Privacy Policy
Last updated: June 8, 2026
1. Introduction
DustBowl.Games ("we", "us", "our") operates the website dustbowl.games and related game server hosting services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.
2. Information We Collect
Information from OAuth Providers
When you sign in, we receive limited profile data from the OAuth provider you choose:
- Steam: SteamID64, display name, avatar URL
- Discord: User ID, username, avatar, guild membership status
- Microsoft: Account ID, display name, email address, Xbox User ID (XUID), Minecraft UUID
We do not collect or store passwords. Authentication is handled entirely by third-party OAuth providers.
Information You Provide
- Display name and email address (optional, editable on your profile)
- FiveM license key (manual entry for server access)
- Contact form submissions (name, email, subject, message)
Payment Information
When you make a purchase, payment is processed by our payment processor, Stripe. Your full card details are entered directly with Stripe and are not stored on our systems. We retain billing records such as invoices, amounts, dates, and the last four digits of the card and card brand returned to us by Stripe.
Automatically Collected Information
- IP address and browser user agent (server logs), retained for security, audit logging, and abuse prevention
- Pages visited and timestamps
- Authentication cookies (session management only)
- Bot-protection signals (IP address and browser data) processed by Cloudflare Turnstile on our forms — see Third-Party Service Providers below
3. How We Use Your Information
- Provide and maintain our game server hosting services
- Authenticate your identity and manage your account
- Link your gaming identities across platforms for server access
- Respond to your inquiries and support requests
- Send service-related communications
- Detect and prevent fraud or abuse
4. Information Sharing
We do not sell your personal information. We may share limited data with:
- Game servers: Your gaming IDs (SteamID, Minecraft UUID, etc.) are shared with game servers you connect to for authentication and whitelisting purposes.
- Service providers: Infrastructure and hosting providers necessary to operate our services (see the sub-processors below).
- Legal requirements: When required by law or to protect our rights.
Third-Party Service Providers / Sub-Processors
To operate our services, we rely on the third-party providers below. Each receives only the data needed for its function, and each processes that data under its own privacy policy and terms.
| Provider | What it handles |
|---|---|
| Stripe | Payment processing. Card details are handled directly by Stripe and are not stored by us; we keep billing records (invoices, amounts, dates). |
| Cloudflare | CDN, DDoS protection, and R2 object storage for uploaded media and images. Cloudflare Turnstile also provides bot protection on our forms, processing your IP address and browser signals and potentially setting its own cookie for that purpose. |
| SMTP2GO | Our email delivery provider for transactional and newsletter email (delivery requires your email address). |
| Discord, Steam, Microsoft | OAuth login providers. When you sign in, we receive your account ID, display name, and avatar from the provider you choose (see Section 2). |
5. Data Retention
We retain different types of data for different periods based on operational and legal requirements:
| Data Type | Retention Period |
|---|---|
| Billing records / invoices | 7 years (legal/tax requirement) |
| Membership application data | 1 year from decision date |
| Active member records (Steam ID, Discord, whitelist) | Duration of membership + 90 days |
| Server connection logs | 90 days |
| Anti-cheat event logs | 1 year |
| Admin action logs (permanent bans) | Indefinite |
| Admin action logs (resolved temp bans) | 2 years |
| Application logs | 30 days |
| Database backups | 14 days |
On Cancellation
Billing stops at the end of your current cycle. Discord roles and server whitelist access are removed at end of cycle. Your active member record is marked inactive, retained for 90 days, then deleted. Application data is retained for 1 year from decision date, then deleted.
On Deletion Request
Contact us via email [email protected] or submit a data deletion request through our website. We can delete application responses and inactive member records. We cannot delete billing records (legal requirement), active ban admin logs, or anti-cheat records needed for ban integrity. Requests are processed within 30 days.
GDPR / CCPA
We are a small operator. We do not sell data. We do not run targeted advertising. Members can request a data summary, request correction, or request deletion (with the exceptions noted above) at any time. Response time: 30 days.
6. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Unsubscribe from marketing communications
- Request a copy of your data in a portable format
To exercise these rights, visit our Data Deletion Request page or contact us at [email protected].
7. Cookies
We use essential cookies for the operation and security of the site:
- DustBowl.Auth: Session authentication cookie (HttpOnly, 30-day expiry)
- Antiforgery tokens: CSRF protection for form submissions
- Cloudflare Turnstile: Our forms use Cloudflare Turnstile for bot protection, which may set its own cookie and process your IP address and browser data to tell humans apart from automated abuse. This is a security measure, not tracking or advertising.
We do not use advertising or marketing tracking cookies, and we do not use third-party analytics cookies to profile you across sites. The only third-party cookie that may be set is the Cloudflare Turnstile security cookie described above.
8. Security
We implement industry-standard security measures including encrypted connections (HTTPS/TLS), secure cookie flags, DDoS protection, and automated system hardening. However, no method of transmission over the Internet is 100% secure.
Vulnerability Disclosure
If you discover a security vulnerability in our infrastructure or services, please report it privately via email to [email protected]. Do not disclose the vulnerability publicly until we've had a chance to address it.
Please include: what you found, how you found it, and any evidence of exploitation.
- Acknowledgment: Within 24 hours
- Status update: Within 72 hours
- Fix timeline: Within 7 days
We do not currently operate a bug bounty program, but responsible disclosures are credited in post-mortems with the reporter's consent.
9. Children's Privacy
Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such data, we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the revised policy.
11. Contact Us
If you have questions about this Privacy Policy, contact us at:
- Email: [email protected]
- Headquarters: Hickory, NC