Privacy Policy

1. Who controls your data

MYFLAG.LOL is operated from India by MishtiLabs (the data fiduciary for this Game). Contact: myflaglol@gmail.com.

This policy is meant to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and rules, as applicable. It is not legal advice.

2. Data we process

Account: username, password hash, optional display name, empire name, website URL, avatar, flag colour.

Play: territories claimed, gifts, wallet ledger, device-ish identifiers used for rate limits (hashed IP).

Payments: we receive confirmation, amount, and provider references from Razorpay, Stripe, or PayPal. Card numbers, UPI PINs, and bank passwords stay with those providers.

Usage: map interactions, approximate location only if you allow the browser geolocation permission (for local weather), and standard server logs.

We do not ask for Aadhaar, PAN, or government ID as a condition of play.

3. Purpose and legal basis

We process data to create your account, run the Game, take payment, prevent fraud and abuse, comply with law, and improve the product. Where consent is required (including this notice and marketing we do not currently send), we ask for it. You may withdraw consent by closing the account and emailing us, without affecting processing already done or required by law.

4. Processors and transfers

Hosting and database may be provided by Vercel and Neon. Payments: Razorpay, and if configured Stripe and PayPal. File uploads may use Vercel Blob. Map and weather use third-party public APIs.

Some processors are outside India. We transfer data only as needed to provide the Game and with contractual / provider safeguards those vendors publish.

5. Retention

Account and play data last as long as the account is open and for a reasonable period afterward for disputes, tax, and fraud prevention. Payment records may be kept as required by tax and payment-partner rules.

6. Your rights

Subject to the DPDP Act, you may request access, correction, erasure, or nomination, and you may withdraw consent. Email the contact address. We may need to verify it is you. We may decline requests the law allows us to decline (for example, legally required records).

You may complain to the Data Protection Board of India after contacting us.

7. Cookies and local storage

We use an HTTP-only session cookie to keep you signed in, and local storage to remember that you accepted these legal documents. Payment checkout from Razorpay, Stripe, or PayPal may set their own cookies.

8. Children

The Game is 18+ for accounts and payments. If you believe a child has created an account, email us and we will delete it.

9. Security

Passwords are hashed. Transport is HTTPS in production. No method is perfectly secure; do not reuse passwords from other sites.