Privacy Policy

1. General Information

The protection of your personal data is important to us. This Privacy Policy explains what personal data ONIRust collects, how we use it, and what rights you have under applicable data protection laws, including the General Data Protection Regulation (GDPR).

Personal data is any information that can be used to identify you personally.

2. Responsible Party

The responsible party for data processing on this website is:

ONIRust

Owner: Onur Can Hira

Address:

Illerstraße 201

89079 Ulm

Germany

Contact:

Phone: +49 152 04145335

Email: [email protected]

Last updated: 19 September 2026.

3. Data Collection on This Website

Website Access Data

When you visit our website, technical information may automatically be collected by our hosting provider.

This information may include:

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Requested pages
• Referrer URL

This data is processed to ensure the security, stability, and proper operation of our website.

The legal basis for this processing is Art. 6 para. 1 lit. f GDPR.

Account Data

There is no ONIRust password account. You sign in with Discord and with Steam, and we store what those services tell us about you:

• From Discord: your user ID, username, display name and avatar; whether you are a member of our Discord; and, for the time it is valid, the access token that lets our "join the Discord" button add you to our server on your request
• From Steam: your SteamID64, display name, avatar and profile URL; whether your profile is public; when the account was created; your Rust playtime; and Steam's own ban record for the account (VAC and game bans)
• The link between your Discord and Steam accounts
• Purchase information (which rank, when, the Stripe references for the payment - never card details)

This data is used to sign you in, to check tournament eligibility (playtime, account age, ban record), to put you on the tournament server's whitelist, to grant purchased ranks and Discord roles, to provide support and to protect our services against abuse. The legal basis is Art. 6 para. 1 lit. b GDPR (performing the contract you enter by registering or purchasing) and, for the abuse-prevention checks, Art. 6 para. 1 lit. f GDPR.

Steam data is retrieved from Valve's Steam Web API (Valve Corporation, USA) and Discord data from Discord's API (Discord Inc., USA); both receive the request needed to answer it. Playtime is refreshed periodically while you are on a tournament roster.

What you must provide

To register for a tournament you must sign in with Discord and Steam, let us read the Steam data described above and answer the registration form; without them we cannot admit you. To buy a rank you must sign in with Steam; linking a Discord account is optional and only decides which Discord account receives the role. To receive a prize you must give the payout or shipping details described in section 8 of the Terms of Service; without them the prize is treated as declined (section 8.9 of the Terms of Service). Everything else, for example asking the support assistant, is voluntary.

Game Server and Tournament Data

When you connect to the tournament server, the game server and our tools record:

• Your SteamID, in-game name and the IP address you connect from, plus the country that address resolves to
• Connection times and playtime on our server
• In-game chat messages
• In-game events: kills, deaths, weapon and distance, raids, positions on the map, team membership
• Reports made about you or by you, and moderation actions (warnings, mutes, kicks, bans) with their reasons

We use this data to run the tournament (standings, statistics, the live feed), to moderate the server and to investigate cheating and rule breaches. Standings, statistics and in-game events of a tournament are shown publicly on this website under your Steam and Discord display names; chat, IP addresses, reports and moderation records are visible to our staff only. The legal basis is Art. 6 para. 1 lit. b GDPR (running the tournament you entered) and Art. 6 para. 1 lit. f GDPR (our legitimate interest in fair play and a safe server).

To show staff which country a connection comes from, the IP address is sent over an unencrypted connection to the geolocation service ip-api.com (Artia International S.R.L., Romania). Only the IP address is sent; ip-api.com states that it keeps it in memory for at most one minute and does not log it.

Moderation records, including bans, are kept for as long as they are needed to enforce our rules; the periods are listed in section 7. In-game chat, the kill and event log and the connection log of the staff panel are deleted 30 days after they were recorded. The last IP address and country we saw you connect from are deleted 30 days after your last connection. The tournament's own results, statistics and kill feed are kept for that tournament and for our archive of past tournaments (section 7).

Registration and rules acceptance

When you register for a tournament, or accept an invitation to a team, we record your answers to the registration form, the team you join and your acceptance of the Tournament Rules, the Terms of Service and this Privacy Policy: which version you accepted and when, and whether you confirmed that you are 18 or older or that a parent or guardian has consented to your taking part (section 10). Invited players give the same confirmations when they join a team.

We need this record to run the tournament you entered and, afterwards, to show which rules applied to you if a result, sanction or prize is questioned. The legal basis is Art. 6 para. 1 lit. b GDPR while the tournament runs and Art. 6 para. 1 lit. f GDPR (establishing or defending legal claims) afterwards. The record is kept for three years from the end of the year in which the tournament ended, the general limitation period (§§ 195, 199 BGB), or longer while a dispute about that tournament is still open.

Investigations, POV footage and sanctions

When a rule breach is reported or suspected, our staff investigate; before prizes are confirmed, staff also verify prize-winning results. Depending on the case, we process:

• Reports made about you or by you, including who made them; the reporter's identity is visible to staff only and is not disclosed to the reported player
• Server logs and in-game data of the kind described above, and the results of our eligibility checks
• Recordings you deliver on request under the Tournament Rules (POV footage), when a case needs them or to verify a prize-winning result: your gameplay, your voice if your recording includes it and, unavoidably, the voices, names and chat of your teammates and of other players who appear in the recording
• Your answers to staff questions and the correspondence about an appeal, by email or in your team's chat with staff
• The decision, the rule it is based on and any sanction: a warning, a point deduction, removal from a match or tournament, a ban, or an entry on our blacklist of players excluded from future tournaments

Evidence, reports and internal notes are seen by staff only. When staff take a measure against you, the notice names the rule, the situation it concerns (when, where and what staff observed, in enough detail for you to respond to it) and the measure. It does not disclose our detection methods, raw anti-cheat data, the identity of anyone who reported you or other players' data. Your right of access under Art. 15 GDPR is not affected (section 8): on request we give you the personal data we hold about you, including the data behind a sanction; we redact or withhold the parts that would reveal other people's data, such as who reported you, or our detection methods (Art. 15 para. 4 GDPR, § 29 para. 1 sentence 2 BDSG), and we tell you when we have done so.

Publicly we announce only the team or player and the measure, marked as under review (an appeal is possible within 48 hours) until the appeal window has closed or the appeal is decided; the rule concerned is named only once the decision is final, and then as our decision. We never publish evidence, details of the review or who reported. If a measure is lifted or changed, we announce that in the same place and amend the original announcement, and after the tournament you can ask us to replace your name in an archived announcement with a neutral label. Other people who appear in your footage are processed on the basis of Art. 6 para. 1 lit. f GDPR, because a match cannot be investigated without seeing everyone in it; deliver only the footage staff ask for, and send it to staff only, by email or in a direct message to the staff member who asked, not in the team chat, unless staff say otherwise. The eligibility checks described in section 8 run automatically but only flag a player; a staff member reviews every flag before anything happens.

The legal basis is Art. 6 para. 1 lit. b GDPR (the Tournament Rules and section 7 of the Terms of Service, which you accepted when registering) and Art. 6 para. 1 lit. f GDPR (fair play for every participant, and defending our decisions). We delete our copy of POV footage and the link to it 90 days after the end of the tournament or, where a dispute about it is still open, when that dispute is closed; a recording you uploaded to a video platform stays under your control, so delete it there once that period has passed. Reports and moderation records are kept as long as they are needed to enforce our rules, and bans until they are lifted or expire. A blacklist entry is kept until it is lifted; we review every entry at the latest five years after it was made and delete it unless a specific reason to keep it is recorded. The decision itself is kept for as long as the sanction stands and for three years from the end of the year in which the tournament ended, whichever is longer.

Publication of results, streams and recordings

Tournaments are public competitions. Standings, results, statistics, team names and emblems are published on this website and in our Discord under your Steam and Discord display names, and they stay in the public archive of past tournaments. ONI may also cast, stream and record its tournaments (section 9 of the Terms of Service). A cast or recording can show your display name, your in-game name and actions, chat shown on screen, and in-game voice that the caster's or a spectator's game client picks up. We do not record or broadcast your team's Discord voice channel unless every member of that team has agreed to it separately for that tournament (Art. 6 para. 1 lit. a GDPR); you can withdraw that agreement at any time with effect for the future (Art. 7 para. 3 GDPR), and a player under 16 needs a parent's or guardian's agreement (Art. 8 GDPR). We publish recordings on our own channels; video platforms such as YouTube, Twitch or Discord process their viewers' data under their own privacy policies.

The legal basis is Art. 6 para. 1 lit. b GDPR for the published results, which are part of the competition you entered, and Art. 6 para. 1 lit. f GDPR for casts and recordings (documenting and promoting the tournament). Results and standings stay under your display names while the tournament runs; afterwards you can ask us to replace your name in the archive with a neutral label. You can object at any time to the promotional use of your name, team name, emblem, avatar or voice; we then make no new promotional use of them, while existing casts, VODs, standings and the archive remain (section 9.2 of the Terms of Service). You can also object to a particular passage of a cast or recording for reasons arising from your situation (section 8); we will then cut, blur or mute it unless we have compelling reasons to keep it, for example because it documents a ruling that is still contested.

Prizes: payout and shipping

To pay out or ship a prize we ask the winner, usually the team captain, for what the payout needs and nothing more: your legal name, your address and a payment reference (the account details for the payout method we agree on, for example a PayPal address or an IBAN) and, for a physical prize, a shipping address and a phone number where the carrier needs one. Where the captain is under 18, or a notified split allocates a share to a member under 18, we need the same from that player's parent or guardian, who receives that part of the prize. We keep a record of the payout or shipment: the amount or item, the date and the payment or tracking reference.

Recipients are the payment provider or bank that carries out the payout and, for a physical prize, the shipping carrier, each receiving only what it needs for its part. Before a payout we check the recipient's name against the consolidated list of persons subject to EU financial sanctions, because EU sanctions regulations forbid us to make funds available to a listed person; a confirmed match stops the payout, and the result of the check is noted in the payout record. Your address and payment details are confidential: they are shared only with the carrier or payment provider, never published, and stored with appropriate safeguards.

The legal basis is Art. 6 para. 1 lit. b GDPR (fulfilling the prize under section 8 of the Terms of Service) and Art. 6 para. 1 lit. c GDPR for the sanctions check and for keeping accounting records. Prize and shipping records are kept until the prize is fulfilled and for eight years after that, counted from the end of the calendar year in which the prize was fulfilled (§ 147 (3), (4) AO); the tax office may inspect the records.

Discord Community

Our Discord server is operated on Discord's platform under Discord's own privacy policy. Our bot reads messages in that server to run tournament features (registration, team channels, announcements) and a support assistant, and it stores messages that staff post in designated knowledge channels, under the staff member's display name, as the knowledge the assistant answers from (Art. 6 para. 1 lit. b and f GDPR). Only messages that mention the assistant are sent to Google; everything else stays with us.

When you address the support assistant by mentioning the bot, your question is answered by Google's Gemini model through the Gemini API (Google Ireland Limited, Ireland, and Google LLC, USA; transfers to the USA rely on the EU-US Data Privacy Framework). Google receives the text of your question, your own earlier questions to the assistant and its answers in that channel, which we keep in memory for at most six hours so that follow-up questions make sense, and the support knowledge our staff have taught the bot, which carries the staff member's display name. It never receives your Discord ID, your username or your IP address, but it will see anything you type into the question yourself, so do not put personal data into a question. Google processes this under its Gemini API terms to generate the answer. The legal basis is Art. 6 para. 1 lit. f GDPR, our legitimate interest in answering support questions quickly at any hour. If you prefer not to use the assistant, ask our staff directly in the same channel.

4. Payment Processing

When purchasing products or services from ONIRust, payments are processed through external payment providers.

We do not store complete payment information such as credit card numbers or banking details.

Payment providers process payment data according to their own privacy policies.

5. Cookies

Our website may use cookies to provide essential functionality, including:

• Account sessions (oni_session, a signed cookie holding your Discord and Steam identifiers, valid 30 days)
• Security features (short-lived cookies that protect the Discord sign-in against forgery, deleted when the sign-in finishes)
• Website functionality (a language choice or a remembered tab, stored in your browser only)

We use no analytics or advertising cookies. Optional cookies or analytics services would only be used with your consent where required.

You can manage or disable cookies through your browser settings.

6. Data Sharing

We do not sell, rent, or trade your personal data.

We share personal data only where it is necessary to provide our services or to fulfil a prize, or where the law requires or allows it:

• Hosting: our website, game server and databases run on a dedicated server rented from OVH (OVH SAS, France)
• Content delivery and protection: onicup.com is served through Cloudflare (Cloudflare, Inc., USA), which sees the traffic to the website, including your IP address, to filter attacks
• Payments: Stripe (Stripe Payments Europe, Ltd., Ireland); we receive a confirmation of payment and a customer reference, never your card details
• Sign-in and account data: Valve (Steam) and Discord, as described above
• Country lookup of game-server connections: ip-api.com (Artia International S.R.L., Romania), as described above
• Support assistant in our Discord: Google (Google Ireland Limited, Ireland / Google LLC, USA) through the Gemini API, as described above
• Prize payouts: the payment provider or bank that carries out the payout, which receives the winner's name and account details
• Physical prizes: the shipping carrier, which receives the winner's name and shipping address and, where it needs one, a phone number
• Authorities and courts, where the law requires it or where it is necessary to establish, exercise or defend legal claims

Where a provider is outside the EU/EEA (Cloudflare, Valve, Discord and Google LLC in the USA), transfers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses. These providers process data according to applicable data protection laws.

7. Data Storage and Deletion

We keep personal data only as long as the purpose it was collected for requires, or as long as the law obliges us to. In detail:

• Session cookie: 30 days from sign-in
• Web server access logs: at most 15 days (rotated daily, 14 archived days), unless an entry is needed to investigate an attack
• Account and link data (Discord, Steam, the link between them, the Steam trust signals): while your account exists; deleted when you unlink or ask us to delete your account, unless a purchase record or a standing sanction requires part of it to stay
• Purchase records (which rank, when, the Stripe references): eight years after the end of the year of purchase (§ 147 (3) AO)
• Tournament data (registrations, rosters, results, statistics, in-game events): for the tournament and afterwards in the public archive of past tournaments, under your display names until you ask us to replace them with a neutral label
• In-game chat, and the kill and event log of the staff panel: 30 days after the entry was recorded
• Connection log of the staff panel (connections with IP address and country): 30 days after the entry was recorded; the last IP address and country we saw you connect from: 30 days after your last connection
• Reports and moderation records: as long as they are needed to enforce our rules
• Bans: until lifted or expired. Blacklist entries: until lifted; every entry is reviewed at the latest five years after it was made and deleted unless a specific reason to keep it is recorded
• POV footage delivered to staff (our copy and the link): 90 days after the end of the tournament, or until a dispute about it is closed if that is later
• Prize and shipping records: until the prize is fulfilled and eight years after that, counted from the end of the calendar year of fulfilment (§ 147 (3), (4) AO)
• Records of your rules acceptance and of decisions taken about you: three years from the end of the year in which the tournament ended (§§ 195, 199 BGB), or as long as a sanction stands
• Support-assistant conversation memory (your questions to the assistant and its answers): at most six hours
• Support emails and inquiries: until the matter is closed, and afterwards only as long as the exchange may matter for a legal claim

When a period ends and no legal obligation requires us to keep the data, it is deleted or anonymised.

8. Your Rights under the GDPR

You have the right to:

• Access your personal data (Art. 15 GDPR), including the data behind a sanction, with the limits of Art. 15 para. 4 GDPR (section 3)
• Request correction of inaccurate data (Art. 16 GDPR)
• Request deletion of your data (Art. 17 GDPR)
• Request restriction of processing (Art. 18 GDPR)
• Object to processing (Art. 21 GDPR, see below)
• Request data portability (Art. 20 GDPR)

If processing is based on your consent, for example the agreement to record or broadcast your team's Discord voice channel, you may withdraw your consent at any time with effect for the future; this does not affect processing that took place before you withdrew it.

Your right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR), that is for casts and recordings of tournaments, abuse-prevention and fair-play checks, the country lookup of connections, the support assistant, the blacklist, your appearance in other players' POV footage, and keeping acceptance and decision records after a tournament, you have the right to object at any time for reasons arising from your particular situation by emailing [email protected]. We will then stop processing that data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. We do not use your data for direct marketing; if we ever did, you could object to that without giving any reason and we would stop at once.

How to exercise your rights

To exercise any of these rights, email [email protected] and include the Discord user ID or SteamID64 you signed in with, or message our staff from that Discord account, so that we can match the request to your data without asking for more. We may ask a short follow-up question if we are not sure the request is yours. We answer within one month; if a request is complex we may extend this by up to two further months and will tell you why (Art. 12 para. 3 GDPR). Exercising your rights is free of charge.

Automated checks: eligibility checks (playtime, account age, ban record) run automatically and can only flag a player; staff take every decision that affects participation or prizes (Art. 22 GDPR).

9. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority if you believe that we process your personal data unlawfully. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Lautenschlagerstraße 20

70173 Stuttgart

Germany

You may also complain to the supervisory authority of the EU member state in which you live or work. We would welcome the chance to address your concern first, but you do not have to contact us before complaining.

10. Children and Young People

Our tournaments and store are aimed at players who are 18 or older. A player under 18 may take part in a tournament only with the consent of a parent or legal guardian (§§ 107, 108 BGB); registration asks you to confirm that this consent exists, and we may ask the guardian to confirm it, at the latest before a prize is confirmed. If we do, we keep the confirmation and the contact details used for it with your registration record (Art. 6 para. 1 lit. b GDPR). Where we rely on your consent, for example to record or broadcast your team's Discord voice channel, a player under 16 needs the consent of a parent or guardian (Art. 8 GDPR). Discord and Steam set their own minimum ages, and we do not knowingly collect data from anyone under 13, Discord's minimum age. If you are a parent or guardian, you can exercise the rights in section 8 for your child, and you can ask us to delete data we collected from a child without your permission. If we learn that we hold such data, we delete it.

11. Changes to This Policy

We update this policy when our services or the law change, for example when we add a service provider. The current version is always published here with its date. If a change alters how we use data we already hold about you in a way you would not expect, we announce it in our Discord and on this website at least 14 days before it applies, where the law lets us wait that long. Earlier versions are available on request.