Privacy Policy

1. Controller

The controller responsible for processing personal data on hipo-mustang.com is:

Nikolaos Kourgiantakis
c/o MDC#1983
Welserstraße 3
87463 Dietmannsried
Germany

Email: [email protected]

This forum is run by a private individual. No data protection officer has been appointed, as there is no legal obligation to do so. Please send any data protection questions to the email address above.

2. Summary

  • We use no tracking, no analytics and no advertising networks, and we do not build advertising profiles.
  • We use only technically necessary cookies (section 4).
  • We do not store IP addresses with posts or private messages. Where the forum stores IP addresses for security reasons, they are deleted after 30 days at the latest.
  • Videos and other content from third-party platforms load only after you consent (section 6.1).
  • The forum is public: posts, profiles and the member list are visible without logging in and may be indexed by search engines.

3. Hosting and delivery

3.1 Server

The forum (WoltLab Suite with Burning Board) and its database run on our own virtual server provided by RelAix Networks GmbH, Aachen, in a data centre in Germany. RelAix provides the infrastructure as a processor (Art. 28 GDPR). We operate the software ourselves. All forum data (accounts, posts, messages) is stored on this server.

3.2 Server log files

For each request, the web server logs the following for technical reasons:

  • IP address of the requesting device,
  • date and time,
  • requested address (URL), HTTP status code and amount of data transferred,
  • the referring page, if your browser sends it,
  • browser identifier (user agent).

We use this data only to keep the service running, find errors and fend off attacks. We do not combine it with other data and do not use it for statistics. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the forum. The log files are capped in size and continuously overwritten. In practice they are kept for a few hours to a few days, and never longer than 7 days.

3.3 Cloudflare (content delivery and attack protection)

All requests to the forum pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare delivers the pages, protects them against denial-of-service attacks (DDoS) and filters malicious requests with a web application firewall. Your browser's encrypted connection ends at Cloudflare. Cloudflare forwards the request to our server over its own, also encrypted, connection (Cloudflare Tunnel). In doing so, Cloudflare processes in particular your IP address, the requested addresses, browser information and the transmitted content. Technically, Cloudflare can see the transmitted content in plain text.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the forum. Cloudflare acts as our processor under its Data Processing Addendum. Cloudflare may transfer data to the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR). The contract also includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not use Cloudflare Web Analytics or bot-detection cookies. More information: https://www.cloudflare.com/privacypolicy/.

4. Cookies and browser storage

The forum stores only information in your browser that is strictly necessary for its operation:

  • wsc_9fb088_user_session (cookie): links your browser to your session. For guests it is a session cookie that is deleted when you close the browser. After login it stays valid for up to 67 days so that you remain logged in. Logging out ends the session.
  • XSRF-TOKEN (cookie): protects against forged form requests (cross-site request forgery). It is deleted when you close the browser.
  • Consent to external content (session storage): if you click "Show all external content" on embedded content, your browser remembers this choice until the end of the session (section 6.1).
  • Cloudflare Turnstile: during registration and after several failed login attempts, Turnstile may store or read information in your browser (section 5.2).
  • cf_clearance (Cloudflare cookie): set only if Cloudflare runs a security check on your browser in a specific case. It is usually valid for 30 minutes.

The legal basis for storing and reading this information is Section 25(2) no. 2 of the German TDDDG, because it is strictly necessary for the service you requested. The subsequent processing is based on Art. 6(1)(b) GDPR (use of the forum) or Art. 6(1)(f) GDPR (security). We do not use marketing, analytics or tracking cookies, which is why we do not show a cookie banner.

5. Using the forum

5.1 Registration and user account

You can read without an account. To post, you need a user account. When you register, we collect:

  • username (publicly visible),
  • email address (not public),
  • password (stored only as a secure hash),
  • time of registration and the IP address used to register,
  • your acceptance of the forum rules and confirmation that you are at least 18 years old.

You confirm your email address via an activation link. After that we use it for notifications you choose yourself, for password resets and for important notices about your account. Without these mandatory details we cannot create an account.

The legal basis is Art. 6(1)(b) GDPR (forum terms of use). We keep the account data as long as your account exists. The registration IP address is deleted automatically after 30 days. We need it only to prevent abuse.

5.2 Spam protection during registration

Cloudflare Turnstile. To prevent automated sign-ups, we use the Turnstile check by Cloudflare, Inc. (USA). It appears in the registration form and after several failed login attempts. Turnstile loads a script from challenges.cloudflare.com and evaluates technical characteristics of your browser and device as well as your IP address to tell humans from bots. According to Cloudflare, Turnstile does not transmit form content. Our server then has the result confirmed by Cloudflare. The legal basis is Art. 6(1)(f) GDPR (protection against spam and abuse) and, for access to your device, Section 25(2) no. 2 TDDDG. For the transfer to third countries, see section 3.3. More information: Turnstile Privacy Addendum.

Check against known spam sources. When you register, we compare your email address and IP address with a list of known spam sources. The list comes from StopForumSpam and is provided via WoltLab. The check runs entirely on our server: the list contains only hash values, and your data is not sent to StopForumSpam, WoltLab or any other third party for this. If there is a match, the registration is rejected automatically. If you think this happened in error, email us and we will review the case personally. The legal basis is Art. 6(1)(f) GDPR (spam protection).

5.3 Login and abuse protection

When a login fails, we store the username entered, the time, the IP address and the browser identifier. After three failed attempts we require a Turnstile check. After too many failed attempts from one IP address, logins from that address are temporarily blocked. These entries are deleted automatically after 30 days. For the duration of your session, the server also stores your IP address, browser identifier, time of last activity and the page you last visited. Guest sessions are deleted after 2 hours of inactivity, and logged-in sessions after 60 days at the latest. The legal basis is Art. 6(1)(b) and (f) GDPR (providing your account, protection against unauthorised access).

5.4 Posts, profiles and public content

Everything you publish publicly in the forum is visible to all visitors, including those who are not logged in, and may be indexed by search engines. This includes:

  • posts, threads, poll answers (if the poll is public), tags and attachments, with username and time,
  • reactions ("likes" and similar), trophies, user ranks and post counts,
  • your profile: avatar (your initials by default), signature, comments on your profile wall and the optional profile details (e.g. about me, birthday, gender, location, occupation, hobbies, website, Facebook and X profile),
  • your entries in the member list and under "Users Online" (this shows which page you are currently viewing; you can hide your online status in your privacy settings),
  • the latest visitors to your profile (kept for 60 days) and your entries in the activity stream (60 days).

You decide in your settings which profile details you provide and who may see them. When posts are edited, earlier versions are kept for 90 days (visible to moderators) so that abuse can be traced. We do not store IP addresses with posts.

The legal basis is Art. 6(1)(b) GDPR (providing the forum's features). Whether to publish optional profile details, particularly sensitive ones, is your own choice. Posts are part of public discussions and remain stored as long as the forum exists, unless you or the moderators delete them.

5.5 Conversations (private messages)

Conversations are visible only to the participants you invite. We store the content, participants and timestamps, but no IP addresses. Messages are not end-to-end encrypted. The administrator technically has access to the database but reads conversations only when a participant reports content or there is a specific suspicion of abuse. A conversation is deleted once all participants have left it. The legal basis is Art. 6(1)(b) GDPR.

5.6 Notifications and email

We send forum emails (activation, password reset, notifications according to your settings) through Amazon Simple Email Service (SES) in the AWS region Frankfurt (eu-central-1). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, acting as our processor. The data processed is your email address, your username and the content of the message. If an email cannot be delivered, we receive a notice from Amazon with the affected address so that we can check the account. Amazon Web Services, Inc. (USA) is certified under the EU-US Data Privacy Framework. The Standard Contractual Clauses in the AWS data processing addendum also apply. The legal basis is Art. 6(1)(b) GDPR. You choose in your account which notifications you receive by email. Notifications inside the forum are deleted after 14 days.

5.7 Moderation and warnings

To enforce the forum rules, moderators may edit, move or delete content, review reported content and issue warnings or bans. For this we store reports, warnings (reason, time, moderator) and moderation logs. The legal basis is Art. 6(1)(b) and (f) GDPR (enforcing the forum rules, protecting users). We keep warnings as long as they are relevant for moderation.

5.8 Deleting your account

You can request deletion of your account at any time by emailing [email protected]. We then delete your account and profile data, your email address and your conversations, unless other participants are affected. Your public posts remain as part of the discussions but are separated from your account. On request we will consider deleting or anonymising individual content. The legal basis for keeping posts is Art. 6(1)(f) GDPR (keeping ongoing discussions understandable).

6. External content

6.1 Embedded media (two-click solution)

Posts may contain embedded content from the following platforms:

This content is not loaded automatically. Instead you first see a placeholder. Only when you click it ("Show once" or "Show all external content") does your browser connect to the provider. The provider then receives at least your IP address, browser information and the fact that you visited our page. It may set cookies and link the visit to your account if you are logged in there. The provider is itself responsible for this further processing. Some providers transfer data to the USA. If the provider is certified under the EU-US Data Privacy Framework, the corresponding adequacy decision applies. Otherwise the transfer is based on your explicit consent (Art. 49(1)(a) GDPR). In that case, access by US authorities cannot be ruled out.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time. As a member, switch off "Show all external content" in your privacy settings. As a guest, close the browser tab; the choice applies only to the current session.

6.2 External images

Images that members embed from other websites are fetched by our server from the other website and cached for up to 14 days (image proxy). Your browser therefore loads these images from our server and does not connect to the other website. The other server sees only our server's address, not yours. Exception: SVG vector graphics cannot be handled by the proxy for technical reasons. They load directly from the other website, which then receives your IP address. The legal basis is Art. 6(1)(f) GDPR (displaying posts with as little data sharing as possible).

6.3 Link previews

When a member adds a link to a post, our server fetches the linked page once and creates a preview with title, description and preview image. The preview image is stored on our server. Viewing the preview does not connect your browser to the linked site. The legal basis is Art. 6(1)(f) GDPR (clear presentation of links).

6.4 Share buttons

Below posts there are buttons for sharing on Facebook, X/Twitter, Reddit, LinkedIn and Pinterest. These buttons load no scripts or images from the networks and transmit no data just by being displayed. Only when you click a button does a window of that network open with the post's address. From then on, that network's privacy policy applies.

6.5 Links to other websites

When you follow a link to another website, that site's privacy policy applies. Your browser may tell the target site which forum page you came from.

7. Donations

7.1 PayPal

You can support the forum with a voluntary donation via PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg ("PayPal"). If you choose to donate, you are redirected to PayPal. There you enter your payment details directly with PayPal, and we do not receive them. After payment, PayPal sends our server the transaction ID, amount, payment status and the email address of your PayPal account. We store this together with your username (if you are logged in), the time and your visibility choice.

Depending on what you choose when donating, the public donor list shows your username and/or the amount. You can also donate anonymously. PayPal processes your data as an independent controller, including for fraud prevention and to meet its legal obligations: PayPal privacy statement.

The legal basis is Art. 6(1)(b) GDPR (processing the donation) and, where statutory retention obligations apply, Art. 6(1)(c) GDPR. Listing you in the public donor list is based on your choice (Art. 6(1)(a) GDPR). We keep donation data until it is no longer needed, but no longer than required by statutory retention obligations.

7.2 Stripe

Alternatively, you can donate via Stripe. For payments from the European Economic Area, the responsible entity is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). If you choose this option, we redirect you to a Stripe payment page (Stripe Checkout). There you enter your payment details directly with Stripe, depending on the payment method e.g. name, email address, card or bank details and billing country. Our forum does not load any Stripe scripts for this. From Stripe we receive only the payment status, the amount, a payment reference and, where applicable, your email address, never your full card or bank details.

On the payment page, Stripe uses its fraud protection "Radar". For this, Stripe evaluates among other things your IP address, device and browser characteristics and your behaviour on the payment page. Stripe sets its own cookies and similar technologies there, for which Stripe itself is responsible: Stripe cookie policy.

The legal basis is Art. 6(1)(b) GDPR (processing the donation), Art. 6(1)(c) GDPR where statutory retention obligations apply, and Art. 6(1)(f) GDPR for fraud prevention. The legitimate interest is protection against fraudulent payments. Stripe acts partly as our processor and partly as an independent controller, for example for fraud prevention and to meet its legal obligations. Stripe may transfer data to Stripe, Inc., USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses also apply. More information: Stripe privacy policy.

8. Contact by email

If you write to [email protected], we process your email address, your name (if given) and the content to handle your request. Emails to this address are received by Cloudflare Email Routing (Cloudflare, Inc., see section 3.3) and forwarded to the operator's mailbox. The legal basis is Art. 6(1)(b) GDPR if your request concerns your user account, and Art. 6(1)(f) GDPR otherwise (answering enquiries). We delete the correspondence once your request has been settled and there is no reason to keep it.

9. Backups

To prevent data loss after a failure, we regularly back up the forum's database and files. The backups are encrypted and stored with RelAix Networks GmbH in storage located in Germany. They are rotated on a fixed schedule, and older backups are deleted automatically. Data that you or we delete in the forum therefore disappears completely only when the backups expire, after 6 months at the latest. The legal basis is Art. 6(1)(f) GDPR (resilience) and Art. 32 GDPR.

10. Recipients and third-country transfers at a glance

  • Processors: RelAix Networks GmbH (server, backups, Germany), Cloudflare, Inc. (delivery, protection, Turnstile, email forwarding, USA/worldwide), Amazon Web Services EMEA SARL (email sending, Frankfurt region).
  • Independent controllers: PayPal for donations, the providers of embedded content after your consent, Stripe for donations via Stripe.
  • The public: all publicly visible forum content (section 5.4).
  • Transfers to the USA: Cloudflare and Amazon Web Services are certified under the EU-US Data Privacy Framework. Standard Contractual Clauses also apply. For embedded content, see section 6.1.

We disclose data to authorities only where we are legally required to. We do not sell data or share it for advertising.

11. Your rights

You have the following rights regarding your personal data:

  • access (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR); processing carried out before the withdrawal remains lawful.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can change many details yourself in your account. For anything else, a short email to [email protected] is enough.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, North Rhine-Westphalia data protection authority)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
https://www.ldi.nrw.de

13. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Automatic security checks (Turnstile, the spam source check, blocking after failed logins) serve only to prevent abuse. If they block you in error, we will review your case personally on request.

14. Changes

We update this privacy policy when the forum or the legal situation changes. The version published here applies.

Last updated: October 2026