Privacy Policy

1. Who we are

ToolCupboard ("we", "us") is a web control panel for Rust game server administrators, operated by the project owner and reachable at privacy@toolcupboard.io. For the purposes of the EU General Data Protection Regulation (GDPR, Reg. EU 2016/679), we act as the data controller for the personal data described below.

2. What data we collect

• Account data: email address, hashed password (or Google OAuth identifier if you sign in with Google), account creation and last sign-in timestamps.
• Profile / usage data: the servers, organizations, whitelists, modules, tickets and settings you create inside the app.
• Codefling username (optional), used only to verify plugin ownership against the Codefling buyers list.
• Technical data: IP address, browser user agent and request logs, kept for security and abuse-prevention purposes.
• Game-server data: RCON connection details, player lists, chat/console output that you connect to the panel. This data belongs to you; we process it on your behalf.

We do not use advertising or marketing trackers, behavioural analytics, third-party pixels, or profiling.

3. Purposes and legal bases

• Providing the service (account, authentication, server management) — performance of a contract, Art. 6(1)(b).
• Security, fraud and abuse prevention, request logging — legitimate interest, Art. 6(1)(f).
• Legal obligations (e.g. responding to lawful requests) — legal obligation, Art. 6(1)(c).
• Transactional email (sign-in links, password reset, ticket notifications) — performance of a contract.

4. Who processes the data

We rely on the following sub-processors, each bound by a GDPR-compliant data processing agreement:

• Supabase (database, authentication, storage) — EU region.
• Cloudflare (edge hosting, DDoS protection, DNS).
• Google (only when you choose "Continue with Google").
• Codefling (only if you link your Codefling username).

Where a sub-processor transfers data outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

5. Retention

Account and usage data are retained while your account is active. When you delete your account from Settings → Profile, your profile, servers, organizations (if you are the owner), whitelists and related data are permanently deleted. Security logs are retained for up to 90 days. Backups are rotated within 30 days.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. You may also lodge a complaint with your local supervisory authority. To exercise any of these rights, email us at privacy@toolcupboard.io. You can delete your account and associated data at any time from Settings → Profile.

7. Cookies and local storage

See our Cookie Policy for details. We only use storage that is strictly necessary to operate the service and remember your preferences — no advertising or analytics cookies.

8. Changes

We may update this policy from time to time. Material changes will be announced inside the app or by email.