Play free

Privacy policy

Hitflag needs no account and shows no ads. Here is everything the website, the newsletter and the game collect, why, where it goes, and how to have it deleted.

In effect from 17 October 2026

The short version

  • You do not need an account to play, and we do not sell or share your data for advertising.
  • The website counts visits with cookieless analytics.
  • We keep your email address only if you give it to us, for the newsletter or the closed beta, and delete it when you ask.
  • Online play goes through Unity's services with a random, anonymous player ID.
  • Your settings and match logs stay on your computer.

Who we are

Hitflag is an independent game made in Türkiye. "We" in this policy means the people who make it. For anything about your data, write to hello@hitflag.com.

The website

This covers hitflag.com and hitflag.nxyz.art.

  • Hosting. Vercel serves the pages, the videos and the downloads. Like any web server, it processes your IP address and the details of each request to deliver the page and keep the service secure (Vercel's privacy policy).
  • Analytics. We count visits with Rybbit, which uses no cookies. It records which pages are viewed, where visitors came from, their approximate country, and their browser, device type and screen size, so we can see what works. We do not use it to identify you.
  • Fonts. The typefaces come from Google Fonts, so Google receives your IP address when your browser fetches them (Google's privacy policy).
  • Your browser. The site remembers your language and whether you closed the newsletter card, in your browser's own storage. That never reaches us.

Newsletter and closed beta

When you sign up we keep your email address, which list you chose (newsletter or closed beta), the platform you picked for the beta, the page's language and the times you signed up and confirmed. That is all.

  • Confirming: we first send one email with a link. Until you tap it you are on no list and we send you nothing else.
  • Why: to send you the newsletter (about once a month) or your closed beta key. We use it for nothing else, and the basis for using it is your consent.
  • Where: at Emailit, the email service that keeps our lists and sends our emails. The emails come from hitflag@nxyz.cloud, the address of the studio behind Hitflag; replies reach hello@hitflag.com.
  • How long: until you unsubscribe, or for the beta list, until the closed beta ends.
  • Leaving: write to hello@hitflag.com, or use the link in any email we send, and we delete your address.

The game

The game itself has no analytics, no ads and no tracking. It keeps your settings and a log of each match on your computer; the logs leave it only if you send them to us.

It connects to the internet only for these things:

  • Updates. It asks hitflag.nxyz.art whether a new version is out, and downloads it from there when you choose to update. A copy from Steam leaves this to Steam.
  • Online play, when you choose it, through Unity Gaming Services (Unity Technologies). Signing in creates a random, anonymous player ID, and Unity's servers connect you to the other players, which means they process your IP address (Unity's privacy policy).
  • Hosting a game. A private game or a game on your local network carries the name you choose under Multiplayer → Your name; until you choose one it is "Driver" and four random digits. Players who find or join the game see that name, Unity's servers handle it, and hosting on your local network announces it to the devices on that network. A public game is named after the place. (Hitflag 0.3.24 and earlier named a hosted game after your computer.)
  • The world map. A place you search for is sent as text to our map server (run on Cloudflare), which asks OpenStreetMap's search service, Nominatim. Building a place asks our map server first for its streets and terrain (it keeps one copy of each place's map data, of each terrain tile and of each search, so that everyone who picks the same place shares it); when it cannot answer, the game downloads the streets itself from OpenStreetMap's Overpass servers, or their public mirrors run by VK (maps.mail.ru) and private.coffee, and when none of those answers, from our own copy of OpenStreetMap (osm-depot, also run on Cloudflare); the terrain comes from Amazon Web Services. Each of these services sees your IP address; our map server keeps no record of who asked.

Steam

If you get Hitflag through Steam, Valve handles your purchase, your account and Steam's features under the Steam privacy policy.

Children

Hitflag is not aimed at children under 13, and we do not knowingly collect their data. If a child has given us an email address, write to us and we will delete it.

Your rights

You can ask us what we hold about you, ask us to correct it or delete it, object to how we use it, or withdraw your consent at any time. Write to hello@hitflag.com; we answer within 30 days. You can also complain to your data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), in the European Union the authority of your country.

Changes

When this policy changes we update this page and the date at the top. If a change matters for an email address you gave us, we tell you by email.