This policy explains what personal information voodoogaming.co.za, the Voodoo ZA Rust server and the Voodoo Network portal collect, why, who sees it, how long it's kept, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA). It only describes what the site and our plugins actually do.
1. Who is responsible
Responsible party and Information Officer: WOLFN, the owner of Voodoo ZA / Voodoo Network, South Africa.
- Email: info@voodoogaming.co.za
- Postal address: [postal address]
- Discord: open a ticket on discord.gg/D7JYfcdTBV
Other Voodoo Network servers: when another server's owner installs our plugins, that owner decides what their server sends and is responsible to their players. We process that data on their behalf to run the portal. We remain responsible for the shared network ban list and for your account on this site.
2. What we collect
Steam sign-in and Steam profile data
- When you sign in with Steam (Steam OpenID): your SteamID64, Steam name and avatar, the time of your first and last sign-in, your last IP address, and your staff role if you have one. We never see your Steam password.
- From the Steam Web API, for players on our servers, the ban list and the gallery: public profile name, avatar and profile URL (cached for about 7 days). For moderators only: Steam account age and VAC / game ban status.
In-game data from our plugin (VoodooCore)
VoodooCore runs on Voodoo ZA and on any network server that installs it. It sends batches to the site every few seconds:
- Sessions: connect and disconnect times, IP address, average ping and disconnect reason; in-game names (including earlier names).
- Per-wipe stats and events: kills and deaths (weapon, distance, body part, hits, shots), PvE kills, gathering, crafting, research, building and upgrades, tool cupboard use, raids and explosives, loot crates, vending and recycling, vehicles, card swipes, movement distance, downed / revived, team create / join / leave, and server events (helicopter, Bradley, cargo, oil rig, etc.). Many events include the map grid square and position.
- Chat: chat messages with their channel, and chat commands.
- Moderation: in-game F7 reports (reporter, reported player, subject and message), anti-hack violations, kicks and bans, and the server's own ban list (SteamID, name, reason, expiry).
- Server metrics: FPS, players online, memory, entities and network traffic (no personal data).
Moderation and staff records
- Warnings, mutes, kicks and bans (reason, length, staff member), evidence links for network bans, review and unban notes, and RCON command history.
- An audit log of actions on the site (sign-ins, staff actions, ban decisions, voucher redemptions, appeal submissions, refused access). Each entry stores who did it and their IP address.
- For moderators, the country of a player's IP address. It comes from a country table stored on our own server (DB-IP Lite). Only when a moderator opens a player whose IP that table doesn't know is the IP address (and nothing else) looked up over HTTPS at ipwho.is, or ipapi.co as a backup. The answer is cached on our server for 30 days under a scrambled (hashed) key, not under the IP.
Ban appeals
The ban you appeal, your SteamID, your message (up to 3,000 characters), the date, the outcome, the staff response and who handled it.
Gallery and blog
- Gallery uploads: the photo (re-encoded so that camera and location data is removed), title, the designer / builder names you type, your write-up, the wipe month, and your SteamID, Steam name and avatar as the uploader (shown only to staff). Also who claimed a base.
- Blog: posts and images published by staff, and the staff member who wrote them.
Voodoo Network portal (server owners)
- Server name, IP address and ports, the owner's SteamID, staff SteamIDs and tiers, plan and expiry, branding and settings, verification status, plugin version, and the hostname and IP address of the last plugin push. The server token is stored only as a hash.
- Vouchers and redemptions: the voucher, the server, who redeemed it, when, and from which IP address. If we email you a voucher, we store your email address and when it was sent. Emails are sent through our mail server.
- There is no online payment on the site at the moment, so we hold no card or bank details.
Server directory
The server directory is built from Steam's public Rust server list. It stores server details such as name, IP address and ports, player counts, map, tags and version, and a country from a database stored on our own server. It holds no player data.
Website visits
- Google Analytics (GA4), only if you press Accept in the cookie banner: pages viewed, device and browser, approximate location (worked out by Google from your IP address), and which cards and pop-ups you open (for example an item's name). Until you accept, Google Analytics isn't loaded at all. If you decline, it never is. It's only on the public pages: never on the staff mod pages, the portal, appeal, player profile or server directory pages.
- Our web host keeps standard server logs, including IP addresses.
- Embeds on the home page: a YouTube video, a Twitch player and clips, and the Discord server widget (member count). When the page loads, your browser connects to YouTube, Twitch and Discord, who may set their own cookies. Steam avatars are loaded from Steam's servers, and some item and monument images come from third-party image hosts.
3. Why we use it
- To run the server and the site: stats, leaderboards, wipe history, kill and raid feeds, the gallery and the blog.
- To keep the game fair and safe: moderation, investigating reports and cheating, enforcing bans, and the VAC policy.
- To run the shared network ban list, so that cheaters banned on one network server can be blocked on the others.
- To handle appeals and requests, and to sign you in and check your staff permissions.
- To run the portal for server owners: verification, plans, vouchers, staff, the RCON relay and support.
- To secure the service: audit logs, rate limits and abuse prevention.
- To understand how the site is used (Google Analytics, only with your consent) and improve it.
We don't sell personal information, and we don't use it for direct marketing.
4. Lawful basis (POPIA section 11)
- Contract: your account, the portal, plans and vouchers. We need this data to give you the service you asked for.
- Legitimate interests (ours, other players' and other network servers'): fair play, anti-cheat, moderation, network bans, stats, and security of the service.
- Consent: Google Analytics cookies (the cookie banner), and where you choose to give us something (gallery uploads, appeals, voucher emails). You can withdraw your consent at any time. This doesn't affect what we did before you withdrew it.
- Legal obligation: where the law requires us to keep or disclose information.
5. What is public (and what never is)
- Public: in-game / Steam names and avatars on leaderboards, stats, kill and raid feeds and player profiles; per-wipe stats; map grid squares of raids and events; the ban list (name, avatar, server, reason, category and dates); approved network bans; gallery photos with the designer / builder names and write-ups you typed.
- No public SteamIDs: public pages and public data don't show SteamIDs. Player profiles use an anonymous player ID: the SteamID is encrypted with a secret key, and it can't be turned back into a SteamID without that key. The player search on player.html only uses a SteamID that you type in yourself.
- Never public: IP addresses, sessions, chat, chat commands, F7 reports, anti-hack data, ban evidence, review notes, appeal messages, gallery uploader accounts, voucher emails and the audit log. These are only for staff with the matching permission (IP addresses and countries need a separate permission).
- Bans not public: network bans waiting for review or rejected, and other network servers' local bans unless that server chooses to make them public. Voodoo ZA's own ban list is public.
6. Who we share it with
- Our staff, on a need-to-know basis based on their role and permissions.
- Network server owners and staff, who see their own server's data in the portal. Every network server's plugin receives the approved network ban list (SteamID, category, reason and expiry) so it can block or flag banned players. It tells us when a banned player tries to join.
- Valve / Steam: Steam sign-in, and Steam Web API lookups (which send SteamIDs to Steam).
- Google: Google Analytics, only if you accepted analytics cookies.
- YouTube, Twitch and Discord: the home-page embeds (your browser connects to them directly).
- ipwho.is / ipapi.co: a player's IP address, over HTTPS, only when a moderator opens that player and our own country table doesn't know the IP. Nothing else is sent.
- Hosting: our web host [web hosting provider] stores the site, the database and email. Intense Servers hosts the Voodoo ZA game server.
- Authorities, when the law requires it, or to protect someone's safety.
7. Transfers outside South Africa
Steam, Google, YouTube, Twitch, Discord, ipwho.is and ipapi.co process data outside South Africa (mainly in the USA and the EU). We only use these well-known providers for the purposes above, and their own privacy terms and safeguards apply (POPIA section 72). Network servers can be in other countries; they receive only the approved network ban list.
8. How long we keep it
A clean-up job runs on our server every day. It deletes, or makes anonymous, the records below once they reach these ages:
| Information | Kept for | Then |
|---|---|---|
| IP addresses (game sessions, players, site sign-ins, audit log, voucher redemptions) | 90 days | Replaced by a scrambled code (a salted hash). We can still tell that two old records came from the same address, for example for ban evasion, but we can't see the address any more. |
| Chat messages and chat commands | 6 months | Deleted |
| Game sessions (connect / disconnect, ping) | 12 months | Deleted |
| Audit log of site actions | 12 months | Deleted |
| Moderation records (warnings, mutes, kicks, F7 reports, RCON history, banned-player join alerts) | 12 months | Deleted |
| Bans | While active, then 12 months after they expire, are revoked or rejected | Deleted, with their appeals and evidence links. Permanent bans stay until they're revoked. |
| Ban appeals | 12 months after the decision | Deleted (open appeals are kept until decided) |
| Vouchers, redemptions and voucher emails | 24 months after the voucher expires, is revoked or is used up | Deleted |
| Per-wipe stats and the event feeds of past wipes | As wipe history | Kept, so that past wipes stay viewable. Stats are totals per player per wipe, linked to the anonymous player ID on public pages. |
- Free-plan servers see only 30 days of history on the dashboard. The periods above still apply.
- Caches: Steam profile names and avatars are refreshed after 7 days; the moderators' Steam data cache drops entries after 30 days; IP country results are cached for 30 days; the mods' live-player list keeps offline players for 14 days; rate-limit counters are cleared after 2 days.
- Plugin queue: on the game server, a batch file is deleted as soon as the site confirms it received it.
- Server directory: servers unseen for 3 days show as offline, and are hidden after 14 days. Sync history is kept for 30 days.
- Sign-in session: ends when you sign out or close your browser.
- Accounts, gallery photos and blog posts are kept until you ask us to remove them (see your rights). Backups follow our host's backup cycle.
9. Security
The site uses HTTPS. Sign-in cookies are HttpOnly and SameSite. Forms that change data are protected with CSRF tokens. Server tokens are stored only as hashes, and voucher codes as hashes plus encryption. Configuration files and data caches are blocked from the web. Staff access is role-based, voucher redemptions, appeals and server sign-ups are rate-limited, and staff actions are audit-logged. IP addresses are replaced by a salted hash after 90 days. No system is perfectly secure. If a breach puts your information at risk, we'll tell you and the Information Regulator as POPIA (section 22) requires.
10. Children
The service is meant for players aged 16 and older. Under POPIA, anyone under 18 is a child, and we need a parent's or guardian's consent to process a child's information. If you're a parent or guardian and think your child's information is on the service without your consent, contact us and we'll remove what isn't needed to enforce an active ban.
11. Your rights and how to use them
Under POPIA you can:
- access the personal information we hold about you;
- ask us to correct information that is wrong or out of date;
- ask us to delete or destroy information that we no longer need, or that we're not allowed to keep;
- object to processing based on legitimate interests, and withdraw consent you gave;
- complain to the Information Regulator.
How to ask: email info@voodoogaming.co.za or open a Discord ticket. Tell us your Steam name and what you want. To confirm it's you, we may ask you to sign in with the Steam account concerned, or to prove ownership in another way. We'll reply within [30 days]. Requests are free, unless a request is clearly excessive.
We may keep information that we need to enforce an active ban, protect other players, or meet a legal duty, and we'll explain why. A server owner can ask us to delete their server's data from the portal. For data from another network server, you can also ask that server's owner.
Information Regulator (South Africa): inforegulator.org.za (complaints via its eServices portal, or POPIA Form 5 to POPIAComplaints@inforegulator.org.za); general enquiries enquiries@inforegulator.org.za, 010 023 5200; Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. We'd appreciate the chance to fix things first, so please contact us before you complain.
12. Cookies and browser storage
| Name | Set by | Purpose | How long |
|---|---|---|---|
PHPSESSID | This site | Keeps you signed in with Steam and protects forms (CSRF). Essential. HttpOnly and SameSite=Lax. | Until you sign out or close the browser |
_ga, _ga_* | Google Analytics | Counts visits and page views. Only set after you press Accept, and removed again if you later decline. | Up to 2 years (set by Google) |
voodoo_consent_v1 (local storage), or the vz_consent cookie if storage is blocked | This site | Remembers whether you accepted or declined analytics cookies. Essential. | 12 months, then we ask again |
| YouTube / Twitch / Discord cookies | Those services | Set by the home-page embeds under their own policies. | Set by those services |
voodoo_za_status_v2 (local storage) | This site | Caches the server status on the home page so it shows faster. | Until it's replaced or you clear site data |
| Staff preferences (local / session storage) | This site | Remember the blog editor view and the last player opened on the mod pages. | Until cleared / the tab is closed |
Change your choice at any time with Cookie settings (also in the footer of every page). You can also block or delete cookies in your browser settings. Blocking the session cookie stops Steam sign-in from working. You can block Google Analytics with Google's opt-out add-on (tools.google.com/dlpage/gaoptout) or a content blocker.
13. Changes to this policy
We'll update this page when the site or the plugins change what they collect. The date at the top shows the latest version. We'll announce important changes on the site or on our Discord.