Privacy Policy

Last updated: 17 September 2026

This page explains what personal data the Flag It website stores, why, on what legal basis and for how long, and what rights you have. Processing is governed by the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Controller

Responsible for the processing described here (Art. 4(7) GDPR):

(loading…)
Email: cities.flagit@gmail.com

This is a private, non-commercial project. A data protection officer is not required and has not been appointed.

2. What I store, why and for how long

Data you provide

When you submit a flag you give me an email address and an image file (including its file name).

• Purpose: to create the requested assets and send them to you, to contact you about your request, and to check the image is not unlawful or infringing before it is used.
• Legal basis: Art. 6(1)(b) GDPR (providing the free service you asked for); the check of the image is based on Art. 6(1)(f) GDPR (legitimate interest in not publishing unlawful content).
• Retention: your email address is deleted once your assets have been delivered, and after 30 days at the latest. The image, its file name and the submission date are kept without your email address for as long as Flag It keeps supporting these assets, so they can be re-created if there is a problem (Art. 6(1)(f) GDPR). Once separated from your email address this material no longer identifies you; it is deleted earlier if you ask.

Technical data

When you use the form I also process the time of the request, basic technical details of the image (such as its dimensions) and a one-way hash of your email address.

• Purpose: preventing spam and abuse – the email hash enforces a limit of 2 submissions per email address per 24 hours. The hash cannot be turned back into your address.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a service protected against abuse).
• Retention: the email-hash counter expires automatically within a few days. The finished download file is deleted about an hour after your first download, and after at most 3 days in any case.

Your IP address is passed to the bot check (section 3) and recorded in the hosting provider's server logs (below). This website does not store it beyond that.

Server log data

My hosting provider (see section 4) automatically records technical access data (e.g. IP address, time, requested page, browser type) to deliver the site and defend against attacks. Legal basis: Art. 6(1)(f) GDPR. It is kept only as long as needed for these purposes, under the provider's own retention rules.

3. Bot protection (Cloudflare Turnstile + honeypot field)

The form uses Cloudflare Turnstile instead of a tracking CAPTCHA. When the form loads, Turnstile processes your IP address and some non-identifying browser and device signals to tell humans apart from bots. It does not use tracking cookies or build user profiles. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form from automated abuse). See Cloudflare's privacy policy.

The form also contains a hidden field that is invisible to human visitors and left empty by them; automated submissions that skip Turnstile entirely and fill in every field are rejected as spam this way too. This second check runs entirely within this website's own code and involves no third party.

4. Recipients

I do not sell your data or use it for advertising. It is only processed on my behalf by the following providers (Art. 28 GDPR), and otherwise only where required by law:

• Cloudflare, Inc. – website hosting, storage of your submission and the download file, and bot protection.
• Google Ireland Ltd. / Google LLC – sending the email with your download link.
• Microsoft Ireland Operations Ltd. / Microsoft Corporation – translating the flag's name (taken from your image's file name) into the languages the in-game asset supports, via the Azure AI Translator service (processed in Microsoft's Germany West Central datacenter).

The web fonts on this site are served from this domain; no data is sent to a third-party font provider. The only third-party script loaded is Cloudflare Turnstile (see section 3).

The footer contains plain links to external sites (Ko-fi, Paradox Mods, Reddit). Nothing is sent to them until you click a link, which opens the site in a new tab under that site's own privacy policy.

5. Cookies and counting

This website sets no cookies of its own, uses no analytics service and builds no user profiles.

It does keep a few anonymous total counters – for example how often a page is opened, or how often a particular outbound link (Paradox Mods, Ko-fi, …) is clicked. These are plain running numbers with nothing personal attached: no IP address, no cookie, no identifier and no timestamp are stored with them, and they cannot be linked back to you or to a visit. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing roughly how the site is used).

6. International data transfers

Cloudflare and Google may process data on servers outside the EU, including in the USA. These transfers are covered by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have inaccurate data corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). You may also withdraw any consent with effect for the future.

To exercise these rights, email cities.flagit@gmail.com. A download file that has already been sent to you cannot be recalled but deletes itself about an hour after your first download, and after 3 days at the latest.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz.

9. Automated decision-making

There is no automated decision-making that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR.

10. Children

This service is not directed at children. If you are under 16, please do not submit personal data without the consent of a parent or guardian.

11. Changes to this policy

I may update this policy if the service or the processing changes. The date at the top shows the current version.

Legal notice (Impressum)

(loading…)
Email: cities.flagit@gmail.com

Private, non-commercial project. Not affiliated with, endorsed by or connected to Paradox Interactive, Colossal Order or Iceflake Studios.