This policy explains what personal information voodoogaming.co.za, the Voodoo ZA Rust server and the Voodoo Network portal collect, why, who sees it, how long it's kept, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA). It only describes what the site and our plugins actually do.
1. Who is responsible
Responsible party and Information Officer: WOLFN, the owner of Voodoo ZA / Voodoo Network, South Africa.
- Email: info@voodoogaming.co.za
- Written requests (POPIA / PAIA): email info@voodoogaming.co.za
- Discord: open a ticket on discord.gg/D7JYfcdTBV
Voodoo Network data: when another server's owner installs our plugins, their server sends player data (sessions, stats, chat, reports and bans, see What we collect) to us. We (Voodoo Network, WOLFN) are the responsible party for that network data: we decide how it is stored, combined, kept and protected, and the rules below apply to it on every network server. Each owner accepts our network data sharing agreement before their server is added. Server owners remain responsible for what they do on their own server and with data they see in the portal.
Servers and players worldwide: the Voodoo Network started in South Africa but accepts Rust servers anywhere in the world. Wherever a network server or its players are, the data it sends is stored and processed in South Africa under this policy and South African law (POPIA).
How players are told: network servers running VoodooCore show a short chat message when you join (once per wipe) that links to this page. Server owners can turn the message off; this page applies either way.
2. What we collect
Steam sign-in and Steam profile data
- When you sign in with Steam (Steam OpenID): your SteamID64, Steam name and avatar, the time of your first and last sign-in, your last IP address, and your staff role if you have one. We never see your Steam password.
- From the Steam Web API, for players on our servers, the ban list and the gallery: public profile name, avatar and profile URL (cached for about 7 days). For moderators only: Steam account age and VAC / game ban status.
In-game data from our plugin (VoodooCore)
VoodooCore runs on Voodoo ZA and on any network server that installs it. It sends batches to the site every few seconds:
- Sessions: connect and disconnect times, IP address, average ping and disconnect reason; in-game names (including earlier names).
- Per-wipe stats and events: kills and deaths (weapon, distance, body part, hits, shots), PvE kills, gathering, crafting, research, building and upgrades, tool cupboard use, raids and explosives, loot crates, vending and recycling, vehicles, card swipes, movement distance, downed / revived, team create / join / leave, and server events (helicopter, Bradley, cargo, oil rig, etc.). Many events include the map grid square and position.
- Chat: chat messages with their channel, and chat commands.
- Moderation: in-game F7 reports (reporter, reported player, subject and message), anti-hack violations, kicks and bans, and the server's own ban list (SteamID, name, reason, expiry).
- Server metrics: FPS, players online, memory, entities and network traffic (no personal data).
Moderation and staff records
- Warnings, mutes, kicks and bans (reason, length, staff member), evidence links for network bans, review and unban notes, and RCON command history.
- An audit log of actions on the site (sign-ins, staff actions, ban decisions, voucher redemptions, appeal submissions, refused access). Each entry stores who did it and their IP address.
- For moderators, the country of a player's IP address. It comes from a country table stored on our own server (DB-IP Lite). Only when a moderator opens a player whose IP that table doesn't know is the IP address (and nothing else) looked up over HTTPS at ipwho.is, or ipapi.co as a backup. The answer is cached on our server for 30 days under a scrambled (hashed) key, not under the IP.
Ban appeals
The ban you appeal, your SteamID, your message (up to 3,000 characters), the date, the outcome, the staff response and who handled it.
Raid calculator reports
If you send a report on the raid calculator ("I needed X of Y"): the target, explosive, side, number and your note, the date, the Voodoo Network server page you sent it from, and a salted hash of your IP address (only to stop spam; we can't turn it back into your IP). If you are signed in, your account is linked to the report for staff only. Reports are never shown publicly. The calculator remembers your current picks in your browser (local storage), not on our server.
My raid lists: if you sign in with Steam and save a raid list, we store the list name you type, the targets and amounts, the side and the explosives you picked, and when you created or changed it, linked to your account. Only you can see your lists (on raid.html on every Voodoo Network server page); they are never shown publicly. Delete a list at any time on the raid calculator; we also delete them if you ask us to delete your account data.
Gallery and blog
- Gallery uploads: the photo (re-encoded so that camera and location data is removed), title, the designer / builder names you type, your write-up, the wipe month, and your SteamID, Steam name and avatar as the uploader (shown only to staff). Also who claimed a base.
- Blog: posts and images published by staff, and the staff member who wrote them.
- Item tips and info suggestions: if you sign in with Steam and submit a tip or suggest info text on an item page, we store the text and title you type (plain text; links are removed), the item, when you sent it, and your account as the submitter. An admin reviews every submission (the decision, reviewer and an internal note are kept in the audit log). Approved tips and info text are public on the item page, credited with your display name only (never your SteamID). An approved info suggestion replaces the previous text; older versions and rejected items are kept until you ask us to delete them.
- Monument tips, photos and video guides: if you sign in with Steam and submit a tip, a photo or a YouTube link on a monument page, we store the tip text and title you type (plain text; links are removed), the photo (re-encoded so that camera and location data is removed, plus a smaller preview), or the YouTube video ID with the title and note you type, the monument, when you sent it, and your account as the submitter. An admin reviews every submission; the review decision, reviewer and an internal note are kept in the audit log. Approved items are public on the monument page, credited with your display name only (never your SteamID). Rejected or removed items are kept so we can stop repeat spam, until you ask us to delete them; deleted photos are removed from the server.
Voodoo Network portal (server owners)
- Server name, IP address and ports, the owner's SteamID, staff SteamIDs and tiers, plan and expiry, branding and settings, verification status, plugin version, and the hostname and IP address of the last plugin push. The server token is stored only as a hash.
- Vouchers and redemptions: the voucher, the server, who redeemed it, when, and from which IP address.
- Owner contact profile (Voodoo Network portal): email, first name, surname, town and country, collected when you claim or register a server so platform staff can contact you about your server. These are never shown on public pages.
- If we email you a voucher, we store your email address and when it was sent. Emails are sent through our mail server.
- There is no online payment on the site at the moment, so we hold no card or bank details.
Server directory
The server directory is built from Steam's public Rust server list. It stores server details such as name, IP address and ports, player counts, map, tags and version, and a country from a database stored on our own server. It holds no player data.
Website visits
- Google Analytics (GA4), only if you press Accept in the cookie banner: pages viewed, device and browser, approximate location (worked out by Google from your IP address), and which cards and pop-ups you open (for example an item's name). Until you accept, Google Analytics isn't loaded at all. If you decline, it never is. It's only on the public pages: never on the staff mod pages, the portal, appeal, player profile or server directory pages.
- Our web host keeps standard server logs, including IP addresses.
- Embeds on the home page: a YouTube video, a Twitch player and clips, and the Discord server widget (member count). When the page loads, your browser connects to YouTube, Twitch and Discord, who may set their own cookies. Steam avatars are loaded from Steam's servers, and some item and monument images come from third-party image hosts.
3. Why we use it
- To run the server and the site: stats, leaderboards, wipe history, kill and raid feeds, the gallery and the blog.
- To keep the game fair and safe: moderation, investigating reports and cheating, enforcing bans, and the VAC policy.
- To run the shared network ban list, so that cheaters banned on one network server can be blocked on the others.
- To handle appeals and requests, and to sign you in and check your staff permissions.
- To run the portal for server owners: verification, plans, vouchers, staff, the RCON relay and support.
- To secure the service: audit logs, rate limits and abuse prevention.
- To understand how the site is used (Google Analytics, only with your consent) and improve it.
We don't sell personal information, and we don't use it for direct marketing.
4. Lawful basis (POPIA section 11)
- Contract: your account, the portal, plans and vouchers. We need this data to give you the service you asked for.
- Legitimate interests (ours, other players' and other network servers'): fair play, anti-cheat, moderation, network bans, stats, and security of the service. This is also our basis for receiving and combining data from all Voodoo Network servers. We have written down why we need it, why it doesn't go further than needed, and the safeguards we use (staff-only access, no public SteamIDs, the retention periods below). You can object (see Your rights).
- Consent: Google Analytics cookies (the cookie banner), and where you choose to give us something (gallery uploads, appeals, voucher emails). You can withdraw your consent at any time. This doesn't affect what we did before you withdrew it.
- Legal obligation: where the law requires us to keep or disclose information.
5. What is public (and what never is)
- Public: in-game / Steam names and avatars on leaderboards, stats, kill and raid feeds and player profiles; per-wipe stats; map grid squares of raids and events; the ban list (name, avatar, server, reason, category and dates); approved network bans; gallery photos with the designer / builder names and write-ups you typed.
- No public SteamIDs: public pages and public data don't show SteamIDs. Where public data needs to tell players apart (for example the leaderboards) it uses an anonymous player ID: the SteamID is encrypted with a secret key, and it can't be turned back into a SteamID without that key. There is no public player search or player profile: nobody can look a player up by SteamID, and when or on which servers a player was seen is not public (only server staff see sessions).
- Never public: IP addresses, sessions, chat, chat commands, F7 reports, anti-hack data, ban evidence, review notes, appeal messages, gallery uploader accounts, voucher emails and the audit log. These are only for staff with the matching permission (IP addresses and countries need a separate permission).
- Bans not public: network bans waiting for review or rejected, and other network servers' local bans unless that server chooses to make them public. Voodoo ZA's own ban list is public.
6. Who we share it with
- Our staff, on a need-to-know basis based on their role and permissions.
- Network server owners and staff, who see their own server's data in the portal. Cross-server history (a player's sessions, hours played, first and last seen, names and network bans across network servers) is staff-only. It is visible to Voodoo platform staff and to the staff of network servers on the Pro plan that share their own history and that we have reviewed and approved. It never includes IP addresses or chat from other servers, it is never on public pages, and every lookup is logged. Servers that don't share their history are left out of it. Every network server's plugin receives the approved network ban list (SteamID, category, reason and expiry) so it can block or flag banned players. It tells us when a banned player tries to join.
- Valve / Steam: Steam sign-in, and Steam Web API lookups (which send SteamIDs to Steam).
- Google: Google Analytics, only if you accepted analytics cookies.
- YouTube, Twitch and Discord: the home-page embeds (your browser connects to them directly). On monument pages, video preview pictures load from YouTube (i.ytimg.com); the video player itself (youtube-nocookie.com) only loads when you press play.
- ipwho.is / ipapi.co: a player's IP address, over HTTPS, only when a moderator opens that player and our own country table doesn't know the IP. Nothing else is sent.
- Hosting: our web host xneelo (South Africa) stores the site, the database and email. Intense Servers hosts the Voodoo ZA game server.
- Authorities, when the law requires it, or to protect someone's safety.
7. Transfers outside South Africa
Steam, Google, YouTube, Twitch, Discord, ipwho.is and ipapi.co process data outside South Africa (mainly in the USA and the EU). We only use these well-known providers for the purposes above, and their own privacy terms and safeguards apply (POPIA section 72).
Voodoo Network servers can be anywhere in the world. Data that they send about players (from any country) is stored and processed in South Africa. In the other direction, network servers outside South Africa receive the approved network ban list (SteamID, name, reason, category and dates) so their plugin can enforce it, and staff of approved Pro servers may view cross-server history in the portal from wherever they are (never IPs or chat). Every owner first accepts our network data sharing agreement, which limits use to running and moderating their server and requires them to keep the data safe (POPIA section 72).
8. How long we keep it
A clean-up job runs on our server every day. It deletes, or makes anonymous, the records below once they reach these ages. Ban records and ban appeals are the exception: they are never deleted. The same periods apply to data from every Voodoo Network server.
| Information | Kept for | Then |
|---|---|---|
| IP addresses (game sessions, players, site sign-ins, audit log, voucher redemptions) | 90 days | Replaced by a scrambled code (a salted hash). We can still tell that two old records came from the same address, for example for ban evasion, but we can't see the address any more. |
| Chat messages and chat commands | 6 months | Deleted |
| Game sessions (connect / disconnect, ping) | 12 months | Deleted |
| Audit log of site actions | 12 months | Deleted, except entries about bans and appeals (see Ban records and Ban appeals) |
| Moderation records (warnings, mutes, kicks, F7 reports, RCON history) | 12 months | Deleted, except entries about bans (see Ban records) |
| Ban records (local and network bans: SteamID, name, reason, category, dates, evidence links, review and unban notes, banned-player join alerts, and the ban entries in the moderation log, RCON history and audit log) | Permanently, also after a ban expires, is revoked or is rejected | Never deleted. We keep ban records permanently to enforce bans and protect the community, for example to spot ban evasion and repeat offenders. An ended ban no longer blocks you. |
| Ban appeals (your message, the outcome, the staff response and who handled it, and the appeal entries in the audit log) | Permanently, open or closed | Never deleted. Appeals are kept with the ban record to enforce bans and protect the community, and so that the appeal limits in the ban guidelines work. |
| Vouchers, redemptions and voucher emails | 24 months after the voucher expires, is revoked or is used up | Deleted |
| Per-wipe stats and the event feeds of past wipes | As wipe history | Kept, so that past wipes stay viewable. Stats are totals per player per wipe, linked to the anonymous player ID on public pages. |
- Free-plan servers see only 30 days of history on the dashboard. The periods above still apply.
- Caches: Steam profile names and avatars are refreshed after 7 days; the moderators' Steam data cache drops entries after 30 days; IP country results are cached for 30 days; the mods' live-player list keeps offline players for 14 days; rate-limit counters are cleared after 2 days.
- Plugin queue: on the game server, a batch file is deleted as soon as the site confirms it received it.
- Server directory: servers unseen for 3 days show as offline, and are hidden after 14 days. Sync history is kept for 30 days.
- Sign-in session: ends when you sign out or close your browser.
- Accounts, gallery photos and blog posts are kept until you ask us to remove them (see your rights). Backups follow our host's backup cycle.
9. Security
The site uses HTTPS. Sign-in cookies are HttpOnly and SameSite. Forms that change data are protected with CSRF tokens. Server tokens are stored only as hashes, and voucher codes as hashes plus encryption. Configuration files and data caches are blocked from the web. Staff access is role-based, voucher redemptions, appeals and server sign-ups are rate-limited, and staff actions are audit-logged. IP addresses are replaced by a salted hash after 90 days. No system is perfectly secure. If a breach puts your information at risk, we'll tell you and the Information Regulator as POPIA (section 22) requires.
10. Children
The service is meant for players aged 16 and older. Under POPIA, anyone under 18 is a child, and we need a parent's or guardian's consent to process a child's information. If you're a parent or guardian and think your child's information is on the service without your consent, contact us and we'll remove what isn't needed to enforce an active ban.
11. Your rights and how to use them
Under POPIA you can:
- access the personal information we hold about you;
- ask us to correct information that is wrong or out of date;
- ask us to delete or destroy information that we no longer need, or that we're not allowed to keep;
- object to processing based on legitimate interests, and withdraw consent you gave;
- complain to the Information Regulator.
Players outside South Africa: we honour these rights for everyone, wherever you live. If you're in the EU or UK, you can also use your rights under the GDPR / UK GDPR (for example access, correction, deletion, objection, restriction and data portability) through the same contact below, and you may complain to your local data protection authority.
How to ask: email info@voodoogaming.co.za or open a Discord ticket. Tell us your Steam name and what you want. To confirm it's you, we may ask you to sign in with the Steam account concerned, or to prove ownership in another way. We'll reply within 30 days. Requests are free, unless a request is clearly excessive.
We may keep information that we need to enforce bans, protect other players, or meet a legal duty, and we'll explain why. Ban records and ban appeals are always kept (see How long we keep it), so we can't delete a ban or an appeal on request; you can still ask us to correct one, or appeal a ban. A server owner can ask us to delete their server's data from the portal. For data from another network server, you can also ask that server's owner.
Information Regulator (South Africa): inforegulator.org.za (complaints via its eServices portal, or POPIA Form 5 to POPIAComplaints@inforegulator.org.za); general enquiries enquiries@inforegulator.org.za, 010 023 5200; Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. We'd appreciate the chance to fix things first, so please contact us before you complain.
12. Cookies and browser storage
| Name | Set by | Purpose | How long |
|---|---|---|---|
PHPSESSID | This site | Keeps you signed in with Steam and protects forms (CSRF). Essential. HttpOnly and SameSite=Lax. | Until you sign out or close the browser |
_ga, _ga_* | Google Analytics | Counts visits and page views. Only set after you press Accept, and removed again if you later decline. | Up to 2 years (set by Google) |
voodoo_consent_v1 (local storage), or the vz_consent cookie if storage is blocked | This site | Remembers whether you accepted or declined analytics cookies. Essential. | 12 months, then we ask again |
| YouTube / Twitch / Discord cookies | Those services | Set by the home-page embeds under their own policies. | Set by those services |
voodoo_za_status_v2 (local storage) | This site | Caches the server status on the home page so it shows faster. | Until it's replaced or you clear site data |
| Staff preferences (local / session storage) | This site | Remember the blog editor view and the last player opened on the mod pages. | Until cleared / the tab is closed |
Change your choice at any time with Cookie settings (also in the footer of every page). You can also block or delete cookies in your browser settings. Blocking the session cookie stops Steam sign-in from working. You can block Google Analytics with Google's opt-out add-on (tools.google.com/dlpage/gaoptout) or a content blocker.
13. Changes to this policy
We'll update this page when the site or the plugins change what they collect. The date at the top shows the latest version. We'll announce important changes on the site or on our Discord.