Privacy Policy

Version 2026-09-06 · Effective [[LAUNCH DATE]]

The short version. One adult holds the account. Children get profiles, not accounts — they have no email address, no password, and no login here. We ask for a nickname and a year of birth, and nothing more. We do not show advertising, we do not track anyone across other websites, and we do not sell personal information.

1. Who we are

xflag (“we”, “us”) operates xflag.ai and its games and applications. The data controller is [[LEGAL NAME / ENTITY]], [[ADDRESS]]. Contact us any time at hello@xflag.ai.

2. What we collect

Data	Why	Where it lives
Account holder’s email address and sign-in identifier	To create and secure the account, and to contact you about the service	Clerk (our identity provider) and our database
Profile nickname and year of birth	To show each profile games appropriate to their age	Our database (Cloudflare D1)
An essential session cookie	To keep you signed in and to check which games a profile may open	Your browser
Standard server logs (IP address, user agent, timestamps)	Security, abuse prevention and diagnosing faults	Cloudflare, retained briefly

What we deliberately do not collect

No passwords. Sign-in is handled by Clerk using Google or an emailed one-time link. We never receive, store, or are able to see a password.
No full dates of birth. We ask for the year only. It is enough to band content by age and is materially less sensitive to hold.
No contact details for children. Child profiles have no email address or phone number, because children do not have accounts here.
No advertising or cross-site tracking. There are no ad networks, no advertising identifiers, and no third-party tracking pixels on this service.

3. Children’s privacy

Parts of xflag are designed for children. We have built the service so that we collect as little information about a child as we practically can.

An adult holds the account. Only a person aged 18 or over may create an xflag account and agree to these terms.
Children do not have accounts. A child uses a profile within the parent’s account. There is no separate login, email address or password for a child.
We ask for a nickname, not a name. The profile creation screen asks you to use a nickname rather than a child’s full real name.
No behavioural advertising or profiling is carried out on any profile, and none on a child’s profile in particular.
Parental control. The account holder can view, correct or delete any profile at any time from the account area, or by emailing us. Deleting a profile removes its data from our database.

We aim to operate consistently with the U.S. Children’s Online Privacy Protection Act (COPPA) and, where it applies, the UK Age Appropriate Design Code. [[CONFIRM WITH COUNSEL BEFORE PUBLIC LAUNCH.]] If you believe a child has provided us with personal information beyond a nickname and year of birth, email hello@xflag.ai and we will delete it.

4. Cookies

We use strictly necessary cookies only. There is no advertising or analytics cookie on this service today.

__Secure-xf_sess — keeps you signed in and records which profile is selected. It expires after 7 days. Without it the service cannot work.
Clerk sets its own session cookies on sign-in for the same purpose.

Some games also save your progress in your browser’s local storage, so that a half-finished puzzle is still there when you come back. That information stays on your own device, is never sent to us, and is cleared when you clear your browser data.

If we later add analytics, we will update this policy and ask for your consent first where the law requires it.

5. Why we are allowed to process this data

Where the UK or EU GDPR applies, our lawful bases are:

Performance of a contract — running your account and delivering the games you asked for.
Legitimate interests — keeping the service secure and preventing abuse, balanced against your rights.
Consent — for anything optional, which you may withdraw at any time.

6. Who we share it with

We do not sell personal information. We share it only with:

Service providers who process data on our instructions: Clerk (authentication) and Cloudflare (hosting, database, CDN).
Legal requirements — where we are obliged to disclose by law, or to protect someone’s safety.
Business transfers — if xflag is involved in a merger, acquisition, financing or sale of assets, user information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will give you notice before your information becomes subject to a materially different one.

7. How long we keep it

Account and profile data: for as long as your account is open, and deleted within 30 days of you closing it.
Server logs: a short period for security and diagnostics, then discarded.
Records of your agreement to these terms: kept while the account is open and for a reasonable period afterwards, because we may need to show what was agreed and when.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict how we use it, and to complain to a data protection authority. Californian residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal information for cross-context behavioural advertising.

To exercise any of these, email hello@xflag.ai. We will respond within the time the law allows. We will not treat you differently for asking.

9. Security

All traffic is encrypted in transit. Session cookies are signed, marked HttpOnly and Secure, and cannot be read by scripts in your browser. We hold no passwords to lose. No system is perfectly secure, but we take the protection of a service used by children seriously, and we will tell affected users promptly if a breach occurs that is likely to put them at risk.

10. International transfers

Our providers operate globally, so your information may be processed outside your country. Where required, transfers are covered by appropriate safeguards such as the European Commission’s standard contractual clauses. [[CONFIRM WITH COUNSEL.]]

11. Changes

If we change this policy we will update the version above and, for material changes, tell the account holder by email before the change takes effect.