Privacy Policy
This policy explains what personal information AutoTurret collects, why, who we share it with, how long we keep it, and your rights. AutoTurret is operated by an individual based in the United States ("we", "us"). Contact: AutoTurretSupport@gmail.com.
It covers two groups of people:
- Users: people who sign in to AutoTurret to manage game servers. For your data, we decide how it is used (we are the "controller").
- Players: people who play on a Rust server that a user has connected to AutoTurret. For players' data, the server's owner decides how it is used, and we process it on their behalf. See section 6.
Short version: we collect what's needed to run the panel. We don't sell or share personal information for advertising, we don't run ads or analytics trackers, RCON passwords are encrypted, and most logs are deleted automatically after 14 to 180 days.
1. Information we collect about users
| What | Details | Why |
|---|---|---|
| Account identity | Your sign-in method and its ID: your SteamID (Steam), your Discord user ID (Discord), or your email address (email sign-in). Your display name and avatar image link. | To create your account and sign you in |
| Password (email sign-in only) | Stored only as a salted scrypt hash; we never store or see your actual password. | To sign you in |
| Email verification codes | One-time codes, stored only as a keyed hash, deleted within 15 minutes. | To verify your email and reset passwords |
| Sessions | A random session token (we store only its hash), its expiry, and when you last signed in. | To keep you signed in, and for security |
| Terms acceptance | When you accepted our Terms and which version. | To record our agreement with you |
| Servers you add | Server name, address and port, RCON password (encrypted with AES-256-GCM), and your settings: schedules, macros, filters, word rules, flags, notes, Discord webhook URLs (encrypted). | To provide the Service |
| Team and activity | Who you invite and their roles; an audit log of actions taken in AutoTurret (who did what, and when). | Accountability for server teams, and security |
| Technical data | IP address and browser information, used briefly for rate limiting and security. Error logs on our server. | Security, abuse prevention, fixing bugs |
| Messages to us | Anything you send to our support email. | To reply to you |
| Support tickets | If you open a ticket in our Discord: your Discord ID and username, the ticket subject, and when it was opened, claimed and closed. The conversation stays in Discord; when the ticket closes, a transcript is posted to a private staff channel there and sent to you by direct message. | To help you and keep a record of support |
We get your Steam name and avatar from Steam's public profile data. We get your Discord username and avatar from Discord, with the identify permission only. We don't receive your Discord email or servers. We do not collect payment information.
2. How we use information, and legal bases
We use information only to provide, secure, maintain and improve the Service, to communicate with you about it (for example verification codes and important notices), to enforce our Terms, and to comply with the law. Under GDPR / UK GDPR, our legal bases are: contract (providing the Service you signed up for), legitimate interests (security, abuse prevention, audit logs, fixing bugs), legal obligation (responding to lawful requests), and consent where we ask for it. We do not use your data for advertising, sell it, or use it for automated decisions with legal or similarly significant effects on you.
3. Who we share it with
We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as defined by California law. We disclose it only to:
- Service providers that run the Service for us, under their own data protection terms:
- OVHcloud: server hosting (United States);
- Cloudflare: DNS for our domain;
- Resend: sending verification and password reset emails (only your email address and the message);
- proxycheck.io: checking whether a player connects through a VPN, proxy or Tor, and which country they connect from, only on servers whose owner turns on VPN blocking or IP addresses in Discord logs (only the player's IP address is sent);
- Google Fonts: our pages load fonts from Google, which receives your IP address and browser information when the font is fetched.
- Platforms you choose to use: Steam (sign-in and public profile and ban lookups) and Discord (sign-in and the webhooks you set up). Messages sent to a Discord webhook are visible to whoever can see that channel.
- Your server team: people you invite to a server can see that server's data according to their role. Teammates never see each other's email addresses.
- Legal reasons: if required by law, subpoena or court order; to protect the rights, property or safety of AutoTurret, users, players or the public; or to investigate abuse.
- Transfer: if the Service is transferred to a new operator, data may be transferred with it, under this policy.
4. How long we keep it
| Data | Kept for |
|---|---|
| Account, servers and settings | Until you delete them or your account |
| Sign-in sessions | Up to 30 days, or until you sign out |
| Email codes | 15 minutes |
| In-game chat logs | 14 days |
| Activity feed (joins, leaves, kicks, auto-mod) | 30 days |
| Play sessions, IP fingerprints, auto-mod strikes, F7 reports | 90 days |
| VPN check results (by IP fingerprint) | 24 hours |
| Audit log, ended bans, decided ban appeals | 180 days |
| Active bans and mutes, player notes and flags, player list | Until removed, or the server is deleted |
| Live console and player list | In memory only, while connected |
| Server error logs | Rotated automatically; kept for a short time |
| Backups | Overwritten on a rolling basis by newer backups |
When you delete your account, your account, sessions and servers (with all their data) are deleted right away. Actions you took on other people's servers stay in their audit logs, marked "deleted user". Copies in backups are overwritten over time.
5. Security
We use HTTPS everywhere, encrypt RCON passwords and webhook URLs at rest, hash passwords and session tokens, restrict database access, rate-limit sign-in, and keep the server updated. No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and authorities as required by law.
6. Players on connected game servers
If you play on a Rust server that uses AutoTurret, the server's owner and their team use AutoTurret to administer it. Through the server's RCON connection, AutoTurret receives and may store:
- your SteamID, in-game name and past names, ping, and connection times and durations;
- chat messages you send on that server (kept 14 days), and whether auto-moderation acted on them;
- bans, mutes, kicks, strikes, notes and flags that the server's staff or its automated rules apply to you;
- F7 reports you send or that are made about you (who reported whom, the category, subject and message), kept 90 days;
- ban appeals, if you send one through a server's appeal page: your SteamID (confirmed by signing in with Steam, which does not create an AutoTurret account), your appeal text, the optional contact you give, and the staff's decision and reply. These are visible to that server's staff, and decided appeals are deleted after 180 days;
- a one-way, keyed fingerprint of your IP address, kept 90 days and only if the server owner turns on alt detection, used to link accounts that connect from the same network. Your IP address itself is not stored by AutoTurret, though it is shown live to that server's admins;
- public Steam information about your account, such as VAC/game ban status and account age, if the owner uses those checks;
- whether your connection is a VPN, proxy or Tor, if the owner turns on VPN blocking. Your IP address is sent to proxycheck.io to check this. The result is kept for 24 hours under the one-way fingerprint described above, not your IP address, and players on a VPN may be kicked;
- your IP address and the country it is in, posted to the server's own Discord channel when you join or leave, only if the server's staff turn this on for a Discord log. The country comes from proxycheck.io as above. Once posted, those Discord messages are controlled by the server's staff and Discord, not by AutoTurret.
The server's owner decides how this is used and is responsible for informing you. Questions or requests about this data should go to the server's owner first. You can also contact us, and we will pass your request on or help where we can. AutoTurret only uses players' data to provide the Service to that server's owner. Data from one server is not shown to other servers' owners, except that a server owner may see ban information from other servers they also manage.
7. Your rights and choices
- Access and portability: download your data any time in the dashboard (Account & privacy → Download).
- Deletion: delete your account in the dashboard, or email us.
- Correction: update your profile on Steam or Discord. It refreshes when you next sign in. Or email us.
- Objection and restriction (EEA/UK): email us. You can also complain to your local data protection authority.
- US state rights (California and other states with privacy laws): you may request to know, access, correct and delete your personal information. We do not sell or share it, and we do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising your rights. You may use an authorised agent; we may need to verify your identity and the agent's authority.
- Signing out everywhere: Account & privacy → Log out everywhere.
Send requests to AutoTurretSupport@gmail.com. We respond within 30 days (45 days where US state law allows), and may ask you to confirm you control the account.
8. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it. Players of any age may play on Rust servers that use AutoTurret. Their limited in-game data is processed as described in section 6, under the responsibility of that server's owner.
9. International transfers
We are based in the United States, and our servers are in the United States. If you use the Service from outside the US, your information is transferred to and processed in the US, where laws may differ from yours. Where required, we rely on appropriate safeguards, such as our providers' standard contractual clauses.
10. Do Not Track and Global Privacy Control
We do not track you across other websites, so there is nothing for these signals to switch off. We honour Global Privacy Control as an opt-out of sale or sharing, which we don't do anyway.
11. Changes
We will post changes here and update the date at the top. If a change is significant, we will notify you through the Service.
12. Contact
Email: AutoTurretSupport@gmail.com