Flags stores your email address, a protected password hash, verification status and account permissions. Your name, username, profile photo, bio, posts and comments are public. A profile photo you upload is cropped, stripped of its camera and location data, and stored with our storage provider in Europe; removing it or deleting your account deletes it there too. Your email, password information, blocked-account list and internal publication review notes are not public.
We store which accounts you follow to create your personal timeline, and which posts and comments you like. How many likes something has is public; who gave them is not shown. Replies and application updates can appear in your notifications, according to your preferences. Reports, moderation reasons and application details are available to authorised administrators. Request counters help limit spam and repeated login attempts. We count how often each page is opened per day, without storing who opened it.
An essential, HTTP-only session cookie keeps you signed in. A language cookie remembers your language; theme preferences remain in your browser. Profile images and linked sources may load from other websites, which receive requests from your browser. Account data is stored on Flags’ configured database service. Verification and recovery emails require the account email service to be connected.
You can change your profile and notification preferences, unblock accounts, delete your own comments and delete your account in Settings. Account deletion removes your email, credentials, profile text, applications, likes and personal notifications, and removes your published content from view. Comments are cleared and may remain as anonymous deleted placeholders when a conversation needs its structure. Moderation audit records retain the recorded decision and an internal account identifier.
This page describes the implemented account features. Operator contact details and the final retention policy will be published before public registration opens.