Privacy policy

Controller

Meitaim OÜ

Registry code

17035899

Registered in

Estonia

Privacy questions and rights requests go to privacy@meitaim.dev.

You sign in to Steamer with your Discord account. Without one you cannot use the dashboard. Discord asks you to let Steamer read your profile. When Steamer's access rules name a Discord server, Discord also asks you to let Steamer read your member information. Discord's grant covers your membership in every server you are in, but Steamer reads only the servers its rules name.

From your profile Steamer keeps two things: your Discord account ID and your display name. It never asks for your email address. For each Discord server its access rules name, Steamer reads whether you are a member and which roles you hold there. Those roles decide what you may read.

Steamer stores these with your session, together with the refresh token Discord issues, so it can check your roles again later. It uses Discord's access token only while it reads your profile and roles, and does not store it.

While you sign in, Steamer's API sets one cookie: steamer_sign_in_browser when you sign in to the dashboard, steamer_sign_in_client when you sign in to another app. It holds a random value that proves the sign-in started in your browser, nothing about you. The API deletes it when Discord sends you back. If you never come back, your browser deletes it when you close it. A sign-in must finish within 10 minutes. Steamer's own record of the sign-in is deleted when Discord sends you back, or at most a day and an hour after those 10 minutes.

After you sign in, Steamer gives the dashboard an access token that works for one hour and a refresh token that works for up to 30 days. Steamer stores only a SHA-256 hash of each token, so a copy of its database cannot sign anyone in as you. It records when your access token was last used.

The dashboard keeps both tokens in your browser's local storage, under the name steamer.token, so you stay signed in across tabs. It keeps nothing else there. The tokens never leave your device except to reach Steamer's API. The dashboard receives them in the part of the address after the # sign, which your browser does not send to any server.

When the access token runs out, the dashboard asks for a new one. Each time, Steamer asks Discord to confirm your account again and reads your memberships and roles again. If Discord no longer confirms you, or your roles no longer grant access, your session ends.

The Steamer bot sees when a member's roles change, a member leaves or a role is deleted, in the Discord servers it is in. If that changes your roles in a server Steamer's access rules name, Steamer makes your session check with Discord again. It does not store these events.

Signing out deletes the tokens from your browser and asks Steamer to delete your session, its tokens and its stored roles. If that request does not reach Steamer, the session stays until it ends on its own. Every session ends 30 days after you signed in, whether you use it or not.

People who manage a Discord server can use the Steamer bot to subscribe that server to changes, such as new bans or changes to official servers. For each subscription Steamer stores the Discord account ID of the person who created it, the Discord server, the channel or webhook it posts to, what it watches, an optional note and when it was created.

People who may read that Discord server's subscriptions on the dashboard see the creator's account ID and the note. If Steamer loses permission to post, it stops the subscription and keeps it until someone resumes or removes it. If the channel or webhook is deleted, Steamer deletes the subscription. Either way it tries to tell the creator in a direct message on Discord.

Steamer records the Rust servers that Facepunch and Steam list in public. From the Facepunch list it records each server's address, port, name, map, tags, country, continent, latitude and longitude. From the Steam list it also records the server's Steam ID and operating system. It asks each server for the details every game client can see: name, map, tags, rules, and how many players and bots are on it. It never asks a server who its players are, and it records no player names or Steam accounts of players.

It also records what Facepunch publishes: the server addresses and name patterns Facepunch bans or blocks, the official servers, and the Steam account IDs and levels of the people Facepunch lists as game administrators. It looks up which network and country each server address belongs to in a database it downloads from IPinfo. Steamer sends IPinfo nothing about you.

A server address can identify a person, for example when someone runs a server at home. For such a server, the latitude and longitude are an approximate location of that home. Steamer keeps what it records as a history, and that history is what people who sign in read.

The dashboard has no tracking script. Its scripts, fonts and images come from its own domain. Apart from the sign-in with Discord, the only other host it contacts is Steamer's API.

Steamer counts sign-in and token requests from each IP address to stop abuse, 30 in any one minute. It keeps these counts in memory for that minute and never writes them down.

Cloudflare serves the dashboard and sits in front of the API. It records each request in a log, which includes your IP address, the page or address requested, the time and your browser's user agent string.

The API and the bot record logs and traces: which requests arrived, how long they took, and what failed. Some of these carry Discord account IDs and session IDs. We collect them ourselves, and no outside monitoring service receives them.

We use these logs and traces to keep Steamer running and to stop abuse, and we do not build a profile from them.

To sign you in and keep you signed in

We process your Discord account ID, name, roles and tokens to give you the access you asked for. The basis is performance of our contract with you, the terms of service.

To keep access current

We check your roles again when your token renews and when the bot sees them change. The basis is our legitimate interest in letting only people our access rules admit read Steamer.

To deliver notifications

We keep a subscription and tell its creator when it stops. The basis is performance of our contract with the person who created it.

To record game servers

We record what servers and Facepunch publish, including server addresses and administrator IDs. The basis is our legitimate interest in keeping an accurate history of Rust servers for the people who use Steamer.

To protect the service

We use IP addresses, logs and traces to detect and stop abuse and to fix faults. The basis is our legitimate interest in protecting our systems.

To meet legal duties

We disclose data where the law requires it. The basis is our legal obligation.

We do not sell personal data and we do not share it for advertising.

Discord signs you in, tells Steamer your roles, and carries the Steamer bot's messages. It does this as a separate controller, under its own privacy policy, and not on our behalf. What you do on Discord, including your use of the bot, is also subject to Discord's terms.

This provider processes personal data on our behalf:

Cloudflare

Serves the dashboard, sits in front of Steamer's API, and records the request logs described above.

Cloudflare is based in the United States and may process data there. Where it does, the transfer relies on the safeguards the GDPR requires, such as the EU-U.S. Data Privacy Framework or standard contractual clauses.

Other people who sign in to Steamer see the game server history, and people who may read a Discord server's subscriptions see who created them. An app you let sign in to Steamer receives what you may read. We also disclose data where the law requires it.

A sign-in in progress

The cookie goes when Discord sends you back, or when you close your browser. Steamer's record of the sign-in goes when you return, or at most a day and an hour after the 10 minutes a sign-in may take.

Your session

Your account ID, name, Discord refresh token and roles stay until Steamer receives your sign-out, until a renewal ends the session, or for 30 days after you signed in, whichever comes first. Steamer deletes expired sessions within the hour.

Token hashes

One hour for an access token, up to 30 days for a refresh token, and never past the end of the session. A refresh token works once: using it replaces both tokens.

Tokens in your browser

Until you sign out, the session ends, or you clear your browser's storage.

Subscriptions

Until someone removes the subscription, or until Steamer can reach neither its channel nor its creator.

Request counts

One minute, in memory.

Steamer's logs and traces

28 days, then deleted.

Cloudflare's request logs

As long as Cloudflare keeps them. Cloudflare sets that period, not Steamer.

Game server history

Kept with no fixed end, because the history is what Steamer offers. Ask us and we review whether to remove an address or ID that identifies you.

Under the GDPR you have the right to:

• Ask for a copy of your personal data.
• Have inaccurate or incomplete data corrected.
• Have your data deleted.
• Have our processing restricted.
• Object to processing we base on legitimate interest.
• Receive your data in a structured, commonly used format.

Signing out asks Steamer to delete your session. To remove a subscription, use the bot's /subscriptions remove command in that Discord server, or ask us.

We answer within one month. If a request is complex we may extend that by two further months, and we tell you inside the first month if we do. If we take no action, we tell you why inside the first month.

You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or to the supervisory authority where you live.

To exercise any of these rights, write to privacy@meitaim.dev.

We may change this policy. The date above marks this version.