In short. You can play FlowRing without an account. If you create one, it asks only for a nickname and an e-mail: no password, no name, no phone number. The e-mail is used to send you a 6-digit sign-in code and is stored encrypted; with the account we keep nickname, country, scores and progress to sync them across your devices and show you on the leaderboard. We collect anonymous usage statistics on our own servers (you can switch them off in the settings) and, in the web version, we may show an advertising video only when you ask for it to refill your energy. We don’t profile you, and we don’t sell data. The game servers are in the European Union.
Francesco Brizi, Via della Cicoria 4, 06126 Perugia (PG), Italy — e-mail: [email protected] (“we”). FlowRing is the game available at flowring.app, play.flowring.app, the linked domains flowring.it and flowring.cloud and, in the future, in the app stores.
| Data | When | Purpose | Legal basis |
|---|---|---|---|
| Settings, progress, scores and energy, stored on the device | Always | Running the game | Performance of the service (art. 6.1.b GDPR) |
| Nickname, country (inferred from the device language, editable), random player identifier, device access key, progress, scores, duel and event results | Only if you create an account | Syncing progress across devices, global and per-country leaderboards, online duels | Performance of the service (art. 6.1.b) |
| Recording of your moves in a game (the finger’s position over time, with no personal data) | Only if you create an account | Verifying scores: the server plays the game again and computes the result itself; the recording is kept only when the result differs from the one sent by the device, for at most 120 days. In the challenges where everyone gets the same rings (daily, weekly, event), only if you accepted (the question at the first launch of the game; change it anytime in Settings → “My challenge replays”), your best run is also kept as a replay: other players can watch it from the leaderboard, with your nickname, and play next to its “ghost”; it stays 48 hours, then only if it is among the top 100 of that leaderboard, for 45 days. If you say no, the replays already kept are deleted at once | Legitimate interest: honest leaderboards (art. 6.1.f); for replays, your consent (art. 6.1.a), which you can withdraw at any time |
| E-mail address | Only if you create an account or add it to an existing one | Sending you the 6-digit code to confirm the account, sign in from another device or recover it. No newsletter, no advertising: that address only ever sends the codes you ask for. The e-mail is stored encrypted (AES-256) with a key kept outside the database; to recognise it we use a fingerprint (HMAC) that cannot be turned back into the address. Not even the game’s administrator sees it in plain text. | Performance of the service (art. 6.1.b) |
| Devices linked to the account: device and browser type, last sign-in date, country of the connection | Only with an account | Showing you where you are signed in and letting you sign out the other devices | Performance of the service (art. 6.1.b) |
| Vertical position of the square during a duel | Only during a duel | Showing your square to the opponent in real time; not stored | Performance of the service (art. 6.1.b) |
| Anonymous usage statistics: a random installation identifier (generated on the device, not linked to the nickname), platform (browser, installed app, Android), country inferred from the device language and event counters (sessions, levels completed or failed, retries, duels, events, videos watched) | Always, unless switched off with the “Anonymous statistics” toggle in the settings | Understanding how many people play, how far they get and what works, to improve the game | Legitimate interest (art. 6.1.f); the data stays on our servers and is not shared |
| IP address and technical request metadata | On every connection to the server | Security, abuse prevention, network operation | Legitimate interest (art. 6.1.f); kept for at most 30 days |
| Support requests: subject, messages, request number, e-mail address for the reply (encrypted as above), nickname if you have an account, platform, game version and language; if you attach them, screenshots or short videos of the problem (encrypted on the server, visible only to whoever answers you) | Only if you use “Support” in the game or write to us by e-mail | Replying to you, by e-mail and inside the game, and keeping question and answers together | Legitimate interest (art. 6.1.f); attachments are deleted 7 days after the request is closed, closed requests after 12 months |
We do not collect phone numbers, contacts, GPS location, advertising identifiers or data from other apps. The nickname is public on the leaderboard: do not use your real name if you do not want it visible. Sign-in codes last 20 minutes, work once and are never stored in plain text.
The web version uses the browser’s local storage (localStorage) to keep settings, progress and the random statistics identifier, with no tracking cookies and no third-party analytics. The site’s and the game’s typefaces are hosted on our own servers: no request goes to third parties. This site uses only essential cookies and has no tracking tools, which is why it shows a simple information notice without asking for consent.
When your energy runs out, the web version may offer you an advertising video to watch in exchange for 1 energy. The video appears only if you choose it and is never mandatory. Videos are provided by Google (AdSense for HTML5 games); on first use Google shows a consent request: if you refuse, only non-personalised ads or no ads are shown. Google may use cookies and identifiers according to its own privacy policy. During the test phase (beta) videos are not active. The Android app shows no advertising.
The game servers are operated by Akamai Technologies (Linode, LLC) and reside in the European Union. Akamai is a US company acting as our data processor: the data stays on European servers and the relationship is governed by a data processing agreement with the European Union’s standard contractual clauses. The game’s e-mails (sign-in codes, confirmations and the support replies sent from our panel) go out from [email protected] ([email protected] for the test server) through the SMTP2GO delivery service, in its European Union data centre (Amsterdam), which processes the address only to deliver the message. If SMTP2GO does not answer, or when you ask for the code again from the game (“No code received?”), the same message goes out through the backup service Resend, from its servers in Ireland (European Union). Resend (Plus Five Five, Inc.) is a US company: it receives only the address and the text of the message in order to deliver it and keeps the delivery log for 30 days in the United States; the transfer is covered by the EU Standard Contractual Clauses and by the EU-U.S. Data Privacy Framework. The support mailbox, [email protected], which you can write to and where replies to our messages arrive, is hosted by Qboxmail S.r.l. (Italy), with the data in its data centres in Tuscany; Qboxmail too processes the messages only to store and deliver them. In the browser version, requesting a code may go through a Cloudflare anti-bot check (Turnstile), which uses no tracking cookies and does not profile. We do not transfer data outside the European Economic Area for purposes other than those described here, and we do not share it with third parties, except where required by law. The only exception is Google, for the advertising videos you chose to watch, when they are active: in that case Google first asks for your consent with a banner (accept / refuse / manage) and honours your choice.
Account data, e-mail included, is kept as long as the account exists. Accounts inactive for 24 months may be deleted. Technical logs are kept for at most 30 days; the log of code requests (e-mail fingerprint, outcome and date only, never the address) for at most 7 days. Closed support requests are deleted after 12 months; screenshots and videos attached to a request are deleted 7 days after it is closed (the conversation stays), and you can ask support to delete them right away. E-mail change requests (addresses encrypted and masked, never in clear) stay at most 12 months in the account’s record; the nickname history stays as long as the account exists, and a nickname you leave stays reserved for you for 30 days. If you delete your account, your requests and their attachments go with it.
You can delete your account yourself, at once, from the game: Account → Delete account (it removes the account, the cloud save, scores, event skins and support requests; details in Deleting your account). You can also request access, rectification, erasure or portability of your data, or object to processing, at any time by writing to [email protected]. We reply within 30 days. Anonymous statistics can be switched off in the game settings. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali).
FlowRing is not aimed at children under 14 and does not knowingly collect data about them. If you believe a child has created an account, write to us and we will remove it.
If this policy changes substantially we will say so in the game and on this page, updating the date at the top.