DRAFT — needs review by ClanStop's legal adviser before publishing
RCON Hub Privacy Notice
Version: draft of 9 October 2026
This notice explains what information RCON Hub and its game tools (the "Software") keep, what is sent to ClanStop (the publisher of RCON Hub, "ClanStop", "we", "us"), why, for how long, who can see it, and how to ask for a copy or for it to be deleted.
There are two different situations, and they are kept separate on purpose:
- Data kept on the server owner's own computer. RCON Hub runs on the server owner's PC (or a machine they choose). What it stores there stays there. ClanStop does not receive it and cannot see it.
- Data sent to ClanStop. Only if the server owner turns on ClanStop sharing for a particular server. Everything is off until they do, and they can turn it off again at any time.
1. Data kept locally by RCON Hub
On the computer where RCON Hub runs (in %APPDATA%\RCON Hub and %LOCALAPPDATA%\RCON Hub on Windows), the Software stores:
- Hub accounts: usernames, password hashes (never the password as typed), two-factor sign-in secrets (encrypted), sign-in sessions, invitations, and each person's role and permissions.
- Settings: server addresses and ports, RCON / host-panel / FTP credentials (encrypted where the tool supports it), Discord webhooks, schedules and other configuration.
- Activity on the game servers: players' names and game ids (for example SteamID, Epic/EOS id, BattlEye GUID, DayZ id), when they joined and left, chat and kill logs the game server writes, bans, notes and flags staff add, and — where the game server reports them — players' IP addresses.
- An audit log of what hub users did (who changed what, and when).
- Backups of game worlds and settings that the owner asks for.
This data is under the server owner's control. They decide how long to keep it and can delete it (for example by removing a server or a game tool, or with the uninstaller's optional "Also remove my RCON Hub data" choice). The server owner is responsible for how they use it and for telling their players about it where the law requires.
Uninstalling RCON Hub does not touch game servers or their worlds.
2. Data sent to ClanStop (only when the server owner opts in, per server)
When a server owner turns on ClanStop sharing for a server, the Software sends ClanStop the following about that server and its players, in signed batches about once a minute:
About the server: its name, region, description and languages as the owner entered them, the game, its game port, player counts, map and version, whether it is listed publicly, and a one-way fingerprint of its public address (never the address itself).
About players (only with "share players"):
- Player ids: SteamID (Steam64), Epic/EOS id, BattlEye GUID, DayZ id, or the game's own player id — whatever the game server reports.
- Names players use in game, and their name history.
- Sessions: when a player joined and left the server, and who is online.
- Kills and deaths: time, weapon, ammunition, distance, direct hit or not, and where the game logs them, the positions of both players; hit events used for fair-play checks.
- Statistics: the game's own counters (for example playtime, levels, kills) and the server's wipe dates.
- Flags (only with "share flags"): open fair-play flags and watch-list entries staff have raised.
- IP-address fingerprints: a keyed one-way hash of a player's IP address and network (sha256 with a per-install pepper on the owner's PC, then keyed again with a secret at ClanStop). Raw IP addresses are never sent to ClanStop and never stored by ClanStop. The fingerprints are used only to recognise the same player across servers and to detect obvious duplicate accounts.
Global bans (Fair-Fight) (only on servers where the owner turns on reporting or enforcement): reports of possible cheating (the rule, the rule-set version, and the ids of the stored events that matched), extra position or level samples needed to check the rules, and the proof record ClanStop keeps for each report and global ban (see the ClanStop Global Ban Terms).
Never sent: chat, staff notes, hub accounts or passwords, RCON or host credentials, or raw IP addresses.
3. Why ClanStop uses this data
- Player profiles and stats: to join a player's activity across the servers that share, and to show public leaderboards, server pages and player cards on ClanStop's site.
- Fair play and global bans: to verify reports of clear cheating against data already received, to apply global bans on servers that enforce them, and to handle appeals.
- Server listings: to list servers whose owners chose to be listed.
- Security and abuse prevention: to detect forged data, duplicate senders and misuse of the service.
Legal basis: [to be confirmed by ClanStop's legal adviser — for example the server owner's consent for sharing, and ClanStop's and server communities' legitimate interest in fair play for global bans].
4. How long ClanStop keeps it
ClanStop deletes data automatically when its retention period ends:
| Data | Kept for |
|---|---|
| IP-address fingerprints and "online now" status | 30 days after the player was last on that server |
| Sessions and name history | 180 days |
| Kill, death and hit events; fair-play samples | 180 days |
| Statistics snapshots | 365 days |
| Shared flags | 365 days |
| Records of who played on which server | up to 365 days after last seen |
| Daily totals (used by leaderboards and past seasons) | 730 days |
| Fair-Fight reports and proof records, lifted global bans, strikes | while a ban stands, then 730 days after it is lifted (or after the decision, when a report led to no ban) |
| Player records with no data left | 30 days |
5. Who can see what
- The public (ClanStop's stats pages and player cards): player names and game statistics only, for servers that are listed. Public pages never show SteamIDs or other platform ids, IP fingerprints, positions or ban evidence. Players who asked to be erased or not to be tracked never appear.
- The server owner sees in their own RCON Hub what their own servers recorded. They do not get other owners' data from ClanStop, except the list of global bans their servers enforce (the ids needed to apply each ban, without the name or the evidence).
- ClanStop staff with a staff account can see the data needed for their role: lookups, global-ban review, appeals and data requests. Every staff action is logged.
- ClanStop does not sell this data. ClanStop's hosting provider stores it on ClanStop's behalf.
6. Your rights
Depending on where you live, you may have the right to ask for a copy of the data ClanStop holds about you (export), to have it corrected, to have it deleted (erasure), to object to its use, or to ask ClanStop to stop tracking you (do-not-track). You can also complain to your data-protection authority.
To make a request, contact ClanStop (section 8) with the game, the name you play under and, if you can, your platform id (for example your SteamID), so staff can find you. ClanStop may ask you to prove that the account is yours. ClanStop aims to answer within [30 days / the period the law requires].
When data is erased, ClanStop deletes the player record, ids, sessions, events, statistics and flags, and keeps a one-way marker so that new data about that id is dropped when it arrives.
Open question — standing global bans after an erasure request. As currently designed, an erasure request does not lift a global ban that is still in force: the ban, the ids needed to enforce it and its proof record (which refers to players only by ClanStop's internal numbers) are kept, on the basis that removing them would let a cheater escape a ban simply by asking. The ban can still be appealed; once it is lifted, its ids are deleted and the proof record follows the retention above. Whether this approach is appropriate in every jurisdiction where RCON Hub is used has not yet been confirmed and is subject to review by ClanStop's legal adviser.
To ask about the data a particular server keeps on its own computer (section 1), contact that server's owner: ClanStop does not hold that data.
7. Children
The Software is meant for server owners and their staff. ClanStop does not knowingly collect data about children beyond what game servers report about their players. [Age wording to be confirmed by ClanStop's legal adviser.]
8. Contact
- Support, appeals and privacy questions: ClanStop's Discord, https://discord.gg/x3D3tmpDuQ
- Formal privacy and data-protection requests: [privacy contact email / postal address]
- Data controller: ClanStop, [legal entity name and address]
9. Changes
ClanStop may update this notice. The current version is published at https://clanstop.com/rconhub/legal/privacy.html.