Privacy Policy

Information We Collect

We may collect account information such as email address, display name, username, profile image, authentication provider, account creation date, login timestamps, subscription status, account role, and preferences.

If you sign in using Google, Facebook, or another login provider, we may receive basic account information from that provider, such as your name, email address, profile ID, and profile image.

Learning and Usage Information

We collect quiz activity, answers, correct and incorrect responses, scores, streaks, progress, leaderboard entries, practice settings, premium feature usage, and related interaction data.

We use this information to provide the learning experience, track progress, calculate scores, maintain leaderboards, improve the Service, detect abuse, and develop new features.

Cookies and Similar Technologies

We use a small number of our own cookies to operate the Service. These include the cookies that keep you signed in, a cookie that links your browser to its free preview allowance so that the sign-in limit can be applied, and one cookie that supports product analytics. We do not use advertising cookies and we do not fingerprint your device.

We also use Google Analytics 4, a measurement service provided by Google. It loads on every page, sets its own cookies in your browser, records page views and basic device information, and sends them to Google, which processes that information under its own privacy policy. You can stop it through your browser settings or with Google’s opt-out browser add-on.

Our analytics cookie is named ft_aid. It stores a randomly generated identifier, it is not derived from your device, browser, network, or any other fingerprint, and it lasts for up to one year from the last time we set it. We use it to recognize the same browser when it comes back, so that we can measure how the learning experience is performing, where visitors stop, and which features are used. Grouping activity into a single visit is done by the separate session identifier described below.

We do not store your IP address alongside analytics activity. We do read the network address our provider reports for your request and convert it into a shortened cryptographic digest, which we use to limit how much data any one connection can send us in a given minute. That digest is held only in the memory of the server that received the request, it is never written to our analytics records, and it is gone when the server restarts. We may record an approximate country and region that our network provider supplies in request headers, together with the device class, browser family, and operating system family that we read from the browser identification sent with each request.

Our security and account records are separate from analytics, and in those we do record IP addresses. When you request a sign-in link, sign in, or sign up, when an administrator acts on an account, and when a premium access code is redeemed, we store the address the request came from and your browser identification in our authentication, administration, and billing records, so that we can investigate abuse, fraud, and account compromise. If you use the free preview without an account, we store a hashed form of those same two details with the preview record. These entries are kept as part of the security record for as long as we hold it, they are not covered by the analytics time limits described in the next section, and our sign-in and administration logs are kept even after the related account is deleted.

Your browser also tells us, when it first loads a page, the query string the address you arrived on carried, including any campaign tags in it, and the site that linked you here if there was one. It reports your time zone, your language preference, and the size of the browser window, so that reporting can tell a phone from a desktop and one region from another. We use these to understand which pages and referrals bring people to FlagTutor.

FlagTutor also keeps values in your browser’s local storage rather than in a cookie. These stay on your device unless the feature they belong to sends them to us, and they are cleared when you clear site data. They include ft_asid, which holds an analytics session identifier and the time of your last activity and starts a new session after thirty minutes without activity; your quiz setup choices and your keyboard shortcut preference; the challenges you have dismissed; and, if you arrive with a premium access code before signing in, that code until it is redeemed.

You may block or delete cookies through your browser settings. Blocking the analytics cookie does not stop you from using FlagTutor, although signing in and saving progress require the cookies that keep an account session active.

Data Retention

We keep account information for as long as the account exists. The answers you give while signed in are part of your learning record and are kept while the account exists, so that progress, review scheduling, and statistics keep working; they are not covered by the time limits below.

We target these limits for analytics data: general product analytics events for 24 months, and analytics activity that is not linked to an account for 12 months, after which the visitor record and its sessions, events, and answers are deleted. Removal runs automatically as the site is used rather than on a fixed clock, so a record may outlast its target through a quiet spell.

Text typed into a typed-answer question that we cannot match to any country, territory, capital, currency, language, or other catalog entry is kept to a target of 90 days and is then removed, on the same schedule. Typed text that we do match to a catalog entry is part of your answer history and is kept with the learning record described above, on the same basis as the answers themselves. We do not retain unbounded free text, keystrokes, or mouse movement.

When an account is deleted, we remove the typed text stored on its answers and we disconnect the account from its stored activity. The activity records themselves are not deleted at that moment: they remain associated with the random visitor identifier described above, which is not linked to a name, an email address, or an account. Once unlinked they count as activity from a visitor without an account, so they come under the 12-month limit above and are removed on that schedule. You may request privacy assistance, a copy of your information, or account deletion by contacting [email protected].

Payments

Stripe or the applicable payment processor may collect and process payment information according to its own terms and privacy policy. We may store payment metadata needed to manage subscriptions.

Your Choices

You may request privacy assistance or account deletion by contacting [email protected]. We may need to verify your identity before fulfilling a request.