Privacy Policy

StateFlo ("the app", "we") is primarily a single-player strategy game with optional online features: a public leaderboard and an in-game licence-plate exchange, where players register, buy and sell virtual plates for in-game currency. We collect the minimum data needed to run these features and to operate auto-renewable subscriptions. We do not sell your data and we do not run advertising.

Data we process

• Leaderboard profile. A callsign and flag you choose yourself, your score, a few derived game statistics (rating, GDP, state power, reserves, territory, drones, days, in-game wealth), your in-game garage (the virtual vehicles you own and the plates on them, plus the registration marks of your yachts and planes and your yachts' names, if you registered them), and the medals you have earned. All of this appears on the public leaderboard and in the player card and, if you are among the 100 wealthiest, on the website too (see "Flobs" below).
• Anonymous player ID. A random identifier generated on your device and stored in the iOS Keychain. It is not linked to your name or email. To recognise your devices and protect your progress from cloning, the server also keeps an irreversible hash of your anonymous iCloud record identifier; it reveals neither your Apple ID nor your email.
• Subscription status. Whether your "President's Club" subscription is active, used to unlock features and show a Club badge on your profile. Payment is processed by Apple; we never receive your card details.
• Purchase receipt. The Apple-signed transaction receipt (JWS) is sent to our server so that limited-edition item runs are verified cryptographically rather than on the app's word. The receipt contains purchase details and no payment information.
• Push notification token. If you allow notifications, the device identifier issued by Apple is stored on our server so we can notify you about the plate market and, if you are a President's Club member, about a private Club auction starting and when someone mentions you in the club chat. You can turn this off in your device settings.
• App integrity. We use Apple App Attest to confirm that a score was submitted by a genuine, unmodified copy of the game. This protects the leaderboard from cheating.
• Friend invites. When you enter the callsign of the player who invited you, the server stores who invited whom (anonymous player identifiers and the device's App Attest key ID) and an irreversible salted hash of the anonymous identifier of your Apple Account (from iCloud): this is how the "one Apple Account, one invite" rule works. We never receive your Apple ID, email or name. A second check uses Apple DeviceCheck: the game sends a one-time device token, the server asks Apple whether an invite has already been accepted on this device and records it after the claim. Apple stores only two bits (yes / no) for the device for the StateFlo developer, with no personal data; we do not store the token.
• Plate exchange. When you register, list, buy, sell or make an offer on a plate, we store the plate text, your anonymous player ID and callsign, the vehicle the plate is attached to, and pending in-game payouts. This keeps plates unique worldwide and delivers the trade to the other player. All amounts are in-game currency; no real money changes hands between players.
• Private Club auction. If you are a President's Club member or an invited guest, we store your bids (lot, amount, time) and invitations (the guest's callsign and who invited them). Other auction participants see the current price and the lot leader, as well as the list of invited guests; after the auction ends, only the winner and the administrator.
• Club chat. If you are a President's Club member and write in the club salon chat, we store your messages (text, time, the message you replied to), your callsign, flag and Club member number, your reactions and the members you mention with "@". Messages are visible to Club members only. Text passes an automatic filter before it is posted. If you report a message or block a member, we store the report or block (who, whom, which message, when) so the moderator can review it; the moderator can turn chat off for a member. We review reports within 24 hours. When you are mentioned, the push notification shows the sender's callsign and the beginning of the message.
• Game saves. Since version 1.1.7 a copy of your game progress (the state of your game: country indicators, money, property, game settings) is sent to our server so that it isn't lost and opens the same way on your devices. The server checks how key indicators changed between save versions to protect the leaderboard from cheating.

Where data is stored

Leaderboard and plate-exchange records are processed by our server (a Cloudflare Worker) and stored in its database (Cloudflare D1) and in Apple CloudKit. Your game progress is stored on your device (and in your private iCloud, if enabled), and since version 1.1.7 a copy is also kept on our server (Cloudflare R2 storage) so that progress isn't lost and opens the same way on your devices. The copy is linked to your anonymous player identifier, is kept until you delete your account and is erased together with it (Settings → Delete account); if the same progress is also played on another of your devices through iCloud, its copy may remain until the account is deleted on that device too. A short technical log of save checks (how game indicators changed between versions) is kept for 30 days to protect the leaderboard from cheating. We do not maintain accounts with passwords.

The stateflo.net website

We set no cookies ourselves and use no analytics, advertising or third-party scripts, and the site stores nothing in your browser; fonts and images load only from stateflo.net. The site runs on Cloudflare: to deliver pages and protect them from attacks, Cloudflare processes technical request data such as your IP address, browser type and the address requested. During a bot check Cloudflare may briefly set strictly necessary security cookies (__cf_bm, up to 30 minutes; cf_clearance, if you are asked to pass a check); they do not track you and are not used for advertising, and as strictly necessary cookies they do not require consent. We keep no logs of individual visits to the website. Links to the App Store and other app stores, Telegram, Instagram, Threads, TikTok and our partners' websites lead to third-party services, whose privacy policies apply once you follow them.

Flobs: the wealth list on the website

The stateflo.net/flobs page publishes the 100 wealthiest players among those who have played in the last 30 days. For each of them we show the callsign, flag, in-game wealth, days played, the vehicles in their garage (models, plates, serial numbers of limited editions), their registered yachts and planes (models, registration marks, yacht names), a "Club" mark if their subscription is active, and the change in rank over the last day. The page also shows a showcase of plates for sale in the game: the plate, the price, and the seller's callsign and flag (if they played in the last 30 days and haven't asked to be removed from Flobs). The site shows no player IDs, email addresses or other contact details. The list is updated hourly, is visible to anyone without the app, and may be indexed by search engines. Other players already see this data on the in-game leaderboard; the website shows it to a wider audience.

Don't want to appear in Flobs? Email us with your callsign and we will remove you from the list within a few working days; your in-game ranking stays the same. Deleting your account removes you from Flobs automatically within an hour.

Subscription

"President's Club" is an auto-renewable subscription (monthly or yearly). Billing, renewals and cancellation are handled entirely by Apple through your Apple ID. Manage or cancel at any time: Settings → Apple ID → Subscriptions.

Who data is shared with

Only Apple (CloudKit, App Store, push notifications, DeviceCheck) and Cloudflare (our server, database and website hosting), strictly so the service can work. Both companies are based in the United States; data is transferred with the safeguards required by the GDPR (the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework). No data is sold or used for advertising. Public profile data (callsign, flag, statistics, garage, medals) is visible to other players, and Flobs data to anyone visiting the website.

Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): the leaderboard, plate exchange, medals, club chat, server game saves and subscription are game features you chose to use.
• Legitimate interests (Art. 6(1)(f) GDPR): anti-cheat protection (App Attest, save checks, invite protection with the Apple Account hash and DeviceCheck), server and website security, publishing Flobs, and moderating the club chat (filter, reports, blocks). You can object to this; see "Your rights".
• Consent (Art. 6(1)(a) GDPR): push notifications. You can withdraw consent in your device settings.

For Ukraine, these bases correspond to Article 11 of the Law of Ukraine "On Personal Data Protection".

How long we keep data

• Leaderboard profile, medals and plates: until you delete your account. Players inactive for 30 days drop off the public leaderboard and Flobs, but the record is kept so you can return with your progress.
• Push notification token: up to 30 days after it was last refreshed.
• Technical security records (one-time checks, request counters, the "online" marker): from a few minutes up to 30 days. To detect new game versions the server keeps no more than 40 truncated hashes of IP addresses per version, never the addresses themselves, until that version becomes outdated.
• Plate trade log (plate, parties, price): 180 days; player reports: until they are handled; the technical save chain that protects progress from cloning: up to 400 days of inactivity.
• Friend invites (who invited whom, the Apple Account hash): no time limit; when you delete your account, the player and device-key identifiers in the record are replaced with irreversible salted hashes, but the Apple Account hash stays so that the "one invite" rule keeps working. The two DeviceCheck bits are stored by Apple; 12 months after their last change the server no longer takes them into account.
• Private Club auction bids and invitations: until the administration deletes the finished auction from its history; yours are removed as soon as you delete your account.
• Club chat messages, reactions, mentions and reports: 7 days, then deleted automatically; a message you delete for everyone is erased at once (if it had already been reported, its text stays with the moderator as evidence until those 7 days are over). Blocks you set: until you remove them; a chat mute: until it expires. All of this is deleted together with your account.
• The copy of your game progress — until you delete your account; the save-check log — 30 days.
• Database backups are kept for a limited time and used only to recover from a failure.

Your rights

You have the right to know what data about you we process, to get a copy of it, to correct or delete it, to restrict or object to its processing (including being shown in Flobs), and to withdraw consent. You can change your callsign and flag in the app at any time. You can delete your account together with all online records (leaderboard row, plates, offers, medals, Flobs entry) from inside the app: Settings → Delete account. Send any other request to the email below; we reply within 30 days. You may also lodge a complaint with a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the data protection authority of your country. Removing the app stops all further data collection.

Children

The app is not directed at children under 13 and does not knowingly collect personal data from them.

Data controller

The controller responsible for your personal data is Yuliia Shkurlei, the seller of StateFlo on the App Store. Questions, data requests and deletion requests: stateflo@ukr.net

We may update this policy; the date above reflects the current version.