Privacy & Compliance

Rust Routes is a self-hosted tool for authoring routes for Rust game servers. This instance is operated by Daily Grind Rust, a hobbyist Rust server community in the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, the operator is the “data controller” for the personal data described here.

• Service: Rust Routes — the website at rustroutes.com and its companion game addon.
• Data controller: the operator of Daily Grind Rust, United Kingdom.
• Contact for privacy matters: [email protected]

There is no tracking here. Everything below exists because the tool needs it to work.

• Your account: your email address, a scrypt hash of your password, and the date the account was created. We never store your password itself and cannot read it.
• Your session: a random session identifier and its expiry, matching a single cookie in your browser.
• API tokens: the name you give a token, a short non-secret prefix, a SHA-256 hash of the token, and the created / last-used / revoked timestamps. The token's real value is shown once and never stored.
• Maps you upload: the map file itself (kept so you can export an anchored copy), plus a rendered image, a height grid, and the map's identity and monument list.
• Routes you draw: the route data and its version history, including whether a save came from the website or from in-game.
• Sign-in rate limiting: when you attempt to sign in or register, your IP address is used as a short-lived counter key to block brute-force attempts. It is not linked to your account, and the entry is superseded once its ten-minute window passes.
• Server logs: ordinary error output, which may include a request path.

What we do not collect: no analytics, no advertising, no third-party trackers or embedded social scripts, no profiling, no payment details, and no in-game player data — the addon sends routes and revisions, not the people on your server.

Under the UK GDPR we need a lawful basis for using your data. Ours are:

• Contract — creating and running your account, storing your maps and routes, and serving them to your addon is the service you asked for.
• Legitimate interests — keeping the service secure and available: rate-limiting sign-in attempts, blocking abuse, and diagnosing errors.
• Legal obligation — where we must retain or disclose something to comply with the law.

We do not use your data for marketing, and we do not sell it.

One cookie, and it is strictly necessary — so there is no consent banner to click through.

• pf_session — keeps you signed in. It is HttpOnly (JavaScript cannot read it), SameSite=Lax, marked Secure when served over HTTPS, and expires on its own or when you sign out.

No analytics cookies, no advertising cookies, and nothing shared with a third party. Clearing it simply signs you out.

We do not sell or trade your data, and there are no advertising or analytics partners. The only third party in the path is our network provider:

• Cloudflare — provides DNS, HTTPS and the tunnel that carries traffic to the server. It processes connection data such as your IP address and request metadata in order to deliver and protect the site.

Everything else — accounts, maps, routes, tokens — is stored on the operator's own server, not on a third-party cloud service. We may disclose data where the law requires it.

The service is hosted in Europe. Our network provider operates globally, so connection data may be processed outside the UK under the safeguards in that provider's own data protection terms.

• Account, maps and routes — until you delete them or ask us to close your account.
• Sessions — until they expire or you sign out.
• API tokens — until you revoke them; revoked tokens keep their record so an old token cannot be reused.
• Rate-limit counters — short-lived, tied to a ten-minute window.
• Backups — where the operator has database backups enabled, a copy of the above may persist in them for a limited retention period before being overwritten.

Under UK data protection law you have the right to:

• Ask what we hold about you, and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted — closing your account removes your maps, routes, sessions and tokens with it.
• Object to, or ask us to restrict, certain processing.
• Ask for your data in a portable format. Your routes are already downloadable as a JSON file from the editor.

Email the contact address above and we will respond within one month.

• Passwords are hashed with scrypt; API tokens are stored only as SHA-256 hashes.
• The site is served over HTTPS, and the session cookie is HttpOnly and Secure.
• Sign-in and registration are rate limited.
• Your maps and routes are only reachable through your own account or a token you issued.
• No system is perfectly secure. If a breach affects your rights we will tell you and the ICO as required.

This is an administrative tool for people who run game servers, not a service aimed at children. If you believe a child has created an account here, contact us and we will remove it.

We may update this notice as the service develops. The “last updated” date and version above reflect the current text.

If you have a concern about how we handle your data, please contact us first so we can put it right. You also have the right to complain to the UK's data protection regulator:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk
• Helpline: 0303 123 1113