Privacy Policy

1. Overview

Oil Team ("we", "us", "our") runs a competitive Rust event platform. This Privacy Policy explains what personal information we collect when you use our website, how we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to everyone who visits or creates an account on Oil Team, anywhere in the world.

In short: we collect what we need to run tournaments — your Steam identity, optionally your Discord identity, and the statistics generated when you play. We publish your in-game name, Steam avatar, and tournament results on public leaderboards. We do not sell your information, we do not run advertising, and we do not use your data to train AI models.

For the EU and UK General Data Protection Regulation ("GDPR"), Oil Team is the controller of your information. For the California Consumer Privacy Act ("CCPA") and similar US state laws, Oil Team is the business that decides how your information is processed.

We are not affiliated with Valve Corporation, Facepunch Studios, or Discord Inc. Their own terms and privacy policies still apply when you use those services.

2. Information we collect

2.1 Steam account

When you sign in with Steam we receive the following from Valve’s Steam Web API:

• your SteamID64 (the 17-digit numeric identifier);
• your Steam persona name (display name);
• your Steam avatar image URL;
• your Steam profile URL;
• a timestamp recording when we last validated your Steam profile.

Steam sign-in is required to create an account on Oil Team. If your Steam profile is private, your Oil Team account may show reduced information.

2.2 Discord (optional)

Linking Discord is optional. If you choose to link it, we receive and store:

• your Discord user ID, username, and display name;
• whether you are a member of our Discord server, and the role information used to gate features;
• whether direct messages from our bot have been delivered or failed.

A Oil Team moderator may also record a Discord username against your account so that staff and team captains can coordinate with you. You can unlink Discord at any time from your account settings.

2.3 Tournament activity

When you take part in events we collect:

• team registrations, including team name, tag, roster, and any in-game name you provide;
• check-in records, attendance, no-shows, and roster change requests;
• match and round events from our game servers, including kills, deaths, objective actions, and timing data;
• statistics derived from those events: ranks, points, leaderboard positions, and ledger entries;
• administrative records relating to your participation, such as bans, disqualifications, warnings, and internal moderator notes.

We do not ingest in-game voice or text chat content, and we do not store IP addresses inside match event records.

2.4 Preferences and acceptance records

• your selected time zone (for displaying event times);
• whether you have opted in or out of Discord notifications from our bot;
• the version of these terms and this policy you accepted, and when you accepted them.

2.5 Technical information

• a session cookie that keeps you signed in;
• a short-lived OAuth state cookie used during Steam or Discord sign-in to prevent cross-site request forgery;
• the IP address and user-agent of incoming requests, visible in server and proxy logs for security and rate-limiting;
• short-lived request traces and server heartbeats used to diagnose problems.

2.6 What we do not collect

• We do not collect your email address, real name, postal address, phone number, or date of birth.
• We do not handle payments. There are no paid subscriptions, donations, or merchandise sales on the site.
• We do not use third-party analytics (Google Analytics, Plausible, PostHog, etc.), advertising cookies, tracking pixels, or social-media pixels.
• We do not knowingly collect information from children below the applicable age of digital consent. See section 11.

3. Where this information comes from

• Directly from you when you sign in, link Discord, edit your account settings, or accept our terms.
• From Valve Corporation via the Steam Web API, when you authenticate with Steam.
• From Discord Inc. via Discord’s OAuth 2.0 flow and the Discord Bot API, if you link your Discord account.
• From our game servers, which send match events containing the SteamIDs of players in each match and the actions they took.
• From team captains, who may submit your SteamID as part of a team roster when registering for a tournament. If your SteamID has been added to a roster without your authorisation, contact us using the details in section 12 and we will remove it.
• From Oil Team moderators when they record actions such as bans, disqualifications, or notes about your participation.

4. How and why we use your information

For users in the EU, UK, and other regions that recognise the GDPR concept of a lawful basis, the basis we rely on is shown next to each purpose.

4.1 To operate your account

Authenticating you, keeping you signed in, remembering your preferences, and showing your account and team affiliations to you. Legal basis: performance of a contract with you.

4.2 To run tournaments

Processing team registrations, check-ins, and roster changes; receiving match events; computing statistics, ranks, and bracket outcomes; publishing public leaderboards and rosters. Legal basis: performance of a contract with you.

4.3 To maintain integrity, security, and fair play

Investigating reports of cheating, harassment, and rule violations; issuing and managing bans and disqualifications; keeping audit logs of moderator actions; rate-limiting requests; detecting abuse and account takeover attempts. Legal basis: legitimate interest in protecting the community and competitive integrity; compliance with legal obligations where applicable.

4.4 To communicate with you

Sending event reminders and roster updates through Discord direct messages when you have linked Discord and have not opted out; responding when you contact us; notifying you of material changes to our terms or this policy. Legal basis: performance of a contract; legitimate interest; consent for Discord direct messages, which you can withdraw at any time.

4.5 To improve and maintain the service

Diagnosing errors using short-lived request traces; maintaining backups; ensuring data integrity. Legal basis: legitimate interest in providing a reliable service.

4.6 To comply with law and protect rights

Responding to lawful requests from competent authorities; defending against legal claims; enforcing our terms; keeping records we are required to keep. Legal basis: compliance with a legal obligation; legitimate interest in establishing, exercising, or defending legal claims.

We do not make decisions about you that produce legal or similarly significant effects solely on the basis of automated processing. Substantive decisions such as bans, disqualifications, and appeals are made by human moderators.

5. What we publish publicly

Oil Team is a competitive platform, and parts of your participation are visible to the public, including search engines.

The following may appear on public pages and in public API responses:

• your display name (your Steam persona name by default, or any in-game name a team captain set when registering your team);
• your SteamID64;
• your Steam avatar image;
• the team or teams you compete on, and the events those teams are registered for;
• your rank, score, and column values on public leaderboards for events whose public leaderboard has been enabled;
• your performance statistics for the events you have played in.

The following is not published publicly:

• your Discord user ID;
• your IP address, time zone, or notification preferences;
• internal moderator notes;
• the detailed reason for any ban or disqualification;
• your raw match events or your account activity log.

You can object to the publication of your information on public leaderboards by contacting us. We will weigh your objection against the legitimate need to publish event results, and where practical we will remove or pseudonymise your row.

6. Who we share your information with

We do not sell your information, we do not share it for cross-context behavioural advertising, and we do not authorise third parties to use it for their own marketing. We share information only in the situations below.

• The public. Information described in section 5 is visible to anyone who visits the website or queries our public API endpoints.
• Service providers. A small number of processors help us run the service, including infrastructure and hosting providers, our database host, our Redis queue host, and our Discord bot host. They act on our instructions under written agreements and may only use your information to provide their services to us.
• Valve and Discord. When you authenticate with Steam or link Discord, information flows between us and those platforms as needed to perform the integration.
• Event partners and sponsors. Where an event is run jointly with a partner or sponsor, your public competitive information (display name, rank, statistics) is visible to them in the same way it is visible to anyone else.
• Authorities. We will disclose information where required by law, in good faith to comply with a legal obligation, or to establish, exercise, or defend legal claims.
• Successors in interest. If Oil Team is reorganised, merged, sold, or transferred, your information may be transferred to the receiving organisation. We will notify users of any such change of control.

7. International transfers

Oil Team runs on internet infrastructure that may be located outside your country of residence, including in countries that do not have data-protection laws considered equivalent to those in the EU or UK. Where personal information from the EU or UK is transferred to such a country, we rely on appropriate safeguards permitted by GDPR Article 46 (such as the European Commission's standard contractual clauses and the UK International Data Transfer Addendum) or on a valid adequacy decision such as the EU–US Data Privacy Framework where the receiving provider is certified.

8. How long we keep your information

We keep personal information only for as long as we need it for the purposes in this policy, and then we delete or anonymise it.

• Account information — for as long as you have an account. If you delete your account, we cascade most personal records and pseudonymise the rest.
• Sessions — up to 30 days from your last sign-in; expired sessions are removed automatically.
• Raw match events — 90 days from receipt, then dropped from active storage.
• Server heartbeats and request traces — 7 days.
• Aggregated tournament statistics and leaderboards — retained while the event is live, and afterwards for as long as we keep the event archive, so historical results remain verifiable.
• Administrative records — bans, audit logs, and appeals decisions are retained for as long as we reasonably need them for the integrity of the service and to defend against legal claims.
• Records required by law — retained for the period required by the applicable law.

9. Cookies and similar technologies

We use only the cookies that are strictly necessary to operate the website. We do not use advertising cookies, analytics cookies, or tracking pixels.

• a session cookie (a signed JSON Web Token) that keeps you signed in; it expires after 30 days of inactivity;
• a short-lived OAuth state cookie used only during the Steam or Discord sign-in flow to prevent cross-site request forgery;
• an optional time-zone cookie so we can show event times in your local time zone.

If we ever introduce non-essential cookies or third-party trackers, we will update this policy and present a consent banner before any such cookie is set, in line with the EU ePrivacy Directive and equivalent rules.

10. Your rights

Depending on where you live, you have some or all of the rights below. We honour them for all users globally to the extent we reasonably can.

• Access. Ask us to confirm what we hold about you and to provide a copy. You can download a copy of most of your data directly from your account at any time.
• Rectification. Ask us to correct information that is inaccurate or out of date.
• Erasure. Ask us to delete your account and the personal information associated with it. You can initiate this from your account settings. Some records, such as audit logs and ban records, may be retained where we have a legal basis under GDPR Article 17(3), including for the establishment, exercise, or defence of legal claims.
• Restriction. Ask us to limit how we use your information while a dispute about it is resolved.
• Objection. Object to processing we carry out on the basis of legitimate interest, including the publication of your row on a public leaderboard.
• Data portability. Receive a copy of certain information you provided to us in a structured, commonly-used, machine-readable format.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
• No discrimination. If you are a California resident, we will not deny you service, charge you a different price, or provide a different level of service because you exercised any of these rights.
• Complaints. If you are in the EU, UK, or another region with a data protection authority, you have the right to complain to that authority. We would appreciate the chance to resolve your concern first if you contact us.

How to exercise your rights. Use the contact details in section 12. We will respond within 30 days of a verifiable request (or 45 days under the CCPA, extendable by a further 45 days where reasonably necessary). To protect your information we may ask you to verify your identity before we act on a request.

California “Do Not Sell or Share”. Oil Team does not sell your personal information and does not share it for cross-context behavioural advertising, as those terms are defined under the CCPA. There is therefore nothing to opt out of, but you can still exercise any of the rights above by contacting us. We honour the Global Privacy Control signal as an opt-out request where it applies.

11. Security

We take reasonable technical and organisational measures to protect personal information, including encryption in transit, encrypted storage of sensitive tokens, scoped access controls, audit logging of administrative actions, rate-limiting, and the use of signed, short-lived authentication tokens. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected users in line with applicable law.

12. Children

Oil Team is intended for adults and older teenagers. By creating an account or by participating in our events you confirm that you are at least 16 years old, or older if that is the minimum age required to play Rust in your country. The service is not directed at children below that age, and we do not knowingly collect information from them. If you believe a child below the applicable age has created an account, contact us using the details in section 13 and we will delete the account and associated personal information.

13. How to contact us

You can reach the Oil Team team about anything in this policy, or to exercise any of the rights in section 10:

• by email at [email protected];
• through our Discord server.

When you contact us about your personal information, please describe what you would like us to do and include enough information for us to identify your account (for example, your Steam profile URL or SteamID64).

14. Changes to this policy

We may update this policy from time to time to reflect changes in the service, the law, or good practice. When we make a material change we will update the “Last updated” date at the top of this page, post an announcement in our Discord server, and where appropriate notify you in-app.