Privacy Policy

Last updated: July 17, 2026

This Privacy Policy describes what information Asylum Redux ("we", "us", the "Site") collects when you use this website and its associated Arma 3 game server, how we use that information, who we share it with, how, and the security practices we use to protect it. It applies to this website and its API — it does not cover Steam, Discord, Stripe, or BattleMetrics themselves, each of which has its own privacy policy governing their own services.

1. Information We Collect

1.1 Account & Authentication Data

We do not operate our own username/password system. You sign in exclusively through Steam OpenID — we never see or store a password. When you log in, we receive and store:

  • Your SteamID64 (a permanent, public identifier issued by Steam)
  • Your Steam display name and avatar URL, as they were at the time of your most recent login
  • The IP address and browser user agent your login request came from, and a timestamp
  • An approximate geolocation (city/region/country) derived from that IP address, including whether it appears to be a VPN, proxy, hosting provider, or mobile connection

Your session itself is kept in a signed, encrypted browser cookie that expires after 7 days of inactivity and contains no more than your SteamID, display name, and your current permission/role flags — never a password or payment detail.

1.2 Gameplay Data

If you play on the associated Arma 3 server, your in-game statistics are mirrored onto this site from the game server's own database — this happens automatically through gameplay, not through anything you submit on the website. This includes things like experience, kills/deaths, arrest history, playtime, in-game cash/bank balance, police/ admin rank, gang affiliation, house and vehicle ownership, and crate key/loot inventory.

1.3 Store & Payment Data

We never see or store your card number, expiry, or CVC — all payment collection happens on Stripe's own hosted checkout page. What we do store for every order is: the items purchased, the price paid, order status, a Stripe session reference, and — for chargeback-dispute purposes — the IP address and user agent the checkout request came from. See our Terms of Service for our purchase and refund terms.

1.4 Support, Applications & Community Content

If you submit a support ticket, a police or staff application, a wiki edit, a change proposal (voting), or a comment, we store what you submit — including any custom fields a form asks for (for example, a Discord username or date of birth on staff/police applications) and any file attachments — along with your SteamID and the time of submission.

1.5 Discord Linking

Linking your Discord account is optional. If you link it, we store your Discord user ID and the display name/handle needed to associate your Discord account with your SteamID, so features like role syncing and mailbox display names can work.

1.6 Cookies & Local Storage

We use one functional cookie — the encrypted session cookie described above — and a small amount of browser localStorage for non-sensitive UI preferences (your chosen color theme, whether the sidebar is expanded, and your shopping cart contents before checkout). We do not use third-party advertising or tracking cookies.

2. How We Use Your Information

  • To authenticate you and keep you signed in
  • To display your profile, stats, and leaderboard position to yourself and other players
  • To process, fulfill, and keep a record of store purchases
  • To detect and respond to payment fraud and chargebacks
  • To review, respond to, and track support tickets and staff/police applications
  • To operate community features you choose to use — the wiki, voting/feedback, the giveaways minigames, gang and house management
  • To enforce server rules, including bans, blacklists, and admin/police rank management
  • To maintain security and audit logs of administrative actions, and to detect suspicious login activity
  • To communicate with you about your account, a ticket, or an order

We do not use your information for targeted advertising, and we do not sell your personal information.

3. Who We Share Information With

We disclose information only where it's necessary to provide the Site's functionality, and only to the specific service that needs it — never as a bulk data sale or for a third party's own marketing purposes:

  • Steam (Valve) — your login is authenticated directly against Steam via OpenID; we send Steam only what its login protocol requires.
  • Stripe — processes all payments. We send Stripe the order line items and amount; Stripe collects and holds your payment details directly, governed by Stripe's own privacy policy.
  • Discord — only if you choose to link your account, to verify the link and sync roles/display names.
  • BattleMetrics — used to manage server bans; ban records (including the associated SteamID and ban reason) are stored on BattleMetrics' platform as part of administering the ban.
  • Hosting & infrastructure providers — our web host and network/CDN provider process traffic (including IP addresses) as part of simply serving the Site; they do not receive access to your account beyond what's necessary to route and secure that traffic.
  • Legal requirements — we may disclose information if required to by law, subpoena, or a similar legal process, or to protect the rights, property, or safety of the Site, our players, or others.

Each of the above is contacted programmatically via that provider's official API, using only the specific fields that integration requires — we don't hand over full database exports to any third party.

4. Data Retention

We retain account and gameplay data for as long as your account/game history exists on the server. Login history, order records, and administrative audit logs are kept indefinitely as an accountability and dispute-resolution record, consistent with standard practice for financial and security-relevant logs. If you'd like your data reviewed, limited, or removed, contact us using the method in Section 9 and we'll evaluate the request — some records (for example, completed order history, or logs needed to investigate a ban or chargeback) may need to be retained regardless, for legal, security, or accounting reasons.

5. Security Practices

  • We don't operate a password system at all — authentication happens entirely through Steam OpenID, so there's no site password to be leaked or reused.
  • Session cookies are signed and encrypted (iron-session), scoped, and time-limited to 7 days.
  • Every Steam login is cryptographically verified against Steam's own servers before we trust it — we never trust an identity claim from the browser alone.
  • Card numbers and other payment details are never transmitted to or stored on our servers — Stripe's hosted checkout handles that directly, and every Stripe webhook we receive is signature-verified before we act on it.
  • Access to sensitive player data and administrative tools is restricted by a role-based permission system — staff only get the level of access their role requires.
  • Administrative actions (bans, blacklist changes, player data edits, rank changes) are written to append-only audit logs.
  • Database credentials and other secrets are kept in server-side environment configuration and are never exposed to the browser.

No online service can guarantee perfect security. If we become aware of a data breach affecting your personal information, we will take reasonable steps to notify affected users and relevant authorities as required by applicable law.

6. Your Choices

  • You can link and unlink your Discord account yourself at any time from the account page.
  • You can stop using the Site at any time; simply not logging back in ends your active session once it expires.
  • You can request a copy of, a correction to, or the deletion of your personal information by contacting us (Section 9), subject to the retention limits described in Section 4.

7. Children's Privacy

The Site is not directed at children under 13, and Steam itself requires account holders to meet its own minimum age requirements. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will remove it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Site after a change means you accept the revised policy.

9. Contact Us

Questions about this policy, or requests regarding your personal information, can be sent through our Support Tickets system, or via our Discord.