Privacy Policy

FlagFans (the website at flagfans.co.uk and the FlagFans iPhone app) is run by Interfulgent Ltd, the controller of your personal data under UK data protection law. Questions, requests and complaints go to hello@flagfans.co.uk.

You can use most of FlagFans without an account. Exploring flags, studying, quizzes and the flag designer work on your device alone. The sections below describe what is collected when you create an account or use the features that need one.

With no account, your progress, saved designs, favourites, theme and blocked-player list stay in your browser or app storage on your device. We do not see them.

When you create an account, we store:

• your email address, used to sign you in and to send the emails you ask for;
• your password, kept only as a one-way hash, so we cannot read it;
• your display name, which appears next to your scores on the leaderboard and on postcards and challenges you send;
• a sign-in token for each device you sign in on, valid for 30 days;
• which newsletters you have chosen to receive (weekly quiz, flag of the week), and a private unsubscribe code that lets the link in each email work without signing in.

We email you a code and a link to finish setting up your account; if neither is used, what you entered at sign-up is deleted after 24 hours.

As you use FlagFans while signed in, we store:

• your progress, synced so it survives a reinstall: flags studied, quiz scores, streaks, globe clicks and flag pages viewed;
• your flag designs, each with its name and its colours, layout and symbol;
• leaderboard entries you submit: display name, score, quiz setup and time. These are public;
• the players you block, so their content stays hidden when you sign in on another device.

If you send a postcard or challenge by email, the recipient's address and your message go to our email provider to be delivered. We keep a log of the recipient address, your account and the time, which enforces a daily sending limit and lets us investigate abuse. The postcard or challenge itself lives in the link, not in our database.

If you turn on notifications in the iPhone app, Apple gives the app a device token. We store it against your account so we can send the notifications you subscribed to.

If you report content, we store the report: what was reported, your chosen reason, your optional note, the time and who reported it. Signed in, that is your account. Signed out, it is a one-way hash of your IP address, used only to limit repeat reports and to count how many different people have reported the same item. A copy of each report also goes to our support inbox, described under If you send us feedback below. Our moderation system, which runs on our own hosting in the UK, holds a record of each report as codes and yes/no answers: the report's number, the kind of item and its code, the reason, whether it came from or is about a child, and whether the item is hidden. It holds no note, no name, no nickname and no email address. When the developer opens a report there, it shows the reported item from FlagFans and keeps no copy of it.

FlagFans has no analytics, no advertising trackers and no location features. The website and the iPhone app do not measure how you use them, do not load advertising, and do not ask for your location.

Parents and carers who add a child profile, and the data held about each child, are described under Children and families below.

Like any web service, our hosting provider's servers record standard request logs, including full IP addresses and the browser's description of itself, to keep the service running and secure. These logs stay in the UK. The server logs are kept for 12 weeks and the network (CDN) logs for 7 days. Our hosting provider sets these periods and we cannot shorten them.

If you send us feedback or report something on FlagFans through the feedback form or the Report menu (a problem, a correction to a flag, a flag you would like added, an idea, a question, or a report about something another player made, such as a leaderboard name, a design, a challenge or a postcard), we collect what you type: your message, the flag or page it is about, the app version and platform if the app sends them, for a report the item you reported and your reason, and, only if you choose to give one, an email address. The server also records a scrambled code derived from your internet address, so that we can limit how much is sent from one place and tell how many different people raised the same thing. Your internet address itself is not stored, and the code cannot be turned back into it.

Your feedback waits on the server that hosts this website until it is copied to the developer's own computer, normally within fifteen minutes, and is then deleted from the server. It is not sent to any other company or service: no helpdesk, no mailing list, no analytics. A report also reaches our moderation system as codes, as described above. An AI model running on that same computer sorts each message into a category and judges whether it is urgent; its text is never sent to an outside AI service. If a message is judged serious (for example a report of hate, harassment or sexual content, or a problem that stops the site or app from loading), the first part of it is sent to the developer's phone as a message through Apple's iMessage. A report from or about a child is handled differently: its alert, by iMessage, by email or as a notification on the developer's own devices, is the one sentence “FlagFans: a new report about a child is waiting.” and carries nothing from the report. A summary of the week's feedback is emailed to the developer each Monday; it shows a report from or about a child without its text.

We use your email address only to reply to what you sent. We delete your email address and the scrambled code 12 months after your message is resolved, or 24 months after it arrived if it is never resolved. The content of a message may be kept after that without anything that identifies you, because it is what FlagFans is improved from. To see, correct or delete what you sent sooner, email hello@flagfans.co.uk and quote the reference the form gave you.

• To provide your account and features (signing in, syncing, leaderboard, designs, postcards, challenges). This is needed to run the service you asked for.
• To send newsletters and notifications you chose. You can withdraw at any time: every email has an unsubscribe link, and you can switch email and notifications off in your Passport.
• To keep FlagFans safe: sending limits, reports, blocking and removing content that breaks our Terms of Use. This is our legitimate interest in running a service that is safe for everyone, including younger players.
• To run a child profile. We do this with the permission of the child's parent or carer, which we ask for and record before the profile starts. The parent or carer can withdraw it at any time.

We do not sell your data, do not show advertising and do not track you across other companies' apps or websites.

• Our database and website are hosted with 20i in the United Kingdom.
• Resend delivers our email: newsletters, postcards and challenges you send, and the emails we send to parents and carers about a child profile (the permission link, the follow-up email and the warnings before a profile is deleted). It receives the recipient address and the message. An email to a parent names the child by nickname or by the private label the parent chose, so the parent knows which profile it is about. We send no email to a child. Resend also delivers the alert to the developer that a report about a child is waiting, which carries nothing from the report. Resend's servers may be outside the UK.
• Apple delivers push notifications through its Apple Push Notification service, using the device token above. Push notifications are for adult and teen accounts that switch them on. Child profiles receive none. Apple also delivers our moderation system's notifications to the developer's own devices; one about a child says only that a new report about a child is waiting.

These providers act on our instructions and handle the data only to do those jobs. Where data leaves the UK, we rely on the safeguards those providers offer under UK data protection law.

• Account data, progress, designs, leaderboard entries, blocked-player list and device tokens are kept until you delete your account, or until the account has not been used for 3 years (see the next point).
• An adult or teen account that nobody has signed in to for 3 years is deleted. A sign-in starts the 3 years again. We email the address on the account 2 months before the deletion and again 1 week before it. To keep the account, sign in. We do not delete the account of an adult who still has child profiles.
• Sign-in tokens for your own account expire after 30 days. A child's sign-ins follow the periods under How long we keep a child's data.
• The email-sending log is deleted with your account.
• An open report is kept for as long as it takes to deal with it. When we close a report, we keep it for 2 more years, to spot repeat problems, and then delete it.
• Device tokens that Apple tells us are no longer valid are removed.
• Child profiles have their own periods, listed under How long we keep a child's data below.

Open Account, choose Delete my account and confirm with your password. This permanently deletes your account, progress, designs, leaderboard entries, sign-in tokens, device tokens, sending log and blocked-player list, and cannot be undone. Reports you made are kept but no longer linked to you. Emails you already sent cannot be recalled.

If you cannot sign in, email hello@flagfans.co.uk from the address on the account and we will delete it for you.

If your account has child profiles, you must delete or withdraw permission for each child profile first. Open Family to do this. Then you can delete your own account.

Under UK data protection law you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. You can change your display name and newsletter choices yourself in the app. For anything else, email hello@flagfans.co.uk. We reply within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk.

FlagFans is for all ages. Exploring, studying, quizzes and the flag designer work without an account and collect nothing about the person using them.

A child under 13 cannot create an account. A parent or carer adds a child profile from their own FlagFans account. People aged 13 or over can create their own account.

A short version of this page for children is at /privacy/kids. Our approach to keeping children safe is at /safeguarding.

A child profile holds:

• a nickname, made from words picked from fixed lists, with a number if needed. It is the only name other people see;
• an age band (under 13). We do not store a date of birth;
• a private label, if the parent or carer chooses to type one, such as a first name. Only the family sees it;
• the link to the parent or carer who set the profile up;
• the child's progress, quiz scores and quiz answers, flag designs and their names, and favourite lists;
• the postcards and quizzes the child has sent or received inside the family;
• a sign-in record for each device the child uses, with a label the parent chose, such as "Kitchen iPad";
• a log of some actions the child takes, such as sending or opening a postcard, with the time. We keep it so that we can check that the service is safe for children.

A child profile has no email address, password, date of birth, photograph or home address.

Our hosting provider's standard request logs, described under What we collect, apply to children as to everyone else.

A child can:

• explore flags, study, play quizzes and design flags;
• keep favourite lists;
• send a postcard to people in their family. A child builds it from fixed phrases chosen from lists. The child does not type a message;
• make a link to a postcard or to one of their flag designs, and give it to someone. The link carries no typed text. A person who opens it sees the child's nickname as the sender. Like any link, it can be passed on to other people;
• play quizzes that someone in their family sent;
• report something that worries them.

A child cannot:

• type a message to anyone, or use chat;
• send or receive email;
• have a public profile;
• see text typed by people outside their family;
• sign up for newsletters or receive push notifications.

Postcards and quizzes a child sends in the app reach the child's own family. A link reaches the people the child gives it to. Flag designs and favourite lists are seen by the child and the parent or carer, and by anyone the child gives a link to.

A parent or carer can send their child a quiz with a title they type, and a note of up to 140 characters on a quiz or postcard. This is the only typed text from an adult that reaches a child. It passes our content filter first.

A child's scores appear on the public leaderboard only if the parent or carer switches that on. The leaderboard shows the nickname, never a real name or the private label.

How we ask for permission. When you add a child, you tell us that you are the child's parent or carer and that you give permission. We email a confirmation link to your address. The child profile starts only after you follow that link. The link works for 7 days. About 24 hours after you confirm, we send a second email that says the profile exists and explains how to withdraw permission.

What we record. We record the address the email went to, the time it was sent and confirmed, the date of the version of this policy you agreed to, and the time of any withdrawal.

What you can do. On the family dashboard you can, for each child:

• see what the child has made and their settings;
• change the nickname and the private label, and switch the public leaderboard on or off;
• download everything we hold about the child as one file. This includes the record of permission and the log of actions;
• see the devices the child is signed in on and remove any of them;
• see the links the child has made, which work for 30 days, and delete any of them;
• withdraw permission. The profile stops working at once. You can restore it within 30 days. We email you 7 days before the 30 days end, with the date of the deletion. After 30 days we delete it;
• delete the child profile. You confirm with your password. This deletes everything the child made and cannot be undone.

You can also email hello@flagfans.co.uk about any child profile. Your other rights, described under Your rights, apply to your child's data.

What we keep after a deletion. When a child profile is deleted, we keep two records. One is the record of permission described above, which includes the parent's email address. The other is a log entry that names the profile by its internal number and gives the reason for the deletion. Neither holds the child's nickname, label or anything the child made. We keep them so that we can show that permission was given and what happened to the profile. We delete the log entry 1 year after the deletion. We delete the record of permission 6 years after the deletion, because 6 years is the time within which a legal claim can be made in the UK. Reports a child made are kept without any link to the child.

• A child profile that nobody has signed in to for 3 years is deleted. A sign-in to the child profile starts the 3 years again. A sign-in to the parent's account does not. We email the parent or carer 2 months before the deletion and again 1 week before it.
• A link that a child makes to a postcard or a flag design stops working 30 days after the child made it, and we then delete it. The parent or carer can see a child's links on the family dashboard and delete any of them sooner.
• A child profile that the parent or carer has not confirmed within 7 days is deleted.
• A child profile whose permission was withdrawn is deleted 30 days later, unless the parent or carer restores it before then. We email the parent or carer 7 days before the deletion, with the date of the deletion and how to restore the profile.
• A code that pairs a child's device works for 10 minutes. Used and expired codes are deleted by an hourly clean-up.
• A child's sign-in on a paired device lasts 180 days and starts again each time the device is used. A sign-in made by switching profile on a parent's device ends after 30 minutes without use.
• After a child profile is deleted, the log entry about the deletion is deleted 1 year later, and the record of permission 6 years later.

If we change what we collect or why, we will update this page and its date. For a material change we will also tell account holders in the app or by email before it takes effect.

Interfulgent Ltd
167-169 Great Portland Street, 5th Floor, London W1W 5PF
hello@flagfans.co.uk