Privacy

Flagglobe works without an account. Your records, the flags you already know and whether this browser has signed in are kept in your browser's own storage, and they are written only when you play or sign in. Analytics keeps nothing there at all.

One request our own server answers for everyone: the home page asks it for today's Daily board on every load, and the game asks for the same board whenever it shows a Daily result — at the end of a round, or when you open a set you have already played. The board is shown with or without an account. A visitor who has not signed in sends no cookie with that request, and the answer writes nothing into your browser's storage.

Google account

Signing in with Google does two things: it keeps your records on the server and shows them on other devices, and it lets a Daily result of yours onto the board. Together with the confirmation of the sign-in, Google passes us the basic account data — identifier, name, email address, language and profile picture. Out of all of that we store only the identifier and the name; the rest is discarded right after the token is verified and is never kept anywhere. Alongside them we keep one thing of our own: the board name you appear under.

That board name is made out of your account identifier by a one-way calculation — the name cannot be turned back into the identifier — so the same account gets the same name on every device without anything being written down when you sign in. The Edit name button on the home page replaces it, and the name you choose is stored next to your records.

Your Daily result goes on a public board that anyone can see on the home page — the board name, the time and the accuracy. What goes up is the first result of the day that reaches our server, and a round you played earlier that same day without an account goes up too, as soon as you sign in and your results are merged. The board shows one UTC day; the rows stay in the database afterwards and are deleted on request together with your records. Nothing else about you is there: not the identifier, not the name from Google, not the email address.

Records on the server are kept until you ask for them to be deleted. Account data is not passed to third parties and is not used for advertising.

Signing in sets one technical cookie, __Host-sid — a random session identifier, not readable by page scripts, with a lifetime of 30 days. It exists only so that the server recognises you between visits; there is nothing else in it. It is the only cookie the site itself sets; without signing in, the site sets none. Google's ad script on the game and map pages is a separate matter and may set cookies of its own — see “Ads” below.

Signing out deletes the session together with the cookie, but not the records themselves — they stay on the server so that signing in again brings them back. To have them deleted, write to drychykdmytro@gmail.com; they are removed within 30 days.

Analytics

The site uses Cloudflare Web Analytics for page views. It sets no cookies and does not follow you between sites. What is collected is anonymous totals: how many times a page was opened, from which country, from which browser, device and operating system, where the link came from and how fast the page loaded.

The game also records how rounds go. For each round: the mode, whether it was started, finished or left, the score and the time. For each flag: which country it was, whether it landed on the first try or the game had to place it, how many misses and hints it took, whether you asked for the country's name, how long it took, which wrong countries were clicked, and whether the device has a touch screen. A few things outside a round are recorded the same way: coming back to a Daily set you have already played, whether an ad was offered, watched or dismissed, whether the ad library failed to load at all, and whether sharing a result used the share sheet, the clipboard or failed — the method only, never what was shared or with whom. If a script on the page fails, the first 64 characters of that error message are recorded too, together with the address of the file the failure came from and the line number in it, so that a broken page can be told apart from an empty one, and our own failure from a failure inside someone else's script. The game's own code is built into the page, so for our own failures that address is the address of the page itself, with the query string dropped; nothing else of the stack is kept. Only http and https addresses are recorded — never a file on your own computer, never an address from a browser extension. The game has no text fields, so nothing of yours can end up in it. Together with these events the game sends a random identifier that ties together the rounds of a single visit. It is made fresh every time the page is opened, is never written to your browser's storage, and is gone when you close the tab, so rounds from two different visits cannot be linked to each other. It is not tied to your Google account, your name or your email, and it is not used to follow you between sites. These events are stored by Cloudflare, which keeps them for three months and then deletes them; we keep no copy of our own.

The IP address reaches Cloudflare with the request itself, and the country is derived from it. Our code never reads that address and never stores it; what is saved next to each of these events is the country of the request, and nothing finer.

The identifier resets by itself — reload the page and a new one is made. Analytics never reads your browser's storage either: your records and the list of flags you know stay on your device and are not sent with these events. The one place those lists show through is Practice and Practice capitals: their decks are built on your device from the flags or capitals you have not learned yet, so the countries in such a round, and how many there are (up to thirty), follow from them. A round played from a file opened on your own computer sends nothing at all.

Ads

Between rounds the game shows a full-screen ad from Google AdSense. There are no ads during a round, and none in the first round after the page is opened.

Google and its partners may use cookies and device identifiers to select ads, limit how often they repeat and count impressions. How Google uses this data is described on the page “How Google uses information from sites that use our services”. Ad personalisation can be turned off in Google ad settings. You can also opt out of the use of cookies for personalised advertising by third-party vendors at aboutads.info or, in Europe, at youronlinechoices.eu. The companies that may take part when Google serves these ads are named in Google's list of ad technology providers.

In the European Economic Area, the United Kingdom and Switzerland, ads are shown only after your consent. It is asked for by a Google-certified consent dialog which Google's own ad script displays, and it appears when a page with the game opens: the game page and every regional map page load the script, while the hub, this page and the other static pages carry no ads and ask nothing. In the dialog you can agree, decline, or set your choice purpose by purpose. To change your decision later, open the game and use the Ad privacy link in the top-left corner — it reopens the same dialog. The link appears only where the dialog itself applies.

We pass advertisers neither your name, nor your account identifier, nor your records.

Who is responsible, and your rights

The site is run by Dmytro Drychyk, a private individual, as the data controller; the contact for any question about this policy or about your data is drychykdmytro@gmail.com. There is no other way we can be reached, and there is no third party acting on our behalf beyond the services named above.

The legal bases are: your consent for advertising in the European Economic Area, the United Kingdom and Switzerland, which you may withdraw at any time as described under “Ads”; the performance of the service you asked for when you sign in and we keep your records; and our legitimate interest in knowing that the site works and how rounds go, for the anonymous analytics, which sets nothing in your browser and carries no identifier that outlives the tab.

You have the right to ask what we hold about you, to have it corrected or deleted, to have its processing restricted, to receive it in a portable form, and to object to processing based on legitimate interest. Write to the address above. If you believe we handled your data wrongly, you may complain to a data protection authority in the country where you live.

Our two processors — Google LLC (sign-in and ads) and Cloudflare, Inc. (hosting, records, analytics) — are both in the United States and both certified under the EU–US Data Privacy Framework, so data reaching them travels under the European Commission's adequacy decision of July 2023. Providing data is never required to play: the game works with no account, and a round opened from a file on your own computer sends nothing anywhere.

Updated: September 13, 2026