Privacy policy

This policy explains what personal information Rustplugins.store collects when you use Rustplugins.store, why, and the choices you have. We collect only what we need to run the store, deliver your plugins and help you.

What we collect

Your account

• Email address, display name and, if you set one, a password (stored only as a secure hash).
• If you sign in with Discord, Google or GitHub: the basic profile that service shares with us (name, email and avatar). We never see your password for those services.

Purchases and licences

• What you bought, the licence size, the amount, currency, date and payment status, and your Stripe customer and session IDs.
• We never see or store your card details. Payments are processed by Stripe.

Servers you link to Oxide Sync

• The server name and the Sync settings you choose (update channel, update window, player threshold and warning time).
• The Oxide and Oxide Sync versions, when the server last checked in, which of your plugins are installed and at what version, and install, update, failure and rollback events.
• A Discord webhook URL, if you add one for notifications.
• The server's link token is stored only as a hash. Oxide Sync does not send us player names, Steam IDs, chat or other player data.

Support tickets

• Your email and name, the plugin and version you're asking about, and the messages you send, including any logs or configs you paste. Please remove passwords and API keys before pasting.

Technical information

• Our hosting provider records standard request logs (such as IP address, browser and time of the request) to keep the service running and secure.

What we don't do: we don't use advertising or analytics trackers, and we don't sell your personal information.

How we use it

• To run your account and sign you in.
• To process payments, deliver licences and keep records we're required to keep for tax and accounting.
• To install and update your plugins through Oxide Sync, and show you your servers' status.
• To answer support tickets and improve our plugins.
• To prevent fraud, abuse and licence sharing, and to enforce our terms.

We rely on performing our contract with you, our legitimate interests in running a secure store, and our legal obligations.

Who we share it with

We use a small number of service providers that process data on our behalf:

Provider	What for
Stripe	Payments and receipts
Vercel	Hosting the website and API
Neon	Database
Supabase	Storing plugin images and files
Discord, Google, GitHub	Only if you choose to sign in with them, or (Discord) if you add a webhook

We may also disclose information if the law requires it, or to protect our rights and users. If the store is ever sold or transferred, your information would move with it under this policy.

Cookies

We use only essential cookies: one keeps you signed in, and one keeps store staff signed in to the admin. We don't use advertising or tracking cookies, so there's no cookie banner.

How long we keep it

• Account information: until you delete your account.
• Orders and licence records: as long as needed for tax and accounting law, typically up to 7 years, even after account deletion.
• Server and Sync records: until you unlink the server or delete your account.
• Support tickets: kept so we can help you with related issues later; ask us to delete them at any time.
• Hosting logs: kept briefly by our hosting provider.

Your rights

Depending on where you live (including under the GDPR, UK GDPR and California privacy law), you can ask to access, correct, export or delete your personal information, or object to how we use it. To make a request, open a support ticket from the email on your account. We'll respond within 30 days. You can also complain to your local data protection authority.

International transfers

Our providers may process data in the United States and other countries. Where required, they use safeguards such as standard contractual clauses.

Security

We use HTTPS everywhere, hash passwords and server tokens, sign plugin releases so servers can verify them, and limit staff access. No system is perfectly secure, so please use a strong, unique password.

Children

Rustplugins.store is for Rust server owners and isn't directed at children under 13 (or under 16 in the EU and UK). We don't knowingly collect their information.

Changes

We'll update this policy if what we collect or how we use it changes. The date at the top shows the latest version.

Contact

For privacy questions or requests, open a support ticket.