Privacy Policy

Last updated: 07.10.2026

1. Responsibility for your information

dFxGainwarD, the administrator of xOpsys, is the controller for processing described here relating to the website, account, forms, Rust statistics, APIs, the Discord bot and xOpsys apps linking to this policy. For questions or data requests, contact contact@xopsys.ro. External platforms, including Steam and Tebex, have their own responsibilities and policies.

2. Information and sources

• Technical data: IP address, browser, device, web requests, access times and errors in technical and security logs. IP addresses can indirectly identify people and are not automatically treated as anonymous.
• Accounts: email, username, a hashed password, sign-ins, sessions, roles and selected language. Profiles may include a name, avatar, phone, address, country or birth date if you provide them. Linked sign-in providers may supply an identifier and permitted profile information, not your external account password.
• Steam and Rust: Steam identifier, public name and avatar, and statistics recorded by the server, such as time online, kills, deaths and ranking positions. These come from server activity and Steam interfaces; the website does not invent them.
• Applications and email: name or nickname, email address, subject and message sent to the team. Webmail for authorised users processes messages, recipients, attachments and contacts needed for the service.
• Notifications: apps using Firebase Cloud Messaging send a technical device token and information needed to subscribe or unsubscribe from notifications. The token is not your account password.
• Orders and support: order details and player identifiers needed to grant benefits or investigate a problem. Tebex handles payment through its service; the website does not request full card details in application forms.
• Discord bot: user, server and channel identifiers, names, roles, commands, points, levels and usage counters. AI features send questions, conversation context and, depending on configuration, user and server information to OpenAI, including for image generation. Conversations may be stored by the provider, while the bot stores their identifiers locally for continuity. Not every community message is automatically an AI request; configured commands and channels determine this.

3. Why we use the information

• GDPR Article 6(1)(b), contract or requested pre-contractual steps: account administration, requested features and handling service applications. This includes requested bot features insofar as necessary to provide them.
• Article 6(1)(f), legitimate interests: protecting the community, preventing fraud and abuse, troubleshooting, general correspondence, server administration and public game statistics. Country-based language selection supports accessibility. These interests are balanced against users' rights, including the right to object as provided by law.
• Article 6(1)(c), legal obligations: lawful requests and applicable mandatory records.
• Article 6(1)(a), consent: optional notifications and other processing requiring consent, obtained separately. Visiting a page or reading this notice does not provide blanket consent.

Without the information necessary for sign-in or an application, that feature may be unavailable. Optional profile details are not required for public browsing.

4. Public information and recipients

Names, avatars and statistics in profiles and leaderboards are publicly accessible and may also be supplied by the Rust statistics API. Blog posts are available through a public API. Others may index or reuse this information; its public nature does not remove your data rights. Form messages and account emails are not automatically published.

Authorised team members and hosting, email and infrastructure providers may access information needed for their tasks. Steam provides profile data, Google supports reCAPTCHA and Firebase notifications, and Tebex processes shop orders. Authorities and advisers involved in a dispute may receive information as permitted by law. We do not sell personal data for advertising.

Bot messages and replies are visible according to Discord channel permissions. Discord supplies interactions, OpenAI processes AI requests, and media providers may receive searches or requested resource addresses. See the policies of Discord and OpenAI. Use AI channels with this processing in mind and avoid unnecessary personal information.

5. Cookies, language and external services

• Session and persistent sign-in cookies and preferences support accounts and website functionality. Some remain after the browser closes. You can sign out, revoke sessions available in your account or clear cookies. Blocking necessary cookies may prevent sign-in.
• When the account language is not used, your IP may be sent to country.is to determine your country and select a language. This feature does not use GPS location.
• Google reCAPTCHA assesses form abuse risk and may process IP and browser data, loading Google resources and cookies including _GRECAPTCHA. The script may load without a visible form. See Google's privacy policy.
• Loading external avatars and resources may send your IP and technical data to the provider. Steam, Tebex, the voting website and social networks apply their policies when used. See the Valve privacy policy and Tebex privacy policy.
• The current website configuration does not integrate Google Analytics, AdSense or advertising pixels. Any future non-essential technologies require notice and, where required, consent before activation. This policy does not replace that consent.

6. Retention, transfers and protection

Account and session data support the active relationship and related features. Applications and correspondence are retained as needed to handle them and substantiate the outcome. Statistics support gameplay history and rankings; you may request assessment of erasure or anonymisation. Moderation evidence and technical logs follow security and legal-claim needs, while mandatory documents follow the law. Notification tokens support subscriptions until unsubscribe or invalidation; notifications can also be disabled in the operating system.

There is no single retention period for every category. Erasure is assessed against legal duties, disputes and backup rotation. Contact us for the period or criteria applicable to your information. Closing Discord does not automatically erase AI context stored with the provider; you may request removal of the conversation and its associated identifiers through the contact address.

Providers may process information outside the European Economic Area. Transfers subject to GDPR require an adequacy decision or appropriate safeguards, such as standard contractual clauses, and additional measures where necessary. You may request recipient and safeguard details. Using the service is not blanket consent to transfers. Security measures include permission checks and hashed passwords, without a guarantee of absolute security.

7. Your rights and automated measures

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent. Withdrawal does not affect earlier lawful processing. Some information may remain necessary for legal duties or legal claims.

Rankings are calculated automatically from game data. For an automated sanction or restriction, you can request reasons and human review. This does not limit legal safeguards concerning solely automated decisions with significant effects.

Contact us identifying your account without sending your password. Identity checks must be proportionate. We normally respond within one month; a lawful extension of up to two further months must be explained in the first month. You may complain to ANSPDCP or the competent authority in your country and seek a judicial remedy.

8. Minors and updates

Respect connected platforms' age requirements and rules protecting minors. Do not submit children's sensitive information in forms. A legal representative may contact us about a minor's information as provided by law.

Updates are dated on this page. Significant changes require appropriate notice and fresh consent where legally required. This policy is interpreted in accordance with GDPR.