Privacy Policy

Last updated 5 November 2026. This policy covers flag-maker.org and describes how the flag maker works today.

Short version

• No account, no sign-up, no ads, and the site sets no cookies of its own.
• Your flag, its colours, its text and any picture you upload are drawn in your browser and never sent to us.
• We count visits and button use with our own analytics under a random ID. It never includes your design or the words on it. You can turn it off on this page, and browsers that send Global Privacy Control are never counted.
• A feedback message is stored only if you write one and press send.
• We don’t sell or share personal information, and we don’t use it for advertising.

Who we are

Flag Maker at flag-maker.org is run by an individual developer, not a company (“we”, “us”). We decide what the site collects and why, so we are responsible for that data. To contact us about privacy, including any of the requests under “Your rights”, use the Give feedback button next to the downloads or on the contact page. There is no public email address.

What we collect at a glance

Designing a flag

The flag maker draws every flag in your browser. The layout, colours, emblems, text, ratio and the files you download (SVG, PNG and the Hearts of Iron IV zip) are made on your device. None of it is sent to our server, to our analytics or to anyone else.

Your latest design is kept in this browser’s local storage (key flag-maker:design) so that it is still there after a reload or when you come back another day. Local storage stays on your device, is never sent over the network and is only readable by pages on flag-maker.org. Clearing this site’s data in your browser deletes it.

When you press Copy link, the design is written into the link after the # sign. Browsers don’t send that part of an address to a server when someone opens the link; it is only read by the page in their browser. Anyone you give the link to can see the design, including any text on the flag. When a shared link opens, the page loads the design and removes it from the address bar. If you already had a flag of your own, it is kept in local storage (key flag-maker:before-share) so the “Bring back my previous flag” button can restore it; the copy is removed when you use that button, or the next time you open the page after editing the shared flag. Downloads are created in your browser and saved by your browser’s own download feature.

Pictures you upload

Upload picture reads the file you choose inside your browser and turns it into part of the flag. The picture is not uploaded to us or to any other service, despite the button’s name. It is kept in local storage with the rest of the design (if it fits; very large pictures may be left out of the saved copy) and embedded in the SVG and PNG files you download. Pictures are never put into share links.

Feedback you send

The Give feedback button opens a short form. Nothing is sent while you type. Only if you press send, we store:

• the message you wrote, exactly as you wrote it;
• this website’s domain (flag-maker.org);
• the address of the page you were on, without any query string or # part (so your design is not included);
• the time it arrived.

That is the message, the domain and the page path, nothing more. The form doesn’t ask for your name or email. If you want a reply, include a way to reach you in the message; we will use it only to answer you. If you want us to see a flag, paste its share link into the message. To limit spam, the service keeps a one-way-hashed form of your network address for a short time so that no network can send more than 10 messages an hour. The hash can’t be turned back into your address. Please don’t include passwords, payment details or other private information in a message.

Analytics

We run our own first-party analytics to learn which features people use and where the flag maker fails. It is not Google Analytics and it is not shared with any advertising network. Each event contains:

• the event type: a page view (the path only, without any query or fragment); time spent on the page and how far you scrolled; a click on a labelled button (for example a layout picture, Undo, Random, Wave it, Add emblem, Upload picture, Download PNG, SVG, HOI4 flag set, Print or Copy link); a successful download, with the PNG width in pixels or the number of HOI4 files; a picture added; a share link copied or opened; Random used; Print pressed; which country flag or layout you opened from the page or the editor, as its short code (for example br for Brazil or nordic); or a failure with a short error code (for example a PNG too large for the browser, a picture over 1.5 MB or unreadable, or copying blocked by the browser);
• the page path, without anything after ? or #;
• a random visitor ID, a random visit ID, a random event ID and the time.

Apart from that starting flag or layout, it does not record your design, its colours, the text on it, the HOI4 country tag, any uploaded picture or file name, the contents of a share link, your name, your email, your IP address or anything else that identifies you. It doesn’t read your browser’s language, your screen size or the page you came from.

The visitor ID is kept in your browser’s local storage and the visit ID in session storage (keys starting with wa_). They are random, are not linked to any account and are not used on other websites. The analytics script is loaded from our Supabase project on every page, so Supabase receives your IP address and browser details when your browser fetches the script or sends an event, as any web server does, even if you have turned analytics off.

Turning analytics off deletes the visitor ID from this browser and stops all events. Your choice is remembered in local storage (key flag-maker:analytics-off), so it applies only to this browser on this device. If you clear this site’s data, the choice is cleared too and you would need to turn it off again.

Cookies and browser storage

The site sets no cookies of its own. When your browser fetches the analytics script, Supabase’s network provider, Cloudflare, may attach a short-lived security cookie (__cf_bm, 30 minutes) that is used only to tell people from bots; many browsers block it as a third-party cookie. Otherwise the site uses your browser’s storage as listed below, and you can clear all of it at any time in your browser’s settings for flag-maker.org.

Hosting and server logs

The servers that deliver these pages receive technical information with every request, such as your IP address, browser type and version, the page requested and the time. They may keep it in short-lived logs for security, abuse prevention and troubleshooting. The site is hosted by Vercel Inc.; see its privacy policy. Fonts are served from our own domain, so no font service sees your visit.

Service providers and transfers

Two service providers process data on our behalf, only for running this site:

• Vercel Inc.: hosting and delivery of the website.
• Supabase, Inc.: the databases that store analytics events and feedback messages, and the server that delivers the analytics script.

These providers may process data in the United States and in other countries where they or their sub-processors operate. Where the law requires it, such transfers rely on the providers’ standard contractual safeguards.

Why we may use the data

If you are in the European Economic Area or the United Kingdom, the legal bases we rely on are:

• Legitimate interests for analytics, server logs and the feedback limit: understanding how the site is used, fixing faults and keeping it safe from abuse. We keep this light by never recording your design and by honouring opt-out and Global Privacy Control.
• Your choice to contact us for feedback: we store a message only because you decided to send it, and we use it to read and answer it.

Your designs in your browser never reach us, so we don’t process them. You can object to analytics at any time by turning it off above.

Sharing and selling

We don’t sell personal information, rent it or share it for targeted advertising, and we don’t combine it with data from other sources. Apart from the service providers above, we would disclose information only if the law required it, to protect the site or its users from fraud or abuse, or as part of a transfer of the site to a new owner, who would stay bound by this policy for data collected under it.

How long data is kept

• Your saved design: in your browser until you clear this site’s data; it is replaced each time you edit.
• Shared links: as long as the link exists wherever you put it; we never receive a copy.
• The analytics visitor ID and your opt-out choice: in your browser until you clear this site’s data.
• Analytics events: only as long as they help us improve the site, reviewed for deletion at least once a year. We may keep totals with no IDs in them (such as downloads per day) for longer.
• Feedback messages: until they have been dealt with, and reviewed for deletion at least once a year.
• The hashed network address for the feedback limit: only for the rate-limit window.
• Hosting and provider logs: according to each provider’s retention period.

Security

The site is served only over HTTPS. Analytics events and feedback are written through narrow interfaces that accept new records but don’t let a visitor read anyone else’s data, and access to the stored data is limited to the people who run the site. Share links are decoded and checked before a design is drawn, and text on a flag is escaped, so a crafted link can’t run code on the page. Because we keep so little, there is little to lose, but no system is perfectly secure.

Your rights

Depending on where you live, for example under the GDPR, the UK GDPR or US state privacy laws, you may have the right to ask whether we hold information about you, to get a copy of it, to have it corrected or deleted, to restrict or object to how we use it, and to withdraw a choice you made. You won’t be treated differently for using these rights.

To make a request, use the feedback form and say what you want. Because we don’t collect names or accounts, we can usually only find a feedback message if you tell us roughly what it said and when you sent it, and we can only find analytics events if you give us the visitor ID from your browser’s storage (the wa_ key). Turning analytics off is the quickest way to stop further collection. We will answer within one month. If you are in the EEA or the UK, you can also complain to your local data protection authority.

US state privacy laws

In the past 12 months we have collected, as described above, internet activity on this site (analytics events and server logs) and the content of feedback messages people chose to send. We have not sold personal information or shared it for cross-context behavioural advertising, and we don’t use or disclose sensitive personal information. Residents of California and other states with similar laws can make the requests described under “Your rights”.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, the analytics script doesn’t record anything, and there is no setting to change. There is no common standard for responding to the older Do Not Track signal. We don’t track you across other sites, so there is nothing for it to switch off, and you can still turn analytics off above.

Children

The flag maker is a general-audience design tool. Students may use it for school projects, but it is not directed at children, there are no accounts, and we don’t knowingly collect personal information from children under 13 (or under 16 in the EEA and the UK). Designs stay in the browser. If you believe a child has sent us personal information in a feedback message, tell us and we will delete it. Schools that prefer no analytics can turn it off on each device above, or use browsers that send Global Privacy Control.

Links to other sites

The sources on the home page link to pages on other websites, and this page links to our hosting provider’s policy. Nothing is loaded from those sites until you click, and their own privacy policies apply once you are there.

Changes to this policy

We will update this page, and the date at the top, whenever the way the site handles data changes. If a change means collecting something new, we will describe it here before it starts.