Controller
The publisher described in the legal notice: [PLACEHOLDER: company name and address]. Data protection contact: [PLACEHOLDER: privacy contact email].
What we process and why
Account (email, password hash, username, date of birth, country, language) and social features (friends, blocks, parties, messages): to provide the service you asked for (contract).
Orders, invoices and VAT evidence: contract and legal obligations.
Security logs, abuse prevention, moderation: our legitimate interest in keeping the service safe.
Usage statistics and crash reports: only with your consent, off by default, withdrawable at any time.
Microsoft and game tokens
Your Microsoft and game session tokens stay in your operating system’s keychain on your computer. They are never sent to Rustic servers. See the page about Microsoft sign-in.
How long we keep data
Account data: while the account exists, then deleted 30 days after a deletion request. Direct messages: 90 days. Moderation records: 2 years after the case closes. Orders and invoices: 10 years (accounting law). Security logs: 90 days, IP addresses truncated after 7 days.
Your rights
Access and portability (Account › Privacy › Export), rectification (Account › Profile), erasure (Account › Privacy › Delete), objection and restriction by email. We answer within one month. You can complain to the CNIL (www.cnil.fr).
Children
The minimum age is 13. Below the age of digital consent of your country, consent-based processing stays off and chat needs a parent or guardian.
Processors
Payment: Stripe. Email delivery: [PLACEHOLDER: email provider]. Hosting: self-hosted in France. Transfers outside the EEA only under the EU-US Data Privacy Framework or standard contractual clauses.