Privacy Policy

This is a translation. The German version is legally binding.

1. Controller

Thomas Houben
Vorstadt 13
41812 Erkelenz
Email: info@ultrasupply.org

2. Hosting and Server Log Files

Hosting: noez (GHOSTnet GmbH), data center in Frankfurt am Main.

For delivery, security, and troubleshooting, the server processes technical connection data. The nginx access log stores truncated IP addresses (IPv4 without last byte, IPv6 only first three blocks), timestamp, request including URL, status, data volume, referrer, and user agent. Error logs may contain full IP addresses. Legal basis is Art. 6(1)(f) GDPR; legitimate interest is secure operation. Configured daily rotation keeps 14 archive files plus current file (regularly up to approx. 15 days). Confirmation and reset links contain short-lived secrets that may appear in access logs.

3. User Account

We process username, email address, a salted password hash, creation, confirmation, and last login time, accepted version of terms of service and timestamp, confirmation of minimum age 16 years, block status, last moderation decision with reason and timestamp, and acquired entitlements. Purpose is provision and administration of the account and game (Art. 6(1)(b) GDPR). No separate consent is necessary. Without mandatory information no account can be created.

Confirmation, reset, and session tokens are stored in account storage only as SHA-256 hashes. Unconfirmed accounts are removed automatically after 48 hours. Confirmed accounts remain until deletion. Confirmation links for email addresses remain valid 48 hours, password reset links one hour. Upon account deletion we remove account, tokens, sessions, and player balance settings immediately from active storage.

IP-based abuse counters for registration, login, and password reset are held temporarily in memory (at most one hour during active cleanup; removed upon restart at latest). Legal basis is Art. 6(1)(f) GDPR, legitimate interest is protection against abuse.

4. Email

Confirmation, reset, and deletion emails are sent via our own mail server. Target address and message content are processed (Art. 6(1)(b) GDPR).

5. Game Operations

Player name, game statistics (e.g. score, kills, deaths), chat messages, and player positions are transmitted to connected players to run the multiplayer game. Ongoing game states reside in volatile memory. Normal chat is not permanently stored. Reported content is stored separately as a moderation case. Bug marks sent intentionally with /mark are saved server-side with name, text, position, viewing angles, map, and timestamp. Game balance settings by administrators are tied to player name. Legal basis is Art. 6(1)(b) GDPR for game operations and Art. 6(1)(f) for bug fixing and fair play. /mark entries are deleted after 90 days.

6. Technically Necessary Browser Storage

The cookie cob_session maintains login (HttpOnly, Secure, SameSite=Lax, 30 days rolling). Signing out revokes the session. In localStorage, callofbongi.settings.v1 and bongi.crosshair are stored. In sessionStorage, bongiAdmin stores admin password for the tab until logout or closing. These technically necessary functions rely on § 25(2) No. 2 TDDDG; subsequent processing on Art. 6(1)(b) GDPR. You can clear local storage in browser settings.

7. Optional Advertising and Cookie Settings

Advertising is disabled by default and exclusively intended on the home page. The game itself loads no ad or CMP scripts. When advertising is enabled, Google CMP can be opened via “Cookie Settings”. Google Consent Mode sets ad_storage, ad_user_data, ad_personalization, and analytics_storage to denied by default. Ad slots are only requested after corresponding consent.

Google AdSense / CMP: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis for optional advertising is Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent is voluntary and not required to play.

8. Optional Purchases via Creem

The shop is disabled by default. On checkout, you are redirected to Creem’s hosted checkout. Creem is seller and Merchant of Record: Armitage Labs OÜ, Rotermanni 14, 10111 Tallinn, Estonia. Creem processes buyer data as independent controller under its own privacy policy and buyer terms.

Only upon clicking “Proceed to payment at Creem” do we transmit product ID, random order reference, email address, and internal account ID to Creem. After payment or refund, our server processes signed webhooks and updates cosmetic/supporter entitlements (Art. 6(1)(b) GDPR). No Creem script runs in your browser.

9. Reports, Withdrawal, and Cancellation

For reports, we store name, optional email, reference, reason, timestamp, status, and human moderation decision (Art. 6(1)(f) GDPR). Reports are deleted 90 days after conclusion. Withdrawals and cancellations contain identity, contact, contract, and timestamp (Art. 6(1)(b) and (c) GDPR).

10. Your Rights

Under statutory requirements, you have rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). Consent can be withdrawn at any time with future effect. Account data can be downloaded on your account page and deleted there; for other matters contact info@ultrasupply.org.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), such as the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf. No automated decision-making or profiling under Art. 22 GDPR takes place.

As of: November 6, 2026.