Privacy Policy

1. Scope

This Policy covers the Rust game server "RAIDADOS 2X", the community's Discord bots, and the raidados.top website. It does not cover Discord, Steam, Facepunch, or the payment providers, which are independent controllers of the data they process on their own account.

2. Data processed, purpose and retention

The account country is derived from the address of the connection that verified your account, or of your first visit to the store, for one purpose only: choosing the currency of a purchase. The lookup happens at the moment of the visit, we keep the two letters and not the address, and the country is then fixed on the account — only support changes it, at your request.

We do not process sensitive data (art. 5, II of the LGPD). We do not sell data. We do not market to contacts derived from Steam.

3. Steam data and country of storage

We obtain Steam data only when you start the linking flow. We store Steam ID (SteamID64), public profile name, and avatar URL. We do not obtain e-mail, payment data, inventory, or friends list.

As required by the Steam Web API Terms of Use, we inform you that data obtained from Steam is stored in Brazil, on a server under our control. We do not use Steam data for unsolicited marketing communications.

4. Discord data

From Discord we obtain your user ID, username, avatar, account language, and your membership of our server. When you log in to the site through Discord, we receive the same set of data via OAuth2. We apply roles (verified, VIP, language, ranking winners) on our server.

Ticket content is stored in our database in Brazil, in addition to existing on Discord as messages.

5. IP addresses and access logs

An IP address is personal data. It is collected when you access the website and when you connect to the game server.

• Anti-cheat and ban evasion: the address is turned into an irreversible hash at the moment of collection, with a secret specific to this installation, and the address itself is never stored. We keep the hash, how many connections came from it, and network metadata about the address: country, region, city, network operator/ASN, whether it is a VPN, proxy, Tor or datacenter address, which provider classified it and when. This serves to recognise the same connection origin, and nothing else.
• Retention: 24 months from the last connection made from that address; while a ban on the account exists the record is kept, because an evasion check is worthless if the evidence expires before the evader comes back.
• Website request logs: we keep the method, path, result, duration and request identifier, without the IP address. If we start keeping access logs under art. 15 of the Internet Civil Framework, they will be kept for 6 months, under confidentiality and restricted access, and disclosed to third parties only under a court order.
• The IP recorded with a legal acceptance: it is the evidence that the acceptance happened, so it stays with the acceptance record for the 5 years stated in section 2. It is the only address we keep in raw form; it is not used for screening and not cross-referenced with the other records.
• Statistics and rankings: do not use IP.
• Ban records: contain no IP; they are keyed on the Steam ID.

6. Game data: positions, events and chat

The server records your position on the map at regular intervals, combat and gathering events, and chat messages.

Positions are kept in raw form for 24 months and then converted into aggregated data (heatmaps and counts) that do not allow a player's path to be reconstructed. Chat is kept for 24 months.

The moderation team consults this game data (positions, events, chat and painted images) in an internal tool, only for moderation and anti-cheat.

The anti-cheat telemetry of each hit (weapon, distance, hit location, shot timing, the game engine's own consistency numbers and your ping) is kept for 2 wipes (the current and the previous one) and then replaced by the per-wipe aggregates, which do not describe individual shots.

From voice chat we record only how long you spoke, in seconds, as a number used in statistics and rankings. We do not record, transcribe, or store voice audio.

7. Tickets and attachments

A ticket contains whatever you write in it: a description of what happened, the players named, the evidence attached. Include only what is necessary, and avoid sending identity documents, receipts with full bank details, or third-party data that your report does not need.

The ticket body and the decision are kept as support history. Attachments are deleted after 1 year.

8. Payments

Payment (PIX or card) is handled entirely by Stripe, on its payment page. We neither receive nor store card numbers, CVV, PIX keys, or bank details.

Where Stripe requires payer identification (a Brazilian CPF) to create the PIX charge, that data goes directly to Stripe, on its page, and never passes through our systems. We keep only the provider's transaction identifier, the amount, the status, the date, and the item purchased.

9. International transfers

Some processing involves international data transfers. As required by art. 33 of the LGPD and ANPD Resolution No. 19/2024:

There is no ANPD adequacy decision for the United States. For the transfers above that do not rely on consent, we act on the basis that they are necessary to perform the contract you requested (using Discord, linking Steam, paying). You can use the game server without linking Discord and without buying anything, with reduced functionality.

10. Sharing with third parties

We do not sell, rent, or trade personal data.

We share only: with the providers listed in section 9; with authorities, upon a valid legal request and, in the case of access logs, upon a court order; and with professionals advising us, under a duty of confidentiality.

We do not share ban records with other Rust communities, third-party ban lists, or "security organisations". Earlier community policies claimed such sharing; it was never implemented and the claim has been removed.

11. Cookies

The website uses four cookies, all first-party and strictly necessary. Because we use no analytics, advertising, or third-party cookies, we do not display a consent banner: consent is not the appropriate legal basis for necessary cookies, per the ANPD guidance on cookies.

There are no third-party scripts, pixels, video embeds, or external widgets on the site. If that changes, we will publish a banner with per-purpose controls, off by default, before any collection.

12. Security and incidents

We apply, at minimum: encrypted transport (HTTPS/TLS), role-based access control to the database, credentials kept out of source code, separation between services, audit logging of administrative actions, and backups.

In the event of a security incident that may cause relevant risk or damage, we will notify the ANPD and the affected data subjects within the regulatory deadline, describing the nature of the data, the subjects involved, the measures adopted, the risks, and the corrective measures. We keep an internal incident register for at least 5 years.

13. Your rights and deadlines

You have the rights in art. 18 of the LGPD: confirmation that processing exists; access to the data; correction of incomplete, inaccurate, or outdated data; anonymisation, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; portability; deletion of data processed on the basis of consent; information about whom we share data with; information about the possibility of refusing consent and the consequences of doing so; and revocation of consent.

To exercise any of them, open a ticket or write to support@raidados.top. Handling is free of charge.

Deadlines: we answer in simplified form immediately whenever possible and, in any case, with a clear and complete statement within 15 days. As a small processing agent, that deadline may extend to 30 days where the request requires investigation; we will tell you when that happens.

Limits: we may keep data where there is a legal or regulatory obligation (for example, tax records and access logs), and we may keep the minimal ban record on the basis of the regular exercise of rights, informing you of the reason.

14. Children and adolescents

The minimum age for the service is 16. We do not knowingly process children's data. If we identify or are told about an account below the minimum age, we will end that access and delete the data we are not required to keep.

We do not collect more data than necessary as a condition for taking part in the game, per art. 14, §4 of the LGPD.

15. Automated decisions

We use automated processing to detect suspicious behaviour, compute rankings, and enforce usage limits. No permanent ban results solely from an automated decision: automated systems may kick, temporarily suspend, or flag an account, but a permanent ban is always confirmed by a person.

You may request a review of any decision that affects you by opening a ticket, and you are entitled to information about the criteria used, subject to trade secrecy and the effectiveness of our anti-cheat measures.

16. Changes to this Policy

We will publish a new version whenever the processing changes. Material changes are announced at least 7 days in advance on Discord and on the website. The current version and date are at the top of this page.

17. Contact and complaints to the ANPD

Contact us by ticket or at support@raidados.top.

If you believe your rights have not been respected, you may complain to the Brazilian National Data Protection Authority (ANPD) at https://www.gov.br/anpd and may also exercise your rights before consumer protection bodies (Procon), under art. 18, §8 of the LGPD.