Last updated: 8 September 2026. This Privacy Policy explains how the operator of flags.games ("we", "us") handles personal data when you use flags.games (the "Service") at flags.games. Our philosophy is simple: we collect only what is needed to deliver the game, we never sell or rent personal information, and you can play every mode without creating an account.
Who is responsible
For data protection questions or privacy requests, contact us at support@flags.games. We will identify the legal controller in replies when required for regulatory requests.
Data we collect
We minimize data collection based on how you choose to use the game:
- Guest gameplay (no account): We assign an anonymous, cookie-based session token in your browser. This enables solo play, daily challenges, multiplayer rooms, and basic abuse protection. We collect no name, email, or identity for guests.
- Registered accounts (optional): If you choose to create an account, we store your email address, authentication provider identifiers (Google or GitHub), username, avatar, XP, gameplay stats, friend code, and privacy preferences (such as leaderboard opt-out) in our Convex database.
- Supporter waitlist: If you join the waitlist, we store the email you entered, the offer you picked, and when we sent waitlist mail. You can leave from the unsubscribe link in those emails.
- Multiplayer activity: Connection state, room codes, round answers, and anti-cheat verification signals processed by our game server.
- Form input masking: When session replay analytics are active, form inputs, passwords, and sensitive text fields are masked on your device before any data leaves your browser.
- Support messages: When you send a message through our contact form at /contact, we collect your email, message content, reason for contact, and an optional technical device snapshot that you choose to attach.
- Security and abuse prevention: IP addresses (from standard proxy headers) used for rate limiting, Cloudflare Turnstile bot checks, and protecting account sign-in endpoints.
- Browser preferences: Sound volume, theme choices, and privacy toggles saved directly in your browser's local storage.
- Crash and diagnostic reports: Error logs and performance diagnostics collected through Sentry to detect and fix bugs.
Why we use data
We process data to operate the game, maintain security, fix bugs, respond to player support inquiries, and comply with legal obligations.
Under data protection frameworks such as the GDPR, our legal bases include contract performance (delivering accounts and gameplay), legitimate interests (platform security, anti-cheat, proportionate technical analytics), and consent (optional analytics cookies).
Who we share data with
We never sell or rent your personal data to advertisers, data brokers, or third parties. We work with trusted infrastructure providers that process data on our behalf:
- Vercel for web hosting, edge compute, and serverless functions.
- Convex for authentication, backend logic, and application database storage.
- Cloudflare for CDN delivery, DNS, media storage, and Turnstile bot protection.
- Sentry for application error monitoring and performance diagnostics.
- PostHog EU for optional product analytics and session replay when enabled.
- Resend and Router.so for transactional account emails, waitlist notices, and support form delivery.
- Google and GitHub for authentication when you choose third-party sign-in.
How long we keep data
We retain data only as long as necessary to provide the Service or comply with legal requirements.
Account records (profile, stats, XP, daily history, and friend connections) are retained until you delete your account.
Authentication sessions and refresh tokens expire automatically or can be revoked anytime.
Temporary gameplay tokens and anti-cheat verification rows are purged automatically on short rolling schedules.
Support inquiries are kept long enough to resolve your issue and verify resolution history.
Technical server logs and error reports follow provider retention schedules (typically 30 to 90 days) and are permanently purged afterward.
Your choices and rights
We build privacy controls directly into the game so you can manage your data self-service:
- Guest play: Play solo modes, daily challenges, and multiplayer without providing any personal information or signing in.
- Leaderboard visibility: Toggle whether your scores and profile appear on public daily and challenge leaderboards anytime in Settings.
- Data export: Download a complete JSON export of your profile, gameplay history, stats, and preferences directly from Settings.
- Account deletion: Permanently delete your account and associated records (profile, XP, daily history, friend lists) with one click in Settings.
- Cookie control: Open Cookie settings at any time to enable or disable optional analytics cookies.
- Waitlist mail: Use the unsubscribe link in a waitlist email to stop further Supporter notices for that address.
Statutory rights
Depending on your jurisdiction (such as under the GDPR or CCPA/CPRA), you may have statutory rights to access, rectify, port, restrict, or delete your personal data, or to object to processing. You can exercise most of these rights directly through the self-service tools described above, or by contacting us at support@flags.games. You also have the right to lodge a complaint with your local data protection supervisory authority.
Security
We protect your data using industry-standard controls, including HTTPS encryption in transit, strict access control on backend services, rate limiting, and continuous vulnerability monitoring. No internet transmission is 100% secure, but we treat infrastructure security as a core responsibility.
Children's privacy
The Service is designed for a general audience and is not directed at children under 13 (or under 16 where required by local law). We do not knowingly collect personal data from children under these ages. If you believe a child has submitted personal data without parental consent, please contact us at support@flags.games so we can promptly delete it.
International transfers
Our infrastructure providers process data in the European Union, United States, and edge points of presence worldwide. Where cross-border data transfers occur, we rely on standard contractual clauses (SCCs) and data protection addenda provided by our infrastructure partners.
Changes to this policy
If we update this Privacy Policy, we will update the date at the top of this page. For significant updates affecting account holders, we will provide advance notice on the site or via email.
Contact
For any privacy inquiries or data requests, email support@flags.games with the subject line "Privacy".
For rules governing gameplay and accounts, see our Terms of Service at /terms.