Privacy Policy

Version 2026-09-15 · Effective [[LAUNCH DATE]]

0. Playing without an account

Baagchaal, Call Break and Chatur can be played without signing in. When you play one of these:

• We do not ask for, or collect, any personal information, no name, no email address, no age.
• There is no account, so there is nothing for us to store about you.
• The game runs entirely in your browser. It makes no requests back to us while you play, and sends nothing anywhere.
• Your progress and preferences are saved in your browser’s local storage. That stays on your own device, never reaches us, and disappears when you clear your browser data.
• We count how many games you have played today, so we know when to offer you an account. That count is kept in your browser only. It is never sent to us, and we cannot tell one visitor from another.

Our servers still record the standard request logs described in section 2, as any web server does. Everything else in this policy applies only if you choose to create an account.

1. Who we are

xflag (“we”, “us”) operates xflag.ai and its games and applications. The data controller is [[LEGAL NAME / ENTITY]], [[ADDRESS]]. Contact us any time at hello@xflag.ai.

2. What we collect

What we deliberately do not collect

• No passwords. You sign in either with Google or with a one time code emailed to you. We never receive, store, or are able to see a password, because you never give us one. There is nothing here for anybody to steal or reuse. If you use Google, Google tells us your email address and nothing more, and we never see your Google password.
• Nothing about children. Accounts are for adults only, and a child cannot create one. We do not ask any player for their age or date of birth at any point.
• No advertising or cross site tracking. There are no ad networks, no advertising identifiers, and no third party tracking pixels on this service.

3. Children’s privacy

Parts of xflag are designed for children. We have built the service so that we collect as little information about a child as we practically can.

• The games that need no account collect nothing. A child can play Baagchaal, Call Break or Chatur without us learning anything about them at all. This is the most privacy-protective option we can offer, and it is why those games are open.
• An adult holds the account. Only a person aged 18 or over may create an xflag account and agree to these terms.
• Children do not have accounts. An xflag account is for adults, 18 or over. There is no child account and no child profile of any kind.
• We ask for a nickname, not a name. The profile creation screen asks you to use a nickname rather than a child’s full real name.
• No advertising, and no profiling for advertising. We do not show ads, we do not build advertising profiles, and we do not share anything about a profile with advertisers. We do record how a signed in profile plays, so we can show progress and one day offer coaching. Section 3a explains exactly what that means.
• Your control. You can see everything saved on your account from the account area, and delete it there or by emailing us. Closing your account deletes it all.
• Age labels. The age shown on an activity is guidance for whoever is choosing it. We do not enforce it, because we never ask anybody their age and so have nothing to check it against.

We aim to operate consistently with the U.S. Children’s Online Privacy Protection Act (COPPA) and, where it applies, the UK Age Appropriate Design Code. [[CONFIRM WITH COUNSEL BEFORE PUBLIC LAUNCH.]] If you believe a child has provided us with personal information beyond a nickname and year of birth, email hello@xflag.ai and we will delete it.

3a. Game scores and play style

When you play while signed in, we save a record of the finished game. We want to be specific about it, because it is the only place where we keep information about how somebody behaves rather than just who they are.

What we save, per finished game:

• Which game it was, when it started and when it ended.
• The result, for example won, lost or drawn, and the score.
• A short summary of how the game was played. For a board game that is things like the difficulty chosen, the side played, and how long moves took. It is about the game, never about the person.

Why: so a player can see their own history and progress, and so that we can later offer coaching that points out habits worth working on. That is the purpose. We are telling you now because we would rather say it up front than add it quietly later.

What we will not do with it: we will not sell it, we will not use it for advertising, and we will not use it to make decisions about anyone outside the game itself.

Automated analysis, and who does it. When you ask for feedback on a game, we send your records for that one game to Anthropic, whose Claude model writes the feedback you see. We send the game records and nothing else: not your email address, not your name, not your account id, and nothing about any other game. Under our commercial terms with Anthropic that data is not used to train their models.

We do this only to help you play better. If we ever want to use this data for anything else, or to send it to a different company, we will say so here first. Feedback is generated only when you ask for it, and you never have to.

Your control. You can see what has been saved on your account page, and you can ask us to delete it. Closing your account deletes it. Playing signed out saves nothing at all, and that option is always there.

4. Cookies

We use strictly necessary cookies only. There is no advertising or analytics cookie on this service today.

• __Secure-xf_sess , keeps you signed in and records which profile is selected. It expires after 7 days. Without it the service cannot work.
• Clerk sets its own session cookies on sign-in for the same purpose.

Some games also save your progress in your browser’s local storage, so that a half-finished puzzle is still there when you come back. That information stays on your own device, is never sent to us, and is cleared when you clear your browser data.

If we later add analytics, we will update this policy and ask for your consent first where the law requires it.

5. Why we are allowed to process this data

Where the UK or EU GDPR applies, our lawful bases are:

• Performance of a contract , running your account and delivering the games you asked for.
• Legitimate interests , keeping the service secure and preventing abuse, balanced against your rights.
• Consent , for anything optional, which you may withdraw at any time.

6. Who we share it with

We do not sell personal information. We share it only with:

• Service providers who process data on our instructions: Clerk (authentication), Cloudflare (hosting, database, CDN), and Anthropic (the AI that writes your coaching feedback). We send Anthropic only the game records described in section 3a, and never your email address or anything else that identifies you. Under our commercial terms with them, that data is not used to train their models.
• Legal requirements , where we are obliged to disclose by law, or to protect someone’s safety.
• Business transfers , if xflag is involved in a merger, acquisition, financing or sale of assets, user information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will give you notice before your information becomes subject to a materially different one.

7. How long we keep it

• Account and profile data: for as long as your account is open, and deleted within 30 days of you closing it.
• Game scores and play style: kept while your account is open, so progress over time is visible. Deleted with the account, or sooner if you ask.
• Server logs: a short period for security and diagnostics, then discarded.
• Records of your agreement to these terms: kept while the account is open and for a reasonable period afterwards, because we may need to show what was agreed and when.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict how we use it, and to complain to a data protection authority. Californian residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal information for cross-context behavioural advertising.

To exercise any of these, email hello@xflag.ai. We will respond within the time the law allows. We will not treat you differently for asking.

9. Security

All traffic is encrypted in transit. Session cookies are signed, marked HttpOnly and Secure, and cannot be read by scripts in your browser. We hold no passwords to lose. No system is perfectly secure, but we take the protection of a service used by children seriously, and we will tell affected users promptly if a breach occurs that is likely to put them at risk.

10. International transfers

Our providers operate globally, so your information may be processed outside your country. Where required, transfers are covered by appropriate safeguards such as the European Commission’s standard contractual clauses. [[CONFIRM WITH COUNSEL.]]

11. Changes

If we change this policy we will update the version above and, for material changes, tell the account holder by email before the change takes effect.