1. Controller and contact
The controller for Battle Bingo is Marcel Kuhla · kuhla.tech, Johannesstr. 21, 56112 Lahnstein, Germany. Send privacy requests to bingo@kuhla.tech. Further contact details are available in the legal notice.
2. Hosting and technical access
Battle Bingo is hosted by kuhla.tech on servers in Germany. Access involves processing technically necessary connection data, including IP address, time, requested address, response status, and browser and device information. Server logs are deleted after seven days. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure operation and detecting and resolving technical faults and attacks.
3. Player accounts and gameplay
We store player name and #Tag, chosen country and derived continent, guest status, Elo ratings, leaderboard statistics, match history, moves and lobby assignments. Email accounts also include an email address and hashed password. Passwords are not stored in plain text. Guest play also creates an internal player record.
This data enables sign-in, duels, result calculation and history display. The legal basis is Article 6(1)(b) GDPR. Public leaderboards may show registered players' names with #Tag, country, continent, wins and Elo. Your opponent sees profile information necessary for the duel. The opponent's board is revealed only after the match ends.
4. Sessions and necessary cookies
Technically necessary session and CSRF cookies maintain sign-in and protect against unauthorized requests. Session data may include internal player ID, IP address, browser information and technical session content. Under the intended configuration, the regular session lifetime is 120 minutes since the last activity; cookie lifetimes renew with continued use. Within Discord, secure SameSite=None cookies and, where supported, storage partitioned by embedding context are used.
Access to your device, insofar as strictly necessary for the expressly requested game and sign-in service, is based on section 25(2)(2) TDDDG. The associated processing of personal data is based on Article 6(1)(b) or (f) GDPR.
If you choose light or dark mode, we store that choice locally in your browser (Local Storage) to retain your requested display preference. It is not sent to our server. You can remove it by clearing website data. Without a saved preference, the design follows your system setting.
The selected language is retained in your session. In the Discord Activity, we read your Discord language through the SDK to select German or English. The language is not used to infer your country or determine matchmaking.
5. Discord sign-in and Activity
Optional Discord sign-in authorizes access to your basic profile through the “identify” scope. The Activity additionally requests “rpc.activities.write” to display your current menu, search, lobby or match status on your Discord profile. Lobby codes and opponent names are not published. Our server verifies your profile and stores the Discord user ID to associate your account. A sanitized Discord username may become your initial player name. We do not request your Discord email address, server list or friends list. The legal basis for the requested sign-in and linking is Article 6(1)(b) GDPR.
Authorization codes and access tokens are processed for sign-in and SDK session authentication. Battle Bingo does not persist them in the player database or Local Storage. The single-use OAuth state expires after five minutes. Discord instance and channel information may be available to the client to run the Activity; it does not replace a verified player identity.
Activity connections pass through Discord's proxy. When sharing an invitation, Discord receives the message you initiate and the lobby code; you choose the recipient and confirm sharing in Discord's dialog. Discord's independent service is governed by its privacy policy, including information on controllers, recipients and possible transfers to third countries. The player database hosted in Germany and Discord are separate processing contexts.
6. Contact requests
We process your contact details and message to answer your request. The legal basis is Article 6(1)(b) GDPR for requests concerning the service relationship, otherwise Article 6(1)(f) GDPR based on our legitimate interest in responding. Please do not send passwords or access tokens.
7. Retention and deletion
Account and gameplay data is stored to provide the account, match history and related ratings. Guest profiles are not deleted merely by closing the browser. Automatic periodic deletion of accounts and match histories is currently not configured. You may request deletion through our contact details; we will assess what can be deleted or anonymized and whether statutory retention requirements or establishing, exercising or defending legal claims prevent deletion.
Contact requests are retained as long as necessary for handling them and meeting applicable statutory obligations. Server logs are deleted after seven days. Cookie expiration does not necessarily mean immediate physical deletion of associated server-side session data.
8. No advertising trackers
Battle Bingo uses no advertising trackers or additional analytics cookies. Technical error and performance diagnostics and Discord's independent processing are separate from this.
Technical diagnostics with Sentry
We use Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) to identify technical errors and measure loading and response times. The project is in Sentry's German region. Data includes error types, technical stack traces, software versions, timestamps and performance data for page loads, server requests and database access. Performance data is sampled at a configured rate. We also send aggregate application metrics, such as player totals, players active in the last five minutes, started and completed games, and opened and closed lobbies. These counts contain no player names, player or Discord IDs, or lobby codes; no individual usage profiles are created from them.
Our filters remove request contents, cookies, user profiles, additional context, raw error messages and database parameters before transmission. Browser events pass through our server. Session Replay, screen recordings and Sentry Logs are not enabled. The integration does not store additional analytics cookies or persistent analytics identifiers in your browser.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is game reliability and security, and identifying and resolving performance problems. Diagnostic data is subject to the Sentry project's retention and deletion settings and is needed only for technical analysis. Ask our privacy contact for current retention settings. Sentry acts as a processor; any access or processing outside the EEA must meet Articles 44 et seq. GDPR. Further information is available in Sentry's privacy policy and data processing agreement.
9. Your rights
Subject to applicable legal requirements, you have rights to access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it with future effect. You may complain to a supervisory authority, particularly where you live, work or suspect a breach. For the provider in Rhineland-Palatinate, one contact is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate.
Use the contact details above to exercise your rights. There is no solely automated decision-making with legal or similarly significant effects; automatic calculation of match results and Elo is used for game ratings.
Last updated: 23 October 2026