Pairing privacy

The extension handles Rust+ authorization you start from GOMPBOT and optional team stats assistance. You sign in and approve access on the official provider pages yourself.

Version 0.2.0 adds an optional Rusticated helper. Enable it on your signed-in dashboard and keep that tab open to receive notifications. Accepting a refresh requests access to rusticated.com. The helper uses your Rusticated login inside that tab to read up to 15 team members’ PvP stats. Login tokens, passwords, cookies and CAPTCHA answers are never sent to GOMPBOT. Searches count toward your provider allowance. You complete all human checks yourself.

A stats job expires in ten minutes. Temporary player IDs and collected numbers are held in browser-session storage until submission, cancellation, expiry, tab closure or browser shutdown. GOMPBOT stores submitted stats in its existing team history. Disable assistance from the dashboard or cancel from the extension; revoke Rusticated host access in your browser’s extension settings.

It observes the Facepunch app authorization response in its own tab, checks the tracked request, session and Steam ID, and encrypts the Rust+ token before passing it back to your GOMPBOT tab. It does not read Steam passwords, use the clipboard, collect general browsing history, or run analytics.

Version 0.1.3 limits access to gompbot.com, www.gompbot.com, and Facepunch’s companion service. It does not request access to generated hosting addresses or localhost. A temporary compatibility rule changes the User-Agent only for Facepunch’s app-handoff request in that authorization tab; it does not change Steam requests or other tabs. The rule is removed when authorization succeeds, fails, expires or is cancelled.

The helper observes the rust-plus authorization redirect and returns to GOMPBOT without needing to launch a local app. If your browser shows an external-app prompt, cancel it. The extension never approves Steam, Facepunch or browser prompts for you.

Temporary extension state uses browser-session storage and expires after at most 15 minutes. Raw Rust+ tokens are not stored by the extension. GOMPBOT’s server keeps your delegated Rust+ device credentials for future pairing until you revoke pairing; current-team and role checks still apply.

The website remembers this browser using a secure, HTTP-only cookie. Website activity renews the login, with a 90-day inactivity limit and a fresh Steam sign-in required after at most one year. Signing out revokes that browser session without removing your saved Rust+ pairing. Clearing cookies, browser privacy settings, or using another browser may require an earlier sign-in. Use Sign out on shared computers. Changing your Steam password does not automatically revoke this website login; current-team and role checks still apply to protected actions.

Only paired team members may use delegated access. Failed team checks record the verified Steam ID privately. The extension does not change who can pair or become an admin.

Uninstalling the extension removes the helper, but does not revoke an existing server delegation. Use Account options → Revoke pairing on your dashboard for that.