Your data stays with us
What we collect, why we need it, who sees it and how long it's kept. Last updated 2 October 2026.
Only what's needed, only used by us
- We only collect what we need to vet people and run the clan
- It's only used inside CTFO's own systems, nowhere else
- It's never sold, never shared for advertising and never used for marketing
- We never see your Steam or Discord password
- This site has no ads, no analytics and no tracking cookies
- You can ask to see your data or have it deleted at any time
Who's responsible for your data
CTFO is run by Natchland Studios, which is responsible for the data described here. To contact us about your data, message an admin in the CTFO Discord. Admins have the Admin role there. If you're no longer in it, message Natchland, the server's owner, directly on Discord.
Just reading? We keep next to nothing
This site doesn't use analytics or trackers. It doesn't load anything from other companies either. Even Steam profile pictures are fetched by our server and passed on, so your browser never contacts Steam. Fonts and everything else are served from our own server.
There are no cookies unless you sign in to apply. Signing in sets one cookie that keeps you signed in for up to 30 days, plus a short-lived one while the sign-in itself happens. Signing in also sets a cookie that recognises the device you applied from, kept for up to a year. We only store a scrambled version of it, with your application, to spot repeat applications from the same device. Signing out removes it. Neither is used for anything else.
The player lookup shows anyone's public Rust stats from Steam. When someone looks an account up, our server asks Steam for its name, profile picture, Rust hours, Rust stats, any bans on it and when it was made. Bans and a brand new account are shown as a tag, the same facts Steam shows on anyone's profile. It's held in memory for ten minutes so a refresh doesn't ask Steam again, then it's gone. Steam only shares it for profiles that are public.
The one thing a lookup saves is the account's Rust hours and Rust stats, like blocks placed and wood gathered, so every card has more real players to compare with. They're stored under a scrambled code made from the Steam ID with a secret only our server has, never the Steam ID, name or picture. The code means each account counts once and lets us delete it if you ask. It isn't linked to anyone's application or membership. Banned accounts and ones with under 10 hours of Rust aren't saved. They're deleted a year after anyone last looked that account up.
The scores on player cards compare each player with real players: today's members, players looked up here and people who applied to the old CTFO in 2025. For those past applicants we read the public Rust stats of the Steam accounts they applied with and keep only their Rust hours and Rust stats, with no name, Steam ID or link to who they were. Banned and private accounts are left out.
Like any web server, ours keeps a basic log of requests (your IP address, the page asked for and when) so we can spot attacks and fix problems. Those logs are deleted after 14 days.
What we collect
From Discord, when you sign in with it: your Discord ID, your username and the Steam account you've linked to your Discord profile, if you have one.
In the CTFO Discord, our bot sees who's in which voice channel, only so it can tidy away group voice channels once they're empty. That's held in memory while the bot's running and never saved.
From Steam, if you sign in with Steam instead: your Steam ID only. The sign-in happens on Steam's own page, so we never see your password.
Public Steam data for that Steam ID: whether your profile is public, your profile picture, when the account was made, your Steam level, any bans on it, the games on it with their hours, what you've played in the last two weeks and your Rust stats and achievements.
What you tell us when you apply: the month and year you were born, your time zone, when and for how long you usually play, what you like doing, what you're good and not so good at, how good you reckon you are, where you heard about us and anything else you add.
Accounts you name when you apply: the Steam ID and Steam name of up to three people you know. We check those accounts for bans too. They're linked to yours in our records.
Clan records once you're in: your group, your tier, whether you're a group lead, how many weeks you've played Rust since joining (counted from your Rust hours going up), reports and notes made by admins.
Ratings between members: when you give another member a thumbs up or down after playing together, we keep who gave it, who it was for, the reason for a thumbs down and any note you add. Every member can see each other's reputation, the score these add up to. Only admins can see who gave which rating or read the notes. The member rated never finds out who rated them.
On our community server, once it's running: connections, chat and reports, the same as most game servers keep. This applies to everyone who plays there, not just members.
We don't collect your real name, address, date of birth or any payment details. We ask the month and year you were born, never the full date.
Running the clan, nothing else
We use your data to check applications, keep cheaters and throwaway accounts out, re-check members so we notice a new ban or a profile going private, work out reputation and tiers, put people into groups, work out roughly how many members are on at each hour, decide who gets access to what in game, enforce the rules and run the community server.
That's the full list. It isn't used for anything else.
Under UK data protection law, we rely on our legitimate interest in keeping cheaters out and running the clan safely. Where we ask for your agreement to something specific, we rely on that instead. You can change your mind at any time.
Us and only us
Your data is only seen by Natchland and the clan admins they appoint. Group leads see what they need to run their group, like your group and role, not your vetting results or admin notes.
Inside the clan, members can see each other on the members list: Discord name, Steam profile picture and name, tier, reputation, player card and Rust stats. Nobody outside the clan can see the list. Each member's own profile page is public though: their Steam name and picture, Discord name, tier, player card and Rust stats, the same stats the public player lookup shows. Reputation and ratings stay members only.
The one public part is the stats page. It shows clan averages, which never name anyone. It also shows leaderboards of members' Rust stats with their Discord name. The player lookup never says whether someone's a member. You can hide your name from the leaderboards in your account at any time. Your stats still count towards the averages. The home page shows how many members there are and roughly how many are on at each hour, never who.
We don't sell it, rent it, trade it or hand it to anyone for advertising. The only time we'd ever share it is if the law requires us to.
Discord and Steam are separate companies with their own privacy policies. We read from them. The one thing we send back is your roles in the CTFO Discord server (Clan, your tier, Group Lead or Admin), so everyone there can see who's who and the right channels open up for you. Nothing else from your application or stats goes to either of them.
On our own server, locked down
Everything is stored on our own server in Germany, inside the EU. It isn't kept with outside storage, analytics or marketing companies.
Everything between you and us goes over an encrypted connection. Only admins can get to the data, through accounts we control.
No system can promise it'll never be breached. If one ever happened that put your data at risk, we'd tell you and report it to the Information Commissioner's Office as the law requires.
No longer than we need
Applications that don't go through are deleted 90 days after the decision.
Members' data is kept while you're in the clan and deleted 90 days after you leave.
Removals and bans. If you're removed for breaking the rules, we keep your Discord ID, Steam ID and the reason for as long as the ban stands, so the same accounts can't apply again. Nothing else is kept.
Ratings between members are deleted 90 days after they were given or last changed.
Looked up players' hours and stats are deleted a year after anyone last looked that account up.
Server logs from this site are deleted after 14 days.
It's your data
You can ask us for a copy of everything we hold about you, ask us to correct it, ask us to delete it or object to how we use it. Contact us the way shown above and we'll reply within a month.
Deleting your data means leaving the clan, as we can't vet or run a member we hold nothing on. A ban record is the one thing we keep, for the reason above.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.
If this changes
The date at the top shows when this was last changed. Anything that changes how your data is used gets announced in the Discord before it happens.