Ultimata — Privacy Policy

Last updated: 21 August 2026

Ultimata (“the app”) is an unofficial, non-commercial native Android browser for torn.com. It is a hobby project and is not affiliated with, endorsed by, or operated by Torn or its owners. This policy explains exactly what data the app handles, why, and your choices.

Contact: olesien2@gmail.com · Developer: Ultimata

The short version

The app does not store your Torn username or password. You log in on Torn’s own web page inside the browser, exactly as you would in Chrome.
If — and only if — you turn on push notifications, the app sends your Torn API key and your device’s notification token to our notification server so it can watch the official Torn API for the events you chose and alert you.
Your Torn API key is sent over HTTPS and stored encrypted (AES-256-GCM), and is used only to call the official Torn API on your behalf.
We show no ads, run no analytics or tracking, and never sell or share your data for marketing.
The Request revive and Request merc buttons send a request to those services — but only when you tap one and confirm it. Nothing is sent automatically, in the background, or on a schedule.

If you never enable notifications and never tap those buttons, the app sends no personal data to us at all — it is just a browser talking to torn.com.

What the app collects, and why

1. Browsing (always local)

The app is a WebView-based browser. Your Torn login session, cookies, and page data live on your device, the same as any browser. They are never sent to us, and the app stores no Torn credentials.

2. Notifications (only if you enable them)

When you enable push notifications, the app sends the following to our notification backend (notify.ultimata.net) over an encrypted HTTPS connection:

Data	Why	How it’s stored
Torn API key	To poll the official Torn API for the events you subscribed to (bars, cooldowns, chain, travel, mail, etc.).	Encrypted at rest with AES-256-GCM. A one-way SHA-256 hash is also kept purely as an anonymous lookup handle to authenticate you — we never look you up by the key itself.
Push token (Firebase Cloud Messaging)	To deliver notifications to your specific device.	Stored to route messages to you.
Torn player ID & API-key access level	Derived from your key when you register; used to route your alerts and gate features that need a higher-permission key.	Stored alongside your record.
Your notification settings	So your chosen toggles and thresholds persist.	Stored as your preferences.

You control the scope by choosing which key you provide on Torn (a Limited-access key is enough for most alerts). The app never asks for your Torn password.

3. The home screen widget (only if you add one)

The optional widget shows your bars, cooldowns and unread counts on your launcher. It talks only to the official Torn API, directly from your device — never to our server. Its latest reading is stored on that device only so it can draw without a network call, and it is dropped when you delete the widget or remove your API key. By default it reads only while you are using the app; one setting, off by default, additionally lets it check on a slow timer (15 minutes or longer) while the app is closed.

4. Asking for help (only when you tap)

The app can ask the war-support services for a revive or a merc — the same two requests the 39thSite war page makes. Nothing is sent unless you tap the button and confirm:

Revive — UHC (tornuhc.eu): sends your Torn player ID and a fixed identifier for the app, so their revive team knows who to revive. No API key is sent.
Merc — ultimata.net: sends your Torn API key, which that service uses only to confirm who you are against the official Torn API before alerting its merc team, plus the two options you ticked (whether the request is “stricken”, and whether you stripped your gear).

One tap sends exactly one request. The app never repeats or retries a request on its own.

5. Crash diagnostics (Firebase Crashlytics)

If the app crashes, Google Firebase Crashlytics collects a crash report to help us fix bugs: the stack trace, app version, device model, OS version, and a random Crashlytics installation identifier. This contains no Torn credentials and no page content, and is used only to diagnose stability.

What the app does not collect

No Torn username or password (the app stores no login credentials).
No email address, real name, phone number, or postal address.
No location, contacts, photos, files, microphone, or camera access.
No advertising identifier, and no advertising or marketing analytics.

Who your data is shared with

We do not sell your data or share it for advertising. It is only processed by the service providers needed to run the app’s features:

Google Firebase (Cloud Messaging + Crashlytics) — processes your push token and crash reports to deliver notifications and report crashes. Governed by Google’s Privacy Policy.
The official Torn API (torn.com) — we call it using your API key to fetch the game state your alerts are based on. Governed by Torn’s own terms and privacy practices.
UHC (tornuhc.eu) — receives your Torn player ID when you request a revive, so it can be actioned. Governed by their own practices.
ultimata.net (39thSite) — receives your Torn API key when you request a merc, and, if you turn on the target-overview or war battle-stats features, when those look up a player’s spied stats. Governed by its own practices.

Security

All data in transit uses HTTPS. Your Torn API key is encrypted at rest using AES-256-GCM.

Data retention & how to delete your data

Your notification data (API key, push token, player ID, settings) is kept until you delete it. You can delete all of it at any time:

In the app: Settings → Remove key. This deletes your stored API key, device token, and notification settings from our server.
By email: write to olesien2@gmail.com and we will delete your record.

If your Torn API key is deleted or revoked on Torn’s side, our server detects this and removes your data automatically.

Children’s privacy

The app is a browser for Torn, which is intended for a mature audience. Ultimata is not directed at children and we do not knowingly collect data from children.

Changes to this policy

We may update this policy; material changes will be reflected by the “Last updated” date above. Continued use after an update constitutes acceptance.

Contact

Questions or deletion requests: olesien2@gmail.com.