Privacy policy

1. Who we are

Codelock (codelock.top) is a companion web service for the game Rust: notifications, device control, team, map and tracking through Rust+. Codelock is not affiliated with Facepunch Studios, Valve or BattleMetrics. For anything about personal data, write to [email protected].

2. What we process

• Steam account: SteamID, nickname and avatar — public data of the profile you sign in with.
• Email, if you give one: service emails and reminders; news only with separate consent.
• Rust+ link: the Facepunch token and player tokens for servers (stored encrypted), servers, your team (names, positions, online status, deaths — as Rust+ shows them), devices, their state and events.
• Codelock browser extension: it works only on the Codelock website and on the Facepunch page companion-rust.facepunch.com. After you sign in with Steam it sends your SteamID and the Rust+ token issued by Facepunch, together with a one-time code from the website, to your Codelock account (HTTPS only). In the browser it keeps only that code and the linking status, until the browser closes; it never stores the token. The extension does not see your Steam password, browsing history or the content of other websites.
• Notification channels: Telegram chat ID, Discord ID and name, browser push subscription addresses.
• Tracking: public BattleMetrics data about players your team added (name, presence on the server, sessions).
• Access: access periods and redeemed promo codes. We never receive card data — the payment provider handles it.
• Technical data: session, anti-forgery, language and theme cookies; an irreversible keyed hash of the IP address in the security log; notification delivery logs.

3. Why and on what basis

• To provide the service you use (contract): sign-in, connections to Rust servers, notifications, map, commands, tracking.
• Security and abuse prevention (legitimate interest): security log, attempt limits, blocking abusers.
• Codelock news and browser notifications — only with your consent, which you can withdraw at any time.
• Tracking other players: your team’s legitimate interest, public BattleMetrics data only; a player can ask us to remove them from every list.

4. How long we keep it

• Event feed and tracking sessions — 14 days; notification delivery logs — 30 days; security log — 1 year.
• After an account is deleted its data is kept for 30 days (so it can be restored), then erased for good.
• Encrypted database backups are kept up to 3 months and removed on schedule.

5. Who receives it

We do not sell data or show ads. Data is processed only by providers the service cannot work without:

• hosting (a server in the EU);
• Sentry — error reports without personal data;
• the email provider — for emails;
• Telegram and Discord — when you connect them; Facepunch (Rust+) and Steam — for the game and sign-in; BattleMetrics — for tracking.

6. Security

Rust+ tokens and other secrets are encrypted, connections are HTTPS only, sessions are stored as hashes, admins sign in with a second factor and their actions are logged.

7. Your rights

• Get a copy of your data — the “Download my data” button on the account page.
• Delete your account and data — the “Delete account” button.
• Correct your data, restrict or object to processing, withdraw consent — write to us.
• Complain to a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the data protection authority of your country.

8. Cookies

We use necessary cookies only: session, anti-forgery, language and theme. There are no advertising or analytics cookies, hence no consent banner.

9. Age and changes

The service is meant for people aged 16 and over. We will announce material changes to this policy on the site or by email.