Privacy policy

The controller of your personal data is Scrap Racket, the name under which a sole trader runs the service.

For anything about your data, email [email protected] or use the support centre. No separate data protection officer has been appointed; that address reaches the person who handles privacy.

The website at scrapracket.uk, the Scrap Racket Rust servers and memberships, and what we do in the Scrap Racket Discord: account linking, the Scrap Racket bot and moderation.

It does not cover Steam, Tebex, Discord or Rust itself. Valve, Tebex, Discord and Facepunch Studios decide what they do with your data, under their own privacy policies.

Signing in is optional; the website works without it. When you sign in through Steam we store:

• your SteamID64, as Steam confirmed it. We never see your Steam password;
• the display name and avatar your Steam profile shows publicly, fetched from the Steam Web API when you sign in and refreshed at most once a day when an account or profile page is viewed;
• when you first and last signed in, and when your profile was last refreshed;
• your membership tier, its status and expiry, and when it was last synchronised, if you have one;
• the servers you mark as favourites, if you use that feature;
• your accessibility settings — text size, spacing, typeface, contrast, motion, messages and text to speech — only if you turn on “Keep these settings with my account” in the accessibility settings. They are used only to apply those settings when you sign in on another device. A setting such as a typeface for dyslexia can say something about you, which is why this is off unless you choose it; turning it off deletes them from your account.

We do not ask for or store your email address, real name, postal address, date of birth or a password.

If you link a Discord account, the section on Discord below says what that adds.

When you connect, the game server receives your SteamID, your Steam name and your IP address, as every Rust server does. The server and the Scrap Racket plugins record, against your SteamID:

• what you do with Scrap Racket systems: Scrap Exchange purchases, contracts and bounties, prison sentences, cabins and membership permissions;
• leaderboard statistics for the current wipe: player kills and deaths, wood, ore, animals, bounties, Scrap and playtime;
• connections and chat, in the server’s logs.

The website reads the leaderboards and a feed of in-game events from the servers. Server status readings hold counts, never names.

Rust’s anti-cheat is part of the game and is run by Facepunch Studios, not by us.

Some of this is shown to anyone, on purpose, because that is what it is for:

• the leaderboards: your name, your SteamID and your statistics for the current wipe;
• the activity feed on server pages: your in-game name as it was at the time, and what happened — a kill, a contract, an Exchange purchase, a prison sentence;
• your player profile at /players/ followed by your SteamID: Steam name, avatar, SteamID, membership tier, the date you first signed in and how many favourite servers you have;
• in the Scrap Racket Discord: posts by the Scrap Racket bot, which name players only as the website already does, and the Supporter, VIP or VIP+ role on a linked Discord account, which other members can see like any role.

Your Discord user ID and username are shown only to you, on your account page, and to staff.

Ban records are not published yet. When they are, the ban records page will say what is shown, and evidence and internal notes never are.

You can report a player or appeal a ban while signed in through Steam. What you send is stored as a support ticket on your account. Every ticket holds your SteamID64, taken from your sign-in, a ticket number, the type of request, a subject, its status, and when it was opened and last changed. On top of that:

• a report holds the server, the player you report as you typed them (a SteamID64 or an in-game name), the kind of problem, when it happened as you typed it, what you say happened, and how to reach you if you chose to give that;
• an appeal holds the server, the approximate ban date and the reason shown in game as you typed them, and your account of what happened. The SteamID64 on an appeal has to be the one you signed in with. Ticking the acknowledgement is needed to send, and is not stored.

The forms take no files. If you include a link to a clip, we store the link as you typed it, not the clip.

We use a report or an appeal only to deal with it: to check it against the rules and what the game server’s records show, to act on it or not, and to follow it up with you. Only staff can read tickets, in the control panel. You can see the status of your own tickets on the support centre.

When a ticket is opened, its full contents are also emailed to the staff inbox, which is a Gmail account run by Google. The Scrap Racket bot tells staff in a private Discord channel that a ticket was opened, with its number and type and nothing else.

A report about another player is personal data about them too. The website does not tell a player that they were reported, or by whom, and the player who reported is not told what happened beyond the public ban records. The rights section below says what the reported player can ask for.

Staff can also open a ticket for you in the control panel, and it is stored and emailed in the same way. If you email us, we receive your email address and whatever you write, and use them only to deal with your request.

Memberships are sold by Tebex, which is the merchant of record. Tebex collects your payment details and the billing information it needs, and decides what it keeps for tax, fraud prevention and accounting, under its own privacy policy.

We never see your card details. We hold only the membership tier, status and dates tied to your SteamID, so the benefits reach the right account.

• A cookie named sr_session, set only when you sign in. It holds your SteamID and name, signed so it cannot be altered, cannot be read by scripts on the page, and expires after 30 days or when you sign out. It is strictly necessary for being signed in, which is why no consent banner asks about it.
• Your accessibility settings, kept in your browser’s local storage. They are sent to us only if you are signed in and turn on “Keep these settings with my account”; the section on signing in says what that stores. Text to speech uses your browser’s own voices, and the text it reads does not leave your device.
• While you write a report or an appeal, what you have typed is kept in this browser tab’s session storage, so signing in through Steam half-way does not lose it. It is deleted when you send the form or close the tab, and it is not sent to us until you send the form.
• Whether you have dismissed the note about cookies at the bottom of the page, also kept in your browser’s local storage. It records only that, and is never sent to us.
• Cloudflare, which sits in front of the website, may set its own strictly necessary security cookies.

There are no advertising, analytics or tracking cookies, and no third-party analytics or advertising scripts.

Every request to the website passes through Cloudflare, which processes your IP address and request details to deliver the site and protect it from attacks. The proxy in front of our web server can also log requests, including IP addresses, for troubleshooting.

The Scrap Racket Discord is a community server on Discord, joined through the invite on the website. Discord runs the platform: your Discord account, your messages and what Discord records about you are handled by Discord under its own privacy policy, at discord.com/privacy. Staff moderate the Scrap Racket Discord under the rules, and see what you post there as other members do.

Linking a Discord account to your Scrap Racket account is optional. It is how a membership’s Discord role reaches you. You start it on your account page while signed in, and Discord asks you to let Scrap Racket see your account’s basic identity: its user ID and username, not your email address, your servers or your messages. When you agree, we store on your account record:

• your Discord user ID, the number Discord gives your account. Roles are granted by this number, never by a name;
• your Discord username as it was when you linked, to show on your account page;
• the state of the link, and when the Scrap Racket bot last made your role match your membership.

The access token Discord issues for linking is used once, to ask Discord whose account it is, and is not kept. A Discord account can be linked to only one Scrap Racket account.

Every few minutes the bot compares the membership on each linked account with that Discord account’s roles in the Scrap Racket Discord, and adds or removes the Supporter, VIP or VIP+ role to match. It changes no other role. If Discord cannot be reached, your roles and your membership stay as they were until the next try.

The bot also posts in the Scrap Racket Discord:

• wipes: when one is recorded, and the day before the next;
• bounties collected and contracts enforced, with the in-game names involved, as the activity feed on the website shows them;
• server firsts: the name a player had when they became the first on a server to earn an achievement, as the website shows it;
• for staff, in a private channel: that a support ticket was opened, with its number and type and nothing else from it;
• answers to its commands, which carry server status, the next wipe and links, and no player data.

The bot does not collect what members write. When it starts, it reads the recent messages in the channels it posts to only to find its own earlier posts, and keeps none of them.

You can remove the link yourself with the Unlink Discord button on your account page, and link a different Discord account straight away. Unlinking deletes your Discord user ID, username, link state and sync record from your account at once. So that the bot can still take the Supporter, VIP or VIP+ role off the Discord account you unlinked, we keep that Discord user ID on its own, without your SteamID or anything else, until the bot has removed the role, normally within a few minutes, and then delete it. If you link the same Discord account again before then, nothing is removed and its role follows your membership as before. You can also ask through the support centre or at [email protected], and we unlink it for you. Removing Scrap Racket from the apps you have authorised in Discord’s settings does not remove the link here, because we keep no token for that to cancel. Leaving the Scrap Racket Discord takes your roles there away, but the link stays on your account until you unlink it.

• Signing you in, showing your account and delivering a membership you bought: performing our contract with you.
• Linking a Discord account you choose to link, and keeping its Supporter, VIP or VIP+ role in step with your membership: performing our contract with you, because the role is part of what a membership includes and linking is the feature you asked for.
• Running the game servers, keeping gameplay records, and showing leaderboards, the activity feed, server firsts and player profiles, on the website and through the bot in the Scrap Racket Discord: our legitimate interest in running a multiplayer server and the community features its players expect.
• Enforcing the rules, handling reports and appeals, stopping cheating, and keeping the website and servers secure: our legitimate interest in a fair and safe service. That includes what a report says about the player it names, which we need in order to check it, and emailing new tickets to the staff inbox so they are seen.
• Keeping membership records for as long as refunds, chargebacks and tax need them: our legal obligations, and our legitimate interest in handling disputes.

We do not sell personal data, use it for advertising or build profiles of anyone. No decision with a legal or similarly significant effect on you is made automatically. A ban is decided by a person.

• Valve (Steam): confirms your sign-in and answers profile lookups.
• Tebex: sells and bills memberships.
• Cloudflare: carries all traffic to the website and serves the site’s images from its storage. Those images are site artwork, not personal data.
• Facepunch Studios: Rust and its server software, which handle your connection to the game.
• Discord: runs the Scrap Racket Discord and receives everything the bot posts there. If you link your account, Discord confirms whose account it is and receives the role changes the bot makes. Discord handles this under its own privacy policy, at discord.com/privacy.
• Google: provides the staff email inbox, a Gmail account, which receives the full contents of every new support ticket, report and appeal. Google handles this under its own privacy policy, at policies.google.com/privacy.
• Scrap Racket staff: moderators and administrators see what they need for their role.
• Authorities: where the law requires us to disclose something.

The web server and its database run on hardware we operate ourselves in the United Kingdom. No cloud hosting provider holds the database; the copies of new tickets emailed to the staff inbox are held by Google.

Valve, Cloudflare, Discord and Google are based in the United States, and Tebex, Cloudflare and Google may process data outside the UK and the EU. Where personal data leaves the UK or the EU, it relies on the safeguards those providers set out in their own terms, such as adequacy regulations or standard contractual clauses.

Nothing is deleted automatically yet, except where this list says so. Where it says "policy", that is a commitment we keep by hand.

• Session cookie: 30 days at most, or until you sign out.
• Accessibility settings, and whether you dismissed the note about cookies: until you clear your browser’s data for the site. Accessibility settings kept with your account: until you turn that off, which deletes them at once, or with the account record. A report or appeal being written: until you send it or close the tab.
• Account record: while you use the service. Policy: at least once a year, we delete account records with no sign-in for two years, unless a ban or an open dispute needs them.
• Leaderboard statistics: the website keeps only the latest reading for each server, and the statistics start again at each wipe.
• Activity feed lines: kept, with no automatic deletion yet. We take a line down on request.
• Game server logs and plugin data: kept for as long as the server needs them, with no automatic deletion yet; much of the plugin data is cleared at a wipe.
• Discord link (user ID, username, state and last sync): kept with your account record until you unlink it, and deleted at once when you do, or with the record. The Discord user ID of an account you unlinked: kept on its own only until the bot has removed its role, normally within a few minutes, and then deleted automatically.
• Posts by the bot in the Scrap Racket Discord: kept by Discord, with no automatic deletion. We delete a post on request. Discord keeps its own records under its own policy.
• Membership records: while the membership is active, and then for as long as refunds, chargebacks and tax records require. Tebex keeps its own records under its own policy.
• Support tickets, including reports and appeals: policy: deleted two years after the ticket is closed, together with the copy emailed to the staff inbox, unless a ban or an open dispute still needs them.
• Database backups: taken by hand. Policy: deleted within 90 days of being taken.
• Versions of these legal documents: kept permanently. They contain no personal data.

Under UK and EU data protection law you can ask us to:

• give you a copy of your personal data;
• correct it. Your name and avatar come from Steam: change them there and they update here within a day;
• delete it;
• restrict how we use it;
• stop using it where we rely on legitimate interests, including showing you on the leaderboards, in the activity feed, in the bot’s posts in the Scrap Racket Discord or on a public profile;
• give it to you in a portable form.

Ask through the support centre or at [email protected]. We may ask you to sign in through Steam to prove the SteamID is yours. It is free, and we answer within one month, or tell you within that month if a complicated request needs up to two more.

Deleting your data removes your account record and what the website holds about you, including a Discord link, and we remove the Supporter, VIP or VIP+ role the bot gave you. A SteamID, and a report or appeal, can be kept where it is needed to enforce a ban or to finish dealing with a report, and we cannot delete what Steam, Tebex or Discord hold; ask them directly.

If someone has reported you, what the report says about you is your personal data too, and you can ask for it like any other. We leave out who made the report and anything that would identify them, and anything else the law allows us to withhold. If you object to our keeping a report about you, we weigh that against the need to enforce the rules and tell you the outcome.

You can complain to the Information Commissioner’s Office in the UK (ico.org.uk), or to the data protection authority where you live in the EU. We would rather hear from you first.

The service is not directed at children under 16, and the terms require users to be 16 or over. If you believe a child under 16 has signed in, tell us through the support centre and we will delete the account record.

The session cookie is signed and cannot be read by scripts. Traffic is encrypted between you and Cloudflare. The database cannot be reached from the internet, game server passwords are never stored in it, events from the game servers are accepted only when signed, no Discord access token is kept, and staff access is limited by role. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the regulator where the law requires it.

A change is published as a new version with its own date, and older versions are kept. A significant change is announced on the website before it applies, and a new use of your data is added here before it starts.