before identity checks begin.

12.2 Curaçao and the EU. Curaçao is part of the Kingdom of the Netherlands but is not part of the European Union, and the European Commission has not decided that Curaçao provides an adequate level of data protection.

12.3 Data you send us directly. When you, while in the EU, send personal data directly to us, that is not itself an international transfer under Chapter V of the GDPR; instead, where the GDPR applies, we are directly bound by it. When we pass that data on to a processor in another country outside the European Economic Area, we protect it with an adequacy decision of the European Commission where one covers the recipient or, otherwise, with the European Commission's standard contractual clauses and any additional measures needed.

12.4 The United Kingdom. For data subject to the UK GDPR, we use the equivalent safeguards recognised under UK data protection law.

12.5 Curaçao law. The Curaçao data protection ordinance is reported to allow transfers of personal data only to countries with an adequate level of protection, unless an exception applies or a permit has been granted by the Curaçao supervisor. We will rely on such an exception or permit where required.

12.6 You can ask us for a copy or summary of the safeguards we use for any transfer by writing to privacy@rust50.com. We may redact commercial terms.

13. How long we keep personal data

13.1 Principles. We keep personal data only for as long as we need it for the purpose for which we collected it, or for longer where the law requires us to. When the period ends, we delete the data or anonymise it so that it can no longer be linked to you. Where several periods apply to the same record, the longest one applies.

13.2 Retention periods.

13.3 When the five-year periods start. For transaction data, the period starts on the date of the transaction (for example the deposit, round or payout). For CDD data and the account record, it starts when the business relationship ends, which is when your account is closed by you or by us, including when it is closed as inactive under Terms clause 17. For the moderation audit log, it starts when the account concerned is closed, but each entry is in any case kept for at least five years from its date.

13.4 Fairness records and deletion. We never rewrite the fairness values of a finished round: its seeds, nonce, roll, values and result stay exactly as they were. When the retention period for a round's personal data ends, we remove or replace the account identifiers linked to it (such as the SteamID64), which does not alter any value used in the fairness calculation. The round number, seeds, roll and values may then remain available in the Round checker as an anonymised record.

13.5 Legal holds. We may keep data longer than the periods above when we are required to by an authority, when it is needed for an ongoing investigation, complaint, dispute or legal claim, or while an account is frozen under AML rules. We delete it when the hold ends.

13.6 Deletion requests. If you ask us to delete your data, we will delete what we are allowed to delete and tell you what we must keep, for how long and why (clause 18.5).

14. Automated decisions and profiling

14.1 Today. The site does not make any decision about you based solely on automated processing, including profiling, that has a legal effect on you or affects you in a similarly significant way.

14.2 Game rules applied automatically. Some rules are applied automatically and in the same way to everyone: the provably fair calculation, the value, item and deadline limits and the fee rule described in clause 7.2, the rate limits and the chat filters. These are rules of the game or of the service, not assessments of you. In particular, the winner of a round is never determined by who you are or how you have played before.

14.3 Moderation. Mutes and bans are decided by a person (the owner), with a recorded reason. They are not decided automatically.

14.4 At launch: fraud, AML and responsible-gambling screening. At launch we will use automated tools to screen players against sanctions and PEP lists, to monitor item values deposited, won and withdrawn against the AML thresholds, to detect possible multiple or linked accounts and collusion, and to flag patterns of play that may indicate gambling harm. These tools raise alerts for review. Some consequences follow automatically because the law requires them; for example, when your cumulative deposits and withdrawals reach the CDD threshold, further deposits and withdrawals are blocked until identity verification is complete. Decisions to refuse or close an account, to withhold a payout other than temporarily while checks are completed, or to start an operator-initiated exclusion are reviewed by a trained person before they are taken.

14.5 Your rights. Where the GDPR or UK GDPR applies and a decision based solely on automated processing significantly affects you, you can ask for a person to review it, give your point of view and contest the decision (clause 18.9).

15. Security

15.1 Measures in place. We protect personal data with technical and organisational measures that include:

• Encryption in transit: the site is served only over HTTPS, and the session cookie is marked Secure so that browsers send it only over HTTPS.
• Session protection: the session cookie is HttpOnly (scripts on the page cannot read it) and SameSite=Lax, sessions are held in server memory rather than on disk, and they expire after 24 hours.
• Cross-site request forgery (CSRF) protection: every request that changes something must carry a security token tied to your session, and requests from other sites are refused.
• Sign-in protection: sign-in happens on Steam's own page, the returned OpenID assertion is checked against a single-use state value that expires after 10 minutes, and we never handle your Steam password.
• Rate limits on sign-in, writes, inventory requests, chat and owner sign-in attempts.
• Content Security Policy: the site loads scripts only from its own address, cannot be embedded in other sites' frames, and limits where images and connections can come from.
• Owner-only administration: the owner console requires a one-time code sent by email, which is stored only as a hash, expires after 5 minutes and is limited in attempts. Owner sessions last up to 12 hours. The console cannot change results, odds, seeds, item values, balances or payouts, and every moderation action is written to an audit log with a reason.
• Careful logging: application logs are designed not to record request bodies, sign-in codes or trade URLs.
• Prepared database statements to prevent injection attacks.

15.2 What you can do. Protect your Steam account with a strong password and the Steam Guard Mobile Authenticator. Check that the address bar shows steamcommunity.com before you enter your Steam credentials, and rust50.com before you use the site. At launch, accept only trade offers from the official bot accounts shown on the site and check every item in a trade offer before confirming it in Steam. Sign out on shared devices. Never share Steam Guard codes with anyone, including anyone claiming to be from RUST50: we will never ask for them.

15.3 No system is completely secure. We cannot guarantee that data will never be accessed without authorisation. If you believe your account or data has been compromised, contact support@rust50.com at once.

16. Personal data breaches

16.1 If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, we will act at once to contain it, assess the risk to the people affected and fix the cause.

16.2 At launch, we will report security incidents to the CGA within 24 hours as our licence conditions require.

16.3 Where the GDPR or UK GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach (GDPR Art. 33), unless the breach is unlikely to result in a risk to people's rights and freedoms.

16.4 Whether or not the law requires it, we will tell you without undue delay if a breach is likely to put your rights and freedoms at high risk, explaining what happened, what data was involved, what we have done and what you can do to protect yourself.

16.5 We keep a record of every personal data breach, its effects and the action taken.

17. Children and age limits

17.1 RUST50 is only for adults. You must be at least 18 years old, or older if the age of majority or the legal gambling age where you live is higher. Curaçao law prohibits giving minors the opportunity to play (LOK art. 1.4).

17.2 Steam accounts can be opened from the age of 13, so signing in with Steam does not show that you are an adult. At launch, we will ask you to confirm your date of birth and that you are of legal age before you can deposit or play, and we will verify your age as part of identity verification.

17.3 We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to a minor, we will block it, return any items the account deposited (unless they must be frozen under AML rules), apply the rules on winnings set out in the Terms and the Responsible Gambling Policy, and delete the minor's personal data except the records that the law requires us to keep, such as the record of the age check and its outcome and any AML records.

17.4 If you are a parent or guardian and believe a minor is using the site, write to privacy@rust50.com or responsible-gambling@rust50.com with the SteamID64 or display name involved. You may also want to use parental filtering tools on the minor's devices.

18. Your rights

18.1 Who has these rights. The GDPR and UK GDPR give the rights below to people whose data they cover. Curaçao law also protects privacy and, as we understand it, gives you the right to know what personal data is collected about you and why, and to have it corrected. We apply the rights in this section to every user, wherever they live, subject to the limits in clause 18.11.

18.2 Right to be informed. You have the right to clear information about how we use your data. This policy provides it.

18.3 Right of access (GDPR Art. 15). You can ask whether we process your personal data and receive a copy of it, together with information about the purposes, recipients, retention periods and source of the data.

18.4 Right to rectification (GDPR Art. 16). You can ask us to correct inaccurate data or complete incomplete data. Your display name and avatar come from Steam: to change them, change them on Steam and sign in again. You can replace your trade URL yourself on the Profile page. We cannot correct the fairness values or results of a finished round, because they are a factual record of what happened; if you think a round record is wrong, use the Complaints and Dispute Resolution procedure.

18.5 Right to erasure (GDPR Art. 17). You can ask us to delete your personal data, for example when it is no longer needed or when you withdraw consent. We will delete it unless we must keep it, for example to comply with Curaçao AML record-keeping rules, to keep a self-exclusion effective, to enforce a ban, or to establish or defend a legal claim. Where we keep data, we will tell you which data, for how long and why, and we will use it only for that purpose. Public chat messages that have already been sent cannot be recalled from other users' screens.

18.6 Right to restriction (GDPR Art. 18). You can ask us to limit the use of your data while we check its accuracy or consider an objection, or where you need it kept for a legal claim.

18.7 Right to data portability (GDPR Art. 20). You can ask for the data you gave us, which we process by automated means on the basis of contract or consent, in a structured, commonly used, machine-readable format (for example JSON or CSV), or ask us to send it to another controller where that is technically feasible.

18.8 Right to object (GDPR Art. 21). You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims. You can always object to direct marketing, although we do not send any.

18.9 Rights about automated decisions (GDPR Art. 22). See section 14. Where a decision based solely on automated processing significantly affects you, you can ask for human review, express your point of view and contest the decision.

18.10 Right to withdraw consent (GDPR Art. 7(3)) at any time, where we rely on consent, and right to complain to a supervisory authority (section 20).

18.11 Limits on these rights. Your rights may be limited where the law requires or allows it. In particular:

• Curaçao AML law prohibits us from disclosing that an unusual transaction report has been made or that an investigation is under way, so an access request will not reveal such information;
• we must keep records for the periods in section 13 even if you ask us to delete them;
• we will not disclose another person's personal data, for example the reasons another user reported you, where that would harm their rights; and
• we may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive, in particular because they are repetitive. If we do, we will explain why.

19. How to exercise your rights

19.1 Self-service. You can already see much of your data on the site: your display name, avatar, referral code and referral count on the Profile page, your rounds in "My games", and your trade URL, which you can replace on the Profile page. You can sign out at any time, and you can clear the site's browser storage yourself (see the Cookie and Local Storage Policy).

19.2 How to make a request. Write to privacy@rust50.com. Tell us which right you want to exercise and include your SteamID64 (or, for a test identity, your test display name and the approximate time you used it), your display name and, where relevant, the round numbers concerned. You do not need to use any particular form of words.

19.3 Verifying your identity. We do not hold an email address for your account, so we must make sure the request comes from the person who controls the Steam account. We may ask you to prove this, for example by temporarily adding a one-time code we send you to your public Steam display name or profile so that we can see it through Steam's public profile data, or, at launch, by matching your verified identity. We will ask only for what is needed and will not use verification information for any other purpose.

19.4 Requests made for you. Someone else may make a request for you if they show that you have authorised them, for example with a signed authority, and we can verify your identity.

19.5 Timing. We will acknowledge your request within one week and answer it within one month of receiving it (or of verifying your identity, if later). If a request is complex or you have made several, we may extend this by up to two further months; we will tell you within the first month and explain why.

19.6 Cost. Exercising your rights is free, except as described in clause 18.11.

19.7 Format. We will send a copy of your data electronically in a commonly used format, unless you ask for something else.

19.8 If we refuse. If we cannot fully meet your request, we will tell you why, which data or rights are affected and how you can complain (section 20).

20. Complaints to supervisory authorities

20.1 Contact us first. We would like the chance to resolve your concern. Write to privacy@rust50.com, or submit a formal complaint under the Complaints and Dispute Resolution procedure at complaints@rust50.com; data protection is one of the complaint categories it covers. You do not have to contact us first, and doing so does not affect your right to go to a supervisory authority or a court.

20.2 Curaçao. The supervisory authority under the Curaçao data protection ordinance is the College bescherming persoonsgegevens (Personal Data Protection Board). At the time of writing, Curaçao is re-staffing the College, and in the meantime the Curaçao administrative court provides general legal protection. You may also be able to bring a claim before the Curaçao courts.

20.3 European Union and EEA. If the GDPR applies, you can complain to the supervisory authority in the EU or EEA country where you usually live, where you work or where you think the infringement took place (GDPR Art. 77). The European Data Protection Board publishes a list of these authorities.

20.4 United Kingdom. If the UK GDPR applies, you can complain to the Information Commissioner's Office (ICO), the UK supervisory authority.

20.5 The CGA and ADR. The CGA does not decide individual disputes between players and operators, but you may report suspected licence breaches or malpractice to it. Disputes with us about rounds, trades or accounts that we cannot resolve can go to the Cyprus Consumer Protection Service (Ministry of Energy, Commerce and Industry) under the Complaints and Dispute Resolution procedure.

20.6 Courts. You may also have the right to bring a claim before a competent court.

21. Marketing and service messages

21.1 We do not send marketing messages. We do not collect players' email addresses through the site and we do not run newsletters, push notifications or advertising campaigns.

21.2 Service messages. We may show you messages on the site about your rounds, trades and account, and at launch Steam trade offers from our bot accounts may include a short message identifying the round. When you email us, we reply by email.

21.3 If marketing is introduced. Before we send any marketing, we will update this policy, ask for your consent where the law requires it, give you a simple way to opt out of every message, and follow the CGA rules on responsible marketing. We will never send marketing to anyone who is self-excluded or in a cooling-off period, who has asked not to receive it, or who we know or suspect is a minor or vulnerable person.

22. Third-party sites and content

22.1 The site links to and loads content from third parties, including Steam's sign-in page and image servers, Cloudflare security challenge pages and the help organisations listed in the Responsible Gambling Policy. When you visit a third-party site, its own privacy policy applies. We are not responsible for how third parties process data on their own sites.

22.2 The site does not embed social media buttons, advertising, third-party analytics or third-party fonts.

23. Changes to this policy

23.1 We review this policy at least once a year and whenever the way we process personal data changes, for example at launch or when a new service provider is added.

23.2 Each version shows its version number and effective date at the top of the page. We archive every version and will provide a previous version on request.

23.3 When we make a material change, we will tell you before it takes effect, for example with a notice on the site or when you next sign in, and we will summarise what has changed. Where a change requires your consent, we will ask for it.

23.4 Changes do not reduce your rights for data collected before the change without your consent, unless the law requires the change.

24. Contact

24.1 Controller: Rust50 Entertainment Ltd, Curaçao Chamber of Commerce number HE 452139, 28 Omonias Avenue, 1010 Nicosia, Cyprus.

24.2 Privacy questions and requests: privacy@rust50.com.

24.3 EU representative: Rust50 Entertainment Ltd, Nicosia, Cyprus. UK representative: Not applicable.

24.4 Support: support@rust50.com. AML and KYC: compliance@rust50.com. Responsible gambling: responsible-gambling@rust50.com. Complaints: complaints@rust50.com.

24.5 Version history: version 0.1 (draft), prepared before licensing; effective 5 November 2026.