Privacy Policy

1.1. This Privacy Policy (the “Policy”) describes what personal data is processed when using the RustOtvet website (rustotvet.ru) and the Doodle program (together, the “Service”), for what purpose, how long it is stored and what rights the user has.

1.2. The personal data operator is the Service administration (the “Administration”). Requests about data processing are accepted at rustotvet@gmail.com.

1.3. By using the Service, the user confirms that they have read and agree to the Policy. Terms not defined in the Policy have the meaning given in the Terms of Service.

1.4. The Administration does not sell personal data or share it for advertising.

2.1. Account data. SteamID, public Steam name and avatar; for accounts created earlier via Google — the Google account ID, name and avatar link. Needed for login and showing authorship. The Service does not receive passwords or email addresses: the password is entered on the Steam or Google side. Stored while the account exists.

2.2. User content. Published questions, answers, comments and votes. Stored until the user deletes them or deletes the account.

2.3. Login history. A hash of the IP address, the login method and the User-Agent string (browser and device) for each login. The IP address itself is not stored: the hash cannot be turned back into an address but can be compared with another hash to link a violator's accounts or spot suspicious activity. Deleted after 365 days.

2.4. Player tracker queries. What was searched and when — for lookup rate limits and balance charges. Stored for 60 days.

2.5. Tracker lookup history. A snapshot of each paid lookup so the user can open it again without paying. The last 100 lookups per account are kept.

2.6. Top-ups and payments. Request contents (skin names and amounts), Steam trade IDs, amount, status and payment ID, and the balance transaction log. Needed to credit the balance exactly once and resolve disputes. Stored for at least five years as settlement records.

2.7. Subscription, clan, promo codes. Plan and term, clan members and invite code, promo code activation marks. Stored while the account exists.

2.8. Doodle. The program key, a computer fingerprint (a hash of hardware characteristics that ties the key to one computer), the program installation key, an IP address hash and the time of the last request — stored while the key is active. The picture the user paints is sent to the Service server to compute the drawing; the log records the time, key, quality, size, IP address hash and a reduced copy of the picture — to handle complaints and detect key sharing. Only the Administration sees the log; records are deleted after 90 days.

2.9. Support tickets. The conversation text, topic and status; for tickets without login — the contact method provided and an IP address hash for spam protection. Stored for three years.

2.10. Anonymised visit statistics. Page address, device type, browser and OS, country, referral source, time on page and scroll depth. Instead of the IP address — an irreversible daily hash; page views of one visit are linked by a random identifier in a cookie that lives 30 minutes and is not tied to the account. Deleted after 90 days.

2.11. Calculator usage. What was selected in the raid or recycling calculator, the time, IP address and account if the user is logged in. Needed to track load and detect automated requests. Only the Administration sees it; deleted after 90 days.

3.1. The tracker shows information about players the user looks up. This information comes from public sources (the official Steam Web API, public server lists) and is open to anyone at the time of the lookup. The Administration does not collect it in bulk or sell it.

3.2. Only the snapshot of a paid lookup is saved in the user's history. It is visible to that user and the Administration.

3.3. The Service does not receive Steam data hidden by privacy settings. If a player has hidden their hours in Steam, the tracker may show a lower estimate — time on game servers from open server data.

3.4. A player who does not want their profile to be found through the tracker may contact support. The exclusion works by SteamID, so changing the name or profile link does not bypass it.

4.1. The Service uses cookies:

• a session cookie — keeps the user logged in (7 days, httpOnly);
• the “Anonymous” switch for posts (30 days);
• an invite code — if the user came via a friend's link;
• the choice made in the analytics consent banner;
• a visit counter — a visit ID (30 minutes), a “visited before” mark (1 year) and the first referral source (90 days), all httpOnly and not tied to identity.

4.2. If “Only necessary cookies” is chosen, the visit counter and third-party analytics cookies are not set.

5.1. The Service keeps its own anonymised statistics described in clause 2.10.

5.2. Only with the user's explicit consent, Yandex.Metrica with Webvisor is loaded. This service may set cookies, receive technical information about the device and record actions on the page.

5.3. Consent can be withdrawn by deleting the site's cookies in the browser, or Metrica can be disabled with the official blocker.

6.1. Data is processed only by services the Service cannot work without:

• SPRINTHOST.RU — site hosting (Russia): sees technical request data (IP address, User-Agent) in server logs;
• AdminVPS — the Doodle drawing server (Russia);
• Supabase — database (USA): stores the data listed in section 2;
• Valve Corporation — Steam login, public profile data, inventory and skin prices, trades for balance top-ups;
• payment provider — accepting money payments: the user enters card or account details on the provider's side; the Service does not receive them and only gets the amount, status and payment ID;
• Yandex.Metrica — analytics, only with the user's consent (Russia).

6.2. Transfer of data to foreign services (Supabase, Valve) is technically necessary and limited to the purposes and scope stated in section 2.

6.3. Data may be provided to public authorities only in cases expressly required by law.

7.1. Only the Administration has access to the data. The connection to the site is protected by HTTPS; service access keys for the database and the drawing server are stored outside the code and are not sent to the browser.

7.2. Where possible, IP addresses are stored as an irreversible hash (clauses 2.3, 2.8, 2.9, 2.10).

8.1. Delete your questions, answers and comments — with the “Delete” button on the post.

8.2. Delete your account — with the button on the “Balance” page or by email to rustotvet@gmail.com. Login links, login history, notifications and sessions are deleted; posts remain anonymised; settlement records are kept for the period stated in clause 2.6.

8.3. Withdraw consent to analytics — by choosing “Only necessary cookies” or deleting the site's cookies.

8.4. Find out what data about you is stored and request its correction or deletion — by email to rustotvet@gmail.com. A reply is sent within 30 days.

8.5. The Service is intended for persons aged 18 and over (see the Terms of Service).

9.1. The Administration may change the Policy. The new version is published on this page.

9.2. Continuing to use the Service after a new version is published means agreeing to it.

10.1. For questions about personal data processing: rustotvet@gmail.com or rustotvet.ru/en/support.