Privacy Policy

The controller is Lorenzo Browne, Chemin des Vignes 43a, 1299 Crans, Switzerland. Privacy questions and requests: support@flagtide.com.

• Your username, display name, avatar, level, join date, collection and showcase, profile badges and invite code.
• Your trades with them, your market listings and auction bids, and your place on leaderboards (including the top-inviters board).
• A Off the Map answer you typed, if enough players give the same answer and it's added to the list (shown without your name).
• Never: your email, date of birth, purchases, spending limit or who invited you.

• To provide the service you asked for (GDPR Art. 6(1)(b)): your account, the game, purchases.
• Legal obligations (Art. 6(1)(c)): accounting and tax records, age rules.
• Legitimate interests (Art. 6(1)(f)): security, preventing cheating and fraud, fixing bugs, improving the game.
• Consent (Art. 6(1)(a)): only where we ask for it; you can withdraw it at any time.

We don't sell or rent personal data. These providers process it on our behalf, under contracts that oblige them to protect it:

• Supabase: database, sign-in and account emails.
• Vercel: website hosting and delivery.
• Google: only if you choose "Continue with Google" (we receive your email and basic profile).
• Stripe: card payments, once Coin bundles are on sale. Stripe handles your payment details; we never see your full card number.

We may also share data where the law requires it, or to protect players and the game against fraud.

Some providers above may process data in the United States or other countries. Where those countries don't have an adequate level of data protection, we rely on safeguards recognised by Swiss and EU law, such as the EU Standard Contractual Clauses (with the Swiss amendments) or the Swiss-U.S. and EU-U.S. Data Privacy Frameworks.

• Account and game data: while your account exists. Deleting it in Settings removes it straight away (backups roll over within 30 days).
• Purchase and accounting records: as long as tax and accounting law requires (in Switzerland, generally 10 years).
• Technical logs: a few weeks at our hosting providers.
• Records of rule breaks (e.g. bans for fraud): as long as needed to stop it happening again.

You can ask to see the data we hold about you, get a copy of it, correct it, delete it, restrict or object to how we use it, and withdraw any consent. Email support@flagtide.com from your account's email address; we answer within 30 days. You can change your spending limit and delete your account yourself in Settings; to correct your date of birth, email us.

If you think we've handled your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, in the EU, to the data protection authority of your country. We'd appreciate the chance to fix it first.

You must be at least 13 to sign up. Players under 18 can't buy Coins or use auctions. If you believe a child under 13 has an account, or you're a parent who wants their child's data deleted, email support@flagtide.com.

To keep the game fair, our servers check for results that look automated or impossible (for example a Daily Game finished faster than a person can play, or invite rewards farmed with fake accounts). Such results are held for a human review; nothing is decided against you purely by a machine. You can always ask for a review at support@flagtide.com.

Data is encrypted in transit (HTTPS), passwords are stored only as hashes, and access to player data on our side is limited to what's needed. No system is perfectly secure: use a strong, unique password. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

We only use cookies and browser storage needed to run the site (sign-in, invite links, your sound and display choices). No advertising or analytics cookies. Details: Cookies.

We'll update this page when what we do with data changes, and tell you in the game or by email about important changes.