Scope
This Privacy Policy explains how Flag Game collects, uses, and protects personal information when you use this website (https://flaggame.online).
It applies to our public website, games, flag-identification tool, sign-in flows, and support communications. It does not control the privacy practices of independent websites or providers that link to us.
Information we collect
We may process account and identity data, such as an email address used for sign-in; technical and usage data, such as logs, request metadata, and feature usage; billing-status data from payment events; and content you choose to submit for flag identification, such as an image or description.
You can choose not to provide optional content. Some features may then be unavailable or produce a less useful response.
Why we process data
We process data to provide and secure core service functionality, manage authentication and account access, handle billing state and related entitlements, improve service quality and support operations, generate a requested flag-identification response, and protect the feature from misuse.
We do not sell personal information. We do not use submitted flag images or descriptions to train our own models.
How information is shared
We share information only when it is reasonably necessary to run the service, meet a legal obligation, protect rights and safety, or complete a transaction you request. This may include service providers acting on our instructions, payment providers for a purchase, or authorities where disclosure is legally required.
We do not share personal information with advertisers for their own independent marketing. If our business is reorganised, acquired, or merged, information may be transferred as part of that transaction, subject to the protections described in this policy or otherwise required by law.
Third-party processors
Depending on product configuration, we may use Google OAuth for authentication, Creem for payment processing and subscription events, and Cloudflare Workers AI for flag-identification inference and delivery infrastructure.
Each provider processes data according to their own terms and privacy notices.
Providers may process data in countries other than the one where you live. Where required, we use appropriate safeguards or rely on a legally recognised transfer mechanism.
Cookies and local storage
We may use essential cookies or similar storage for sign-in, security, language preferences, and basic service operation. Where non-essential analytics or similar technologies are introduced, we will provide the notices or choices required by applicable law.
You can usually control cookies through your browser settings. Blocking essential storage can prevent account or security features from working correctly. Browser controls do not necessarily remove information already held in our systems.
Legal basis and user rights
Where applicable, this policy is designed to align with GDPR-friendly principles such as transparency, purpose limitation, and user rights.
You may request access, correction, deletion, export, or restriction of your personal information, subject to legal and operational constraints.
You may also object to certain processing or withdraw consent where processing relies on consent. To make a request, use the contact address below and describe the request clearly. We may need to verify your identity before acting on it.
We aim to respond within the period required by applicable law. If a request is unusually complex, we may need more time or information and will explain that where required. You may also have the right to complain to a data-protection authority in your jurisdiction.
Data retention
We keep data only for as long as reasonably necessary to provide services, meet legal obligations, and resolve disputes.
Images and descriptions submitted for identification are processed to respond to your request and are not intended for long-term storage by the service unless we tell you otherwise at the point of collection.
Retention periods vary by record type. For example, we may retain security logs long enough to investigate abuse, account records while an account remains active, and payment-related records for a period required by tax, accounting, or dispute-resolution rules.
Security
We use reasonable technical and organisational measures intended to protect information against unauthorised access, loss, misuse, and alteration. No internet service can guarantee absolute security. Please use a unique password where an account is available and notify us promptly if you suspect unauthorised activity.
Jurisdiction
Primary compliance framework: International / GDPR-friendly.
Nothing in this policy limits rights you may have under mandatory privacy law in your place of residence.
Changes to this policy
We may update this policy to reflect changes in our service, providers, or legal obligations. The date at the top shows when it was last updated. If a change is material, we will provide additional notice when required by law.
Contact
For privacy requests, email: [email protected]