Privacy policy

Last updated 1 November 2026

Playing as a guest

You can play Flag Flash without an account. Your settings, best scores and daily results are stored in your browser's local storage on your device. When you finish the daily challenge, we store your score, a random player ID and the leaderboard name you choose (or "Anonymous") so the leaderboard can show rankings.

If you create an account

When you sign in with Google, we receive your Google account ID, email address, first name and profile picture. When you sign in with email, we store your email address and send you a one-time code. We use this to keep your account, and we keep your game stats (best scores, daily results and streaks) so they follow you across devices.

We use a single cookie, ff_session, to keep you signed in. We don't use advertising or tracking cookies.

Live duels

While you have the live 1v1 page open, other signed-in players on that page see your account name, profile picture and number of duels won, so they can challenge you. When you play a duel, your opponent sees your name and picture, and we store each duel's answers, scores and result so you can see your record. Duels against other players change your duel rating, which other players can see, and the players with the most wins each week are listed on the duel page. A player you meet through "Find an opponent" can follow you, which shows them your daily result. Deleting your account deletes your duels.

Classroom mode

Teachers use a normal Flag Flash account to make classes and set quizzes. Students join a class with its code and a name, without an email address or account. For each student we store the name they type, which class they joined, and their result for each quiz (score, number right, time taken and which flags they answered). Only the student's teacher can see this. The student's browser keeps a random token so it stays in the class; nothing else on the device is used.

Teachers can remove a student, a quiz or a whole class at any time, which deletes the results with it. Deleting a teacher's account deletes all their classes. Students or parents who want a student's data removed can ask the teacher or email us.

Paying for a plan

Teacher Pro payments are handled by Stripe. We never see or store card details; we keep which plan you're on, until when, and Stripe's customer and subscription ids so you can manage billing. Schools that pay by invoice give us the school's name, a contact and the email addresses or domain the license covers. When a school asks for a quote, we keep what they typed into the quote form so we can reply.

Buying Flag Flash cards

When you buy cards, Stripe takes your payment on its own secure page; we never see or store your card details. Stripe sends us your name, email address, phone number and delivery address, and we keep them with what you ordered so we can send it, answer questions about it and handle returns. We share your name, address and phone number only with whoever prints and posts your order, and the courier. We use your email address to send your receipt, tracking, your friend code and, two weeks after delivery, one request for a review. If you join the waitlist we keep your email address only to tell you once when the cards go on sale, and you can unsubscribe from that email. We keep order records for as long as tax law requires (usually six years); email us to have anything else removed sooner.

Visitor statistics

We count visits with Cloudflare Web Analytics, which doesn't use cookies or track you across sites. It tells us things like which pages are popular and roughly which countries visitors come from.

Who we share it with

We don't sell your data. It is stored with Cloudflare, which hosts the site. Sign-in emails are delivered through our email provider, Resend. Stripe handles payments for paid plans and card orders. Card orders are shared with the printer and courier that send them. Google handles "Sign in with Google". Only your leaderboard name and scores are shown publicly.

Deleting your data

Signed-in players can delete their account at any time from the account page. This removes your account, your saved stats, your leaderboard entries and any classes you teach. Guests can clear their data by clearing site data in their browser.

Children

Flag Flash can be played without an account. Accounts are intended for players aged 13 and over.

Contact

Questions about privacy: hey@flagflash.com