Privacy Policy — FlyingFree

1. Data controller

Controller: O. Samper

Postal address:
C. de Reus, 6
43480 Vila-Seca
Spain

Privacy and rights contact: contact@flyingfree.online

2. Data we process

In your browser: scores, completed challenges, aliases, verified zones, video preferences and your choice to discard the sponsor banner. They are not sent just because they are stored.
Published score (if you submit one): alias (up to 16 characters), score, zone, virtual landing coordinates, top speed, flight duration and minimum altitude. The server adds the date and time. The ranking page shows your alias, best score per zone, summed score and dates; scores with the same alias are grouped. The highest zone score also appears on a map monument.
Contact form (if you submit it): your name, email address and message are sent to the FlyingFree inbox so the owner can reply. The message is delivered through Resend; the game does not save a separate copy in your browser or records database.
Sponsored panels: after a landing or collision, we may send the zone, event time, identifiers/names of panels visible for at least one second, and their approximate display time. This does not include your alias or full flight path.
Gameplay statistics: we measure visits, scenarios played, active and simulated flight duration, landing/crash/abandonment outcomes, scores, challenges, parachute use, landing precision, loading time, frame rate and control type. This log does not store your name or alias, email, IP address or an IP hash, browser/device identifiers, real location, referring URL or flight path. Random delivery tokens group events within a visit and prevent duplicates; they exist only in browser memory and temporary server state and are excluded from permanent log rows. Reloading starts a new visit. Published-record statistics contain only the scenario, score and whether a record or ranking improvement was accepted.
Website traffic statistics: We use Vercel Web Analytics to count visits and page views. It does not use cookies or persistent browser identifiers. Our separate anonymous gameplay log and aggregate statistics emails remain available without advertising or YouTube consent.
Connection and security: the hosting provider may receive your IP address, timestamp, requested path, browser and technical headers. The record endpoint uses a temporary IP-based rate-limit key, and contact submissions are rate-limited by IP.
Maps and videos: Cesium ion and Google Maps receive 3D map requests using anonymous requests without cookies. On desktop, YouTube receives your IP address, browser information and video requests only after you activate video sync and expressly accept YouTube cookies and data use. Its enhanced-privacy embed may still use cookies or device storage. On mobile, videos are external links; no embedded player or YouTube API loads inside FlyingFree.
Consent preferences: the device-storage decision received from Google's certified consent platform and its date are kept in ff_ad_storage_consent_v2 in local storage for at most 180 days. This is not a cookie and does not replace Google's advertising record. YouTube permission exists only in memory for the current visit. Every reload starts with video sync off. Old generic cookie and sync choices are discarded; neither advertising consent nor previous preferences activate YouTube. Gameplay remains available without accepting cookies.
Google AdSense and consent: the public introduction and game guide load Google's script to display its certified consent message, with advertising requests paused. There is no preliminary FlyingFree cookie acceptance. In the EEA, UK and Switzerland, the message offers consent, refusal and management of purposes and partners. Advertising starts only with valid, express permission, including device storage; it stays off if permission or the platform is unavailable. Google manages its consent record and may process your IP address, browser and page information to provide consent, advertising, measurement and fraud prevention. Personalization follows your choices. This is separate from YouTube permission and our anonymous gameplay statistics. See Google's advertising information.

Playing the game does not require an email, phone number, account or date of birth. Submitting the contact form requires a name, email and message. Record coordinates refer to a virtual landing, not your device.

3. Purposes and legal basis

Provide the game and save preferences locally.
Publish a score when you submit it and show rankings by zone and total.
Reply to a message when you submit the contact form.
Measure sponsored-panel visibility and protect the service.
Understand gameplay participation, scenario difficulty, loading and performance using game statistics. A password-protected endpoint can email aggregate reports to the site owner without player aliases or individual visit histories.
Load requested maps and videos.
Support the game through Google AdSense advertising.

Depending on the feature, the legal basis may be providing the service you request, our legitimate interests in security and visibility measurement, or your consent where required. Advertising and embedded YouTube use separate consent choices. Reading this policy, scrolling, closing a prompt or opening an external link does not accept cookies inside FlyingFree. Rejecting does not prevent you from playing.

On the introduction and guide, Cookie settings reopens Google's consent message; other pages link to Advertising choices on the introduction. On desktop, enabling video sync asks separately for YouTube acceptance. Disabling sync removes the player and withdraws that permission. Cookie settings in the game menu also offers YouTube withdrawal while enabled, reloading the game to stop loaded third-party code. No Cookie settings button appears during flight; return to the main menu to access it.

Google advertising is limited to the public introduction and the standalone game guide. A remembered refusal keeps the advertising script and message off on later pages and visits for at most 180 days; Cookie settings can reopen Google's message to change your decision. No Google ads are loaded in the game, embedded guides, rankings, contact, legal pages, local development or deployment previews.

4. Who receives the data

Vercel: site hosting and server functions.
Upstash: records, gameplay statistics and temporary request limits.
Resend: delivery of contact form messages and aggregate statistics reports to the configured FlyingFree inbox.
Cesium ion and Google Maps Platform: 3D maps.
YouTube/Google: reference videos.
Google AdSense: advertising. See Google's Privacy Policy and My Ad Center for advertising preferences.

Each provider's own policies apply. Sponsored links open external sites; FlyingFree does not send visibility reports to sponsors.

The source code does not specify hosting regions or provider log-retention periods. The site owner must verify them, including safeguards for transfers outside the EEA.

5. Data retention

Local data: until you clear this site's data in your browser.
Advertising storage preference: at most 180 days in local storage, or until you withdraw or clear this site's data. YouTube consent: current visit only, kept in memory.
Records: no expiry is defined in the code; the owner can delete them, or a higher score for that zone can replace one.
Gameplay statistics: individual access/result/record rows are kept for at most 90 days, with a maximum of 10,000 rows per day; anonymous daily and hourly summaries for 12 calendar months. Temporary visit and flight tokens, event timestamps and per-visit hourly snapshots are kept for at most 48 hours; exact start/READY/end timestamps and tokens are excluded from permanent detail rows. Active time is split by hour in Europe/Madrid. Report retry payloads are kept for up to 24 hours. Aggregate emails are delivered to the owner's inbox; the code does not set the inbox's retention period.
Contact messages are delivered to the configured inbox and processed by Resend. The code does not set a deletion period for either location; the owner should define one. The contact rate-limit key is held temporarily, and provider log retention is not set by this code.
Record rate-limit key: 60 seconds. The code does not set retention periods for panel reports or Vercel logs.
AdSense advertising data and cookies: Google's provider policies and settings apply; FlyingFree does not define their retention periods.

6. Your rights and how to exercise them

You may request access, correction, erasure, restriction or objection, and data portability where applicable. You may also withdraw consent. To exercise these rights or request removal of a public record, email contact@flyingfree.online and identify the relevant data or alias.

Clear local data in your browser. To remove a server record, contact the controller. You may also complain to the Spanish Data Protection Agency (AEPD) or your country's EEA data-protection authority.

7. Security and updates

We validate records and limit requests; no online system can be guaranteed completely secure. We will update this policy if the data, providers or purposes change.