Privacy

As of: 07.10.2026

These notes describe data processing by the current Rustomize website.

Controller and contact

Frederic Bauer, Gösstr. 38, 72070 Tübingen, Deutschland · info@rustomize.com · +49 151 52425660

Hosting and requests

The website is hosted on Cloudflare Workers, with its database and image storage on Cloudflare D1 and R2. Technical connection data such as IP address, requested URL, time and browser information are processed to deliver and protect the site. Private previews are protected by an access password.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Sampled request and error logs in Workers Logs are retained for seven days. D1 keeps database backups for up to 30 days; deleted comparison lists may temporarily remain in them. Deletions and expiry rules must be reapplied after restoration. Our application does not log form contents.

Hosting and security providers receive the technical data necessary for their services. Processing may also take place in the USA. The providers describe their transfer mechanisms, including the EU-US Data Privacy Framework and standard contractual clauses, in the information linked below. Logs serve delivery, troubleshooting and abuse prevention; the hosting platform’s service-specific retention periods apply in addition to the application periods stated here. We do not maintain our own permanent visitor database of IP addresses.

Saved selections

The comparison list is stored on the server under a random identifier: skin IDs, variants, skin data and save time. The loadout-plan cookie expires after 365 days and is renewed when read. Server copies expire twelve months after the last read or save. Regular maintenance removes them; expired lists are also deleted on access. Clearing the list deletes its server copy. Clearing browser data alone does not delete a server copy.

Language, currency, favourites, outfits and ClonePilot data remain in local browser storage without a fixed expiry until you delete them through the relevant feature or your browser settings. Cookies named rustomize-drops-* store marked drops for 365 days. This storage supports your chosen features, not advertising profiles. Legal bases: section 25(2)(2) TDDDG for necessary device access and Article 6(1)(f) GDPR for providing and restoring your selections.

ClonePilot image recognition and calculations run locally in your browser. Captured images are not sent to our server for calculation. Administrator access uses a separate session cookie lasting up to eight hours.

External images and links

Some item images and drop previews are loaded directly from Steam, Facepunch or other credited image sources. These providers receive the technical connection data needed for loading. Marketplace links open the respective external website; its privacy information applies there.

Purposes and legal bases

We process technical data to operate and protect the site on the basis of our legitimate interest under Article 6(1)(f) GDPR. Storage needed for a feature you request serves to provide that feature. Emails are processed to respond to your inquiry; the applicable basis is Article 6(1)(b) or (f) GDPR depending on the inquiry. Correspondence is retained for handling and any applicable legal retention duties.

When you contact us by email or phone, we process your contact details and request to handle your inquiry. We delete general inquiries no later than six months after completion. Legal retention duties or unresolved legal claims may require longer storage restricted to that purpose. Our email inbox is hosted by Google (Gmail); the provider processes messages and connection data for delivery and security.

Providing contact details is voluntary; without a way to contact you, we cannot reply. Blocking browser storage may prevent your selections from being saved persistently. Statistics require your consent. We make no automated decisions with legal or similarly significant effects.

Messages to info@rustomize.com are forwarded by Cloudflare Email Routing to our Gmail inbox. The contact form sends your email address, subject and message through Cloudflare to this inbox. We do not store form contents in our website database. A shared submission counter limits misuse without storing visitor identifiers. Google may process data in the USA; its privacy policy describes international transfers.

We handle general inquiries based on our legitimate interest in communication under Article 6(1)(f) GDPR; Article 6(1)(b) applies only when initiating or performing a contract with us. The optional form requires an email address, subject and message; it cannot be sent without them. Google’s general privacy terms apply to the Gmail inbox. Google operates its email service under its own data protection responsibility, not as our contractual processor.

Google Analytics and statistics

With your consent, we use Google Analytics 4 to measure visits, traffic sources and use of the website. Google tags load only after you select “Allow statistics”. We do not send contact form contents or email addresses to Analytics. Advertising features and Google Signals are disabled. Google may process data in the USA. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw consent through “Statistics settings” in the footer. We retain the choice in local browser storage for 180 days; Analytics cookies last up to 180 days. Event data in Analytics is retained for two months.

Google Ireland Limited, Ireland; Google LLC, USA.

Analytics processes random cookie identifiers (_ga, _ga_TJM1X5CK7Y), page paths without query parameters, times, browser, operating system, language, screen data, approximate location and referring domain. We measure page views and successful form submissions, not message contents. The IP address is transmitted technically; Google states that GA4 does not store it and discards it after deriving location for EU traffic.

The two-month period applies to user and event data; aggregated standard reports may remain available longer. The consent choice includes its time and notice version, without our own visitor identifier. Rejection does not restrict website features. Withdrawal stops future measurement and removes Analytics cookies; it does not affect earlier lawful processing.

Google Analytics · Google DPA · Google Analytics — Data retention

Transfers to certified US companies of Cloudflare and Google rely on the EU-US Data Privacy Framework and Article 45 GDPR. Where no adequacy decision applies, the providers provide standard contractual clauses under Article 46 GDPR. Details and copies of safeguards are available through the linked contractual and transfer information or on request from us.

Google — International transfers · Cloudflare — Sub-processors

Your rights

Subject to the applicable requirements, you may request access, rectification, erasure, restriction and portability of personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on consent. You may complain to a data protection supervisory authority. Contact the address above for requests.

Objection under Article 21 GDPR: you may object at any time to processing based on legitimate interests on grounds relating to your particular situation. We stop processing unless compelling legitimate grounds or legal claims override the objection.

Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg · Heilbronner Straße 35, 70191 Stuttgart

Further information about the hosting providers: Cloudflare · Cloudflare DPA · Google (Gmail)