Privacy Policy

1. Who is responsible

[имя оператора], a private individual in [страна], decides how data in Rust Raid Alarm is handled and is the person to write to about it: [контактный e-mail].

There is no company, no data team and no advertising business behind this. One person runs it.

2. What we store

• —Telegram identity: your numeric user id, @username, display name, your role in the team and when you joined. Also the chat ids of chats subscribed to alarms.
• —Discord identity: your Discord user id, only if you link a Discord account.
• —Rust+ link: the FCM credentials, push token and Rust+ auth token of the team, stored encrypted with AES-256-GCM. These reach your game notifications and paired devices, never your Steam account.
• —Phone number: only if you add one yourself for calls. Encrypted at rest, shown masked in the interface, used for nothing but calling you on an alarm.
• —Game data: your servers and paired devices, cameras and the snapshots they take, your base marker, teammate positions while they are online, wipe times, the event feed (most recent 400 entries) and raid history (most recent 500 raids).
• —Enemy watchlist: Steam IDs, nicknames, online and offline times, session lengths, usual hours and Rust playtime of players you added. See section 4.
• —Payment: your Stripe customer and subscription id, plan and period end. Card numbers never reach our servers — Stripe holds them.
• —Technical records: timestamps, errors and diagnostics needed to see that the alarm chain works.

3. Why we are allowed to

Most of it is simply what the contract needs: without your Telegram identity, the Rust+ token and your device list there is no alarm to deliver.

Your phone number and the enemy watchlist are there because you chose to add them, and you can remove either at any time.

Technical records exist because we have a legitimate interest in knowing that a watchman which promises to wake people is actually working.

4. Data about people who are not our users

The enemy watchlist holds information about other players — Steam ID, nickname, when they are online, how long they play and their Rust playtime. Those people never agreed to anything with us, so we are careful and want to be open about it.

It comes from two places: Valve’s public Steam Web API, which only ever gives us what that person left public in their own Steam privacy settings, and the game’s own chat and team feeds. When someone hides their game details, we record that we cannot see them rather than guessing.

We store the minimum needed to answer "is this player online", we never contact these people, and we never sell or share the list.

If you are one of those players and want your entry gone, write to [контактный e-mail] with your Steam ID and we will delete it from every team that holds it, within 7 days.

If you use this feature, using it lawfully is on you. The Terms forbid using it to harass, dox or stalk anyone, and we will close accounts that do.

5. Who else sees the data

Only the services the Service is made of, and only what each needs to do its job:

• —Telegram — delivers messages and places the calls.
• —Discord — delivers messages, if your team connected it.
• —Facepunch (Rust+) and Google — the game notifications and the push transport that carries them.
• —Valve (Steam Web API) — public player status for the enemy watchlist.
• —Stripe — payment, invoices and subscription state.
• —ntfy — an optional extra notification channel, only if your team turns it on.
• —Cloudflare and our hosting and database provider — the network and the servers the Service runs on.

We do not sell data, we do not run ads, and we do not share anything with anyone else unless the law requires it.

6. How long we keep it

Team data lives as long as the team does. The event feed and raid history roll over on their own at 400 and 500 entries.

Delete your team and its data is removed from the live database within 7 days. Backups age out within 30 days after that.

Some records we must keep longer because tax or accounting rules say so — payment records, essentially.

7. How it is protected

Secrets — the Rust+ token and phone numbers — are encrypted with AES-256-GCM, and the key is kept outside the database, readable only by the account that runs the Service.

The site and the API are served over HTTPS. Only the operator has access to the servers.

Nobody can promise perfect security. If a breach ever affects your data, we will tell you and say what happened, rather than hope you do not notice.

8. Your rights

You can ask what we hold about you, get a copy, have it corrected, have it deleted, or object to a particular use. Where you gave consent, you can withdraw it.

Most of it you can do yourself, immediately. In the bot: /stopcall stops calls to you, /stop unsubscribes a chat from alerts entirely. In the dashboard: your own settings hold the phone number and quiet hours, the Rust+ link has an "Unlink" button that deletes the token, and deleting your account removes you from every team. A team owner can delete the whole team, with its history and member settings, in Settings.

A copy of the data is a button: the team owner downloads the whole team as one file in the dashboard, under Settings. Tokens and access codes are left out of it, and other people’s phone numbers come out masked.

For anything else write to [контактный e-mail]. Deletion requests are done within 7 days, everything else within 30.

If you think we handled your data badly and we cannot settle it between us, you can complain to the data protection authority where you live.

9. Children

The Service is not intended for anyone under 16. We do not knowingly keep data about children, and will delete it if we find it.

10. Changes

This policy took effect on 2026-09-29. If we change it in a way that matters, we will say so through the bot and the site before it takes effect.

The English version is the binding one; the Russian version is a translation for convenience.