Privacy Policy

01The short version

The rest of this page is the detail: exactly what is stored, where it goes, how long we keep it, and how to get it back or get it deleted.

02Who we are

FlexGames is an independent game studio operated by an individual based in Jordan, and is the data controller for everything described here. We run three sites: flexgames.win, galaxy.flexgames.win (Galaxy Dominion) and pixelwars.flexgames.win (Pixel Wars).

For anything on this page — a question, a copy of your data, a deletion request or a complaint — write to privacy@flexgames.win.

03What this covers

This policy is a house rule: it applies to every FlexGames title, including any we launch after the date at the top of this page. Where a specific game handles something differently, the difference is called out by name below.

It does not cover anything you reach by leaving our sites. Pixel Wars lets players attach links to their blocks, and those destinations are other people's websites running their own rules.

04What we collect

Your account

Both games ask for the same three things to create an account: a display name (your nickname or Sovereign name), an email address, and a password. Passwords are never stored — we keep only a bcrypt hash, which cannot be reversed back into your password. Pixel Wars additionally stores an optional avatar image and a profile colour if you set them.

What you do in the world

This is the game state itself, and it is the bulk of what we hold:

• Galaxy Dominion — your Dominion score, your planet's appearance and orbit, the cosmetics you have unlocked, your Arena runs and best scores, and a ledger of every Dominion change (earned, spent or bought).
• Pixel Wars — the blocks you own, their coordinates and value, the price history of every purchase and conquest, your wallet balance, and a ledger of every credit and debit.

Content you publish

In Pixel Wars you can attach an image, a message, a link or a voice note to a block you own. You are publishing that to a public canvas, and we store it so we can serve it. Images and audio are uploaded to Cloudinary (see third parties); the message and link are stored in our own database. We may remove content that breaks the rules or the law.

Payments

Both games take payment through Ziina, a licensed payment provider in the UAE. You are redirected to Ziina's own hosted page to pay. Card numbers never reach our servers and we never see them. What we keep is the record of the transaction: the amount, the currency, what it bought, its status, and Ziina's reference for it.

Technical data

• Server logs. Our web server records each request with your IP address, the time, the page requested, your browser's user-agent string and the referring page. This is standard web-server logging and it is how we investigate faults and abuse.
• Sign-in records. Galaxy Dominion stores the IP address and browser user-agent attached to each active session, and keeps a short-lived record of registration and sign-in attempts by IP so that automated attacks can be throttled.
• Rate-limit counters. Both games count recent requests per IP address in Redis to stop abuse. These counters expire on their own within minutes.
• View counters. Pixel Wars counts how many times the canvas and individual blocks have been viewed. These are plain totals — we do not record who viewed what.

05What is public by design

This is deliberate. In Galaxy Dominion your planet's size is drawn directly from your Dominion score, so the leaderboard is literally the map. In Pixel Wars the whole point is that everyone can see who holds which pixels. Playing means accepting that this is on show.

Your email address is never public. It is not shown to other players, is not included in any API response, and is not broadcast in the live updates that stream to everyone watching the canvas.

Choose a display name you are happy to have seen. If you pick your real name, your real name is what the world sees.

06What we never collect

Stated plainly, because most sites cannot say this:

• No analytics. No Google Analytics, no Plausible, no PostHog, no product analytics of any kind, on any of our sites.
• No advertising or tracking cookies, no advertising pixels, no remarketing tags, no cross-site tracking, no fingerprinting.
• No selling or renting your data to anyone, for any purpose, ever. No sharing it with data brokers or advertisers.
• No marketing email. We do not currently send email at all — not newsletters, not product announcements. If that changes, it will be opt-in and this page will be updated first.
• No card details, no bank details, no government ID. Ziina handles payment; we only ever see its result.
• No location tracking beyond whatever coarse region an IP address implies, and no access to your camera, microphone or contacts. A Pixel Wars voice note is a file you choose to upload, nothing more.

07Why we hold it

08Cookies & local storage

We set no advertising cookies and no third-party cookies. There is no cookie banner because there is nothing to consent to beyond what is strictly necessary to sign you in — the complete list is below.

The landing page at flexgames.win sets nothing at all. You can clear or block any of this in your browser; blocking the two session cookies will simply mean you cannot stay signed in.

09Third parties

These are every outside service our sites touch. There are no others.

10Embedded games on the home page

Worth knowing, because it is not obvious: the two game previews on flexgames.win are not videos. They are the real games, embedded live in the page. Opening our home page on a desktop browser therefore loads galaxy.flexgames.win and pixelwars.flexgames.win, and those servers log the request the same way they would if you had visited them directly. If you are already signed in to a game, its session cookie applies inside that frame.

The previews cannot be clicked into — they are covered by a shield that turns the whole frame into a plain link — and they are not loaded at all on phones, on connections in data-saver mode, or when your browser asks for reduced motion.

11How long we keep it

• Account and game state — for as long as your account exists. These are persistent worlds; your territory and rank are meant to outlast your session.
• Payment records — kept after account deletion, for as long as tax and accounting rules require. We keep the amount, date and reference; they are not used for anything else.
• Server logs — rotated and deleted on our host's normal schedule, a matter of weeks.
• Sign-in attempt records — kept only long enough to throttle attacks, measured in hours.
• Rate-limit counters — expire by themselves within minutes.
• Expired sessions — removed once past their expiry date.

12Your rights

Wherever you live, we will honour all of the following. If you are in the UK, the EU, or a place with comparable law such as California, these are rights you already hold; we are choosing not to make them depend on where you happen to be.

• Access — ask for a copy of everything we hold about you.
• Correction — have anything inaccurate fixed.
• Deletion — have your account and personal data erased, subject to the payment-record exception above.
• Portability — get your data in a machine-readable file.
• Objection and restriction — object to processing we do on the basis of legitimate interest.
• Complaint — complain to your local data protection authority. We would rather you came to us first, but it is your call.

Email privacy@flexgames.win from the address on your account. We aim to reply within 30 days, and we will not charge you or make you justify the request.

13Deleting your account

There is no self-service delete button yet. Email privacy@flexgames.win from your account's email address and we will do it by hand.

Be clear on what deletion means in a persistent world, because some of it cannot be undone:

• Your account, email address and password hash are erased.
• Your Sovereign and its Dominion score are removed from Aurelia, and your planet leaves the map.
• Your Pixel Wars blocks are deactivated and the content on them is removed. The pixels themselves return to the canvas for others to claim — we cannot take a million-pixel shared canvas back to how it looked before you played.
• Any remaining wallet balance or Dominion is forfeited. It is game currency, not stored cash, and it is not refundable.
• Records of past transactions are kept as described above, reduced to the financial facts.
• Historical price records that mention a block may survive without naming you.

14Children

FlexGames titles are not for under-13s, and we do not knowingly collect anything from a child under 13. If you are under 18, you may play, but you must have a parent's or guardian's permission before you spend any money — that means Dominion tribute in Galaxy Dominion and any pixel purchase in Pixel Wars.

If you believe a child under 13 has created an account, write to privacy@flexgames.win and we will delete it and everything attached to it.

15Security

Every site is served over HTTPS. Passwords are stored as bcrypt hashes, never in a readable form. Session cookies are HTTP-only, so a script on the page cannot read them, and they expire rather than lasting forever. Sign-in, registration, upload and checkout endpoints are all rate-limited, and repeated failed sign-ins lock an account temporarily. Payments are verified with Ziina on our server before anything is credited, so a forged return from the payment page buys nothing.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal data, we will tell you and the relevant authority without undue delay, and we will tell you what actually happened.

16Where your data lives

Our servers and databases are hosted in Europe. FlexGames is operated from Jordan, so your data is accessed from there. Ziina processes payments in the UAE, and Cloudinary and Google Fonts operate globally. If you are in the UK or EU, this means your data may be transferred outside your region; we rely on the safeguards those providers offer for such transfers.

17Changes

When this policy changes, the "last updated" date at the top changes with it. If a change is significant — a new third party, a new category of data, anything that would reasonably change your mind about playing — we will announce it in the games rather than quietly editing the page and hoping you do not notice.

18Contact

Privacy questions, data requests and complaints: privacy@flexgames.win.

We would rather answer a question than have you guess. If something on this page is unclear or looks wrong, tell us and we will fix the page.