Privacy Policy

Last updated: [DATE]

This page explains what personal data the Flag It website stores, why, on what legal basis and for how long, and what rights you have. Processing is governed by the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

Before publishing: replace every […] placeholder with the real value (operator name, postal address, date, retention period, competent supervisory authority).

1. Controller

Responsible for the processing described here (Art. 4(7) GDPR):

[Full name]
[Street and number]
[Postcode and city], Germany
Email: cs2flagit@gmail.com

This is a private, non-commercial project. A data protection officer is not required and has not been appointed.

2. What we store, why and for how long

Data you provide

When you submit a flag you give us an email address and an image file (including its file name).

Purpose: to create the requested assets and send them to you, to contact you about your request, and to check the image is not unlawful or infringing before it is used.
Legal basis: Art. 6(1)(b) GDPR (providing the free service you asked for); the check of the image is based on Art. 6(1)(f) GDPR (legitimate interest in not publishing unlawful content).
Retention: your email address is deleted once your assets have been delivered, and after 30 days at the latest. The image, its file name and the submission date are kept without your email address for up to [e.g. 12 months] so your assets can be re-created if there is a problem (Art. 6(1)(f) GDPR); after that, or earlier on request, they are deleted.

Technical data

When you use the form we also process the time of the request, basic technical details of the image (such as its dimensions) and a one-way hash of your email address.

Purpose: preventing spam and abuse – the email hash enforces a daily limit on the number of submissions per email address. The hash cannot be turned back into your address.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a service protected against abuse).
Retention: the email-hash counter expires automatically within a few days. The finished download file is available for 3 days and is then deleted automatically.

Your IP address is only passed to the bot check (section 3) and recorded in the hosting provider's server logs (below). This website does not store it beyond that.

Server log data

Our hosting provider (see section 4) automatically records technical access data (e.g. IP address, time, requested page, browser type) to deliver the site and defend against attacks. Legal basis: Art. 6(1)(f) GDPR. It is kept only as long as needed for these purposes, under the provider's own retention rules.

3. Bot protection (Cloudflare Turnstile)

The form uses Cloudflare Turnstile instead of a tracking CAPTCHA. When the form loads, Turnstile processes your IP address and some non-identifying browser and device signals to tell humans apart from bots. It does not use tracking cookies or build user profiles. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form from automated abuse). See Cloudflare's privacy policy.

4. Recipients

We do not sell your data or use it for advertising. It is only processed on our behalf by the following providers (Art. 28 GDPR), and otherwise only where required by law:

Cloudflare, Inc. – website hosting, storage of your submission and the download file, and bot protection.
Google Ireland Ltd. / Google LLC – sending the email with your download link.

The web fonts on this site are served from this domain; no data is sent to a third-party font provider.

5. Cookies

This website sets no cookies of its own and uses no analytics or tracking. Cloudflare Turnstile may briefly store a technical token in your browser that is strictly necessary for the bot check; it is not used for tracking.

6. International data transfers

Cloudflare and Google may process data on servers outside the EU, including in the USA. These transfers are covered by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have inaccurate data corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). You may also withdraw any consent with effect for the future.

To exercise these rights, email cs2flagit@gmail.com. A download file that has already been sent to you cannot be recalled but expires on its own after 3 days.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for the controller is [the data protection authority of the controller’s federal state].

9. Automated decision-making

There is no automated decision-making that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR.

10. Children

This service is not directed at children. If you are under 16, please do not submit personal data without the consent of a parent or guardian.

11. Changes to this policy

We may update this policy if the service or the processing changes. The date at the top shows the current version.

Legal notice (Impressum)

[Full name]
[Street and number]
[Postcode and city], Germany
Email: cs2flagit@gmail.com

Private, non-commercial project. Not affiliated with, endorsed by or connected to Paradox Interactive or Colossal Order.