Privacy Policy

Zombie Land is a Rust PvE community operated by THUNDERBIRD SERVICES, LLC. This policy applies to three places:

• This website, ZombieLand.io, including the player profile, the stats and Wraith analytics pages, the kit builder, and the staff tools.
• Our game servers, the official Zombie Land Rust servers listed on the home page.
• Our Discord server, including the bots that run in it.

It does not cover Steam, Discord, Facepunch (the makers of Rust), YouTube, Twitch, Kick, or any other company whose site you reach from ours. Those are their own businesses with their own policies. Where we hand something to one of them, or take something from one of them, we say so in §8.

You can read every public page on this site without signing in, and we do not try to work out who you are while you do it.

Access logs exist so we can spot an outage, a broken link or someone hammering the API. They are not read for any other reason, they are never joined up with your player account, and they roll over on their own.

Some parts of the site, such as your profile and the staff tools, need to know who you are. We use Steam OpenID for that, which is Steam's own sign in system.

What we store when you sign in

• Your SteamID64, which is the account key for everything on our side.
• Your Steam display name and avatar, fetched from Steam so pages can show a name instead of a number.
• Anything you choose to fill in yourself: a display name override, a Discord tag, a short bio, or a profile picture you upload to replace the Steam avatar.
• Your role on the site (member, or a staff role), and if you are staff, an audit record of admin actions you take, so the team stays accountable.

The session cookie

Signing in sets one cookie, zl_staff. It holds a signed token with your SteamID and an expiry date, nothing else. It is marked HttpOnly, Secure and SameSite, so it cannot be read by scripts and is not sent to other sites. Signing out clears it, and it expires on its own.

When you connect to a Zombie Land Rust server, the game itself hands the server your SteamID, your Steam name and your connecting IP address. That is how Rust works on every server you have ever joined, ours included. On top of that, running a server and its plugins produces records such as:

• Session data: when you connected and disconnected, and which server you were on.
• Progression and economy: your rank, playtime, balances, kits used, shop purchases, vote rewards, skill levels, and anything else a plugin has to remember between logins so the server works at all.
• Gameplay events: deaths, kills, raids, boss fights and similar, including the Wraith encounter data that feeds the Wraith analytics pages.
• Moderation records: in-game chat logs, reports, warnings, mutes and bans, plus the reason and the admin who issued them. Ban records are kept for as long as the ban stands, and usually longer, because a lifted ban still needs its history.
• Support tickets and whatever you attach to them, such as a video clip, kept with the ticket.

We use this to run the server, settle disputes fairly, enforce the General Rules and the Administration Policies, fix bugs, and build the public stats pages. We do not use it to profile you for anything outside the community.

Our Discord server is hosted by Discord, and everything you post there lives on Discord's systems under their privacy policy. As server operators we can see the same things any Discord moderator can see: your username, your Discord ID, your avatar, your roles, and the messages you post in channels we can read.

What our bots do

• Hand out roles based on your rank, your donations and your linked account.
• Run support tickets. A ticket transcript, including anything you paste into it, is kept so a later admin can pick up where the last one left off.
• Post server announcements, wipe notices and go-live notifications for streamers who opt in.
• Moderation logging: joins, leaves, edits, deletions and moderator actions, which is standard for any Discord of this size.

Applications and forms

A few pages have forms, such as the Wraith Bounty application. Those collect exactly what the form shows on screen: a creator name, channel links, audience figures, a SteamID64, a Discord tag, a roster and any note you add. We use it to review the application and contact you about it, and nothing else. We also keep a short-lived record of the IP addresses that submit, purely to stop someone spamming the form.

The store

Purchases happen on our store at store.zombieland.io, which runs on a third-party game store and payment platform. Card numbers and payment details go to that platform and its payment processor, never to us. We do not see, handle or store them. What comes back to us is the part we need to deliver your purchase: which package was bought and which SteamID it goes to. That platform has its own privacy policy and is the controller of the payment data.

Voting

Vote links point at third-party server listing sites such as rust-servers.net. Those sites run their own accounts, their own logging and their own policies. All we receive is a callback saying a given SteamID voted, so the reward can be delivered in game.

This is the complete list of outside services involved in running Zombie Land, and what each one touches.

We share personal information with these services only as far as the job requires. We do not sell it, rent it, trade it or hand it to advertisers. The one other case where we would disclose something is a lawful demand from a competent authority, or a genuine safety emergency such as a credible threat of harm.

There is no cookie banner on this site because there is nothing to ask you about.

• One cookie: the zl_staff session cookie, set only after you sign in with Steam, described in §3. It is strictly necessary for signing in. There are no advertising, analytics or tracking cookies.
• Local storage: a few pages remember small preferences in your own browser, such as an enchanting build you were planning, which dashboard cards you arranged, or which Hall of Legends cards you have already seen. This never leaves your device and is never sent to us. Clearing your browser data wipes it.
• Embeds: the RankEval leaderboard and any YouTube video you play may set their own storage, under their policies, not ours.

Competitive servers run on visible scoreboards, so some information is public by design. Specifically:

• Leaderboards and stats pages show in-game names, SteamIDs, ranks and gameplay figures such as kills, times and win rates.
• Wraith analytics publish fight records, including who was in the squad, how long it took and how it ended.
• The Hall of Legends and event results list the players involved.
• Staff cards on the About page show a staff member's name, role and avatar, which is something they opt into by joining the team.

None of this includes an email address, a real name, an IP address or anything you have not put in front of the server yourself. If you would rather not appear on a public board, tell us in a ticket and we will exclude you where the system allows it.

• Web server logs: a short rolling window, long enough to investigate a problem.
• Your site account: for as long as it exists. Ask us to remove it and we will.
• Progression and economy data: until the server it belongs to wipes. Rust wipes are scheduled and most of it is cleared then, though some things are deliberately carried across wipes, such as rank and playtime.
• Stats, fight records and leaderboards: kept as historical record so past seasons still make sense.
• Moderation records, bans and ticket history: kept as long as they are useful for enforcement and appeals. A ban with no history behind it cannot be appealed fairly.
• Purchase records: kept as long as we need them to support the purchase and meet accounting obligations. The payment platform keeps its own records on its own schedule.

The site is served over HTTPS. Sign in uses Steam's own system, so there is no password of yours for us to leak. Session cookies are signed, HttpOnly and expiring. Staff tools sit behind per-role permissions, and admin actions are written to an audit log. Secrets and API keys live on the server only, never in anything your browser downloads.

That said, we are a game community, not a bank, and no system anywhere is perfectly secure. We are telling you plainly what we hold precisely so you can decide what you are comfortable putting into it. If you ever spot a security problem with our site or servers, please report it quietly in a ticket rather than publicly, and we will get on it.

Zombie Land is not aimed at children. Playing here requires a Steam account, and our Discord requires a Discord account, and both of those services set their own minimum age, which is 13 in most countries and higher in some. You need to meet the age requirement of those services to be here.

We do not knowingly collect information from anyone below that age. If you are a parent or guardian and believe a child has given us personal information, contact us in Discord or at privacy@zombieland.io and we will remove what we can.

You can ask us to:

1. Tell you what we hold on your SteamID or Discord account.
2. Correct anything wrong, such as a display name or a mistaken record.
3. Delete your site account, your profile picture and the personal parts of what we hold.
4. Unlink your Discord from your Steam account and drop the pairing on our side.

Two ways to ask. Open a support ticket in our Discord, which is the fastest, or email privacy@zombieland.io if you would rather have it in writing or are not in the Discord. Either way, tell us what you want and include your SteamID64 so we can find you.

We will ask you to prove the account is yours, usually by signing in with Steam or by asking from the linked Discord account, because otherwise anyone could delete anyone. Expect an answer within 30 days, and usually a lot sooner than that.

Where we have to say no

Two honest limits. First, we will not delete ban and moderation records on request, because deleting them is how a banned account wipes its own history and walks back in. Second, some records are shared, such as a fight where four people were in a squad, or a trade between two players, and we cannot erase one person out of another person's history. Where we cannot delete something, we will tell you why rather than quietly ignore the request.

If you are in a place with laws like the GDPR or the CCPA that give you formal rights over your data, those rights apply and we will honour them. The route is the same: a ticket or an email to privacy@zombieland.io, telling us what you are asking for. For anything held by Platform Sync, Discord, Steam or the store platform, you will need to go to them directly, and we will point you the right way if you are not sure where to start.

If we change something here that actually matters, such as adding a new service that touches your data, we will update the date at the top of this page and announce it in the Discord. Small wording fixes will just change the date.

Questions about any of this, including the awkward ones, are answered by a person, not a form letter. Reach us either way:

Zombie Land is operated by THUNDERBIRD SERVICES, LLC. Privacy questions sent to that address reach the owner directly.