Privacy

Flamezam is operated by Powerzam Studio, a small development team based in Denmark, which is the data controller for everything described on this page.

You can reach us by email or on the Discord. Both are read by a person, and either is fine for a privacy question, a copyright notice, or a request about your own data.

Because the operator is established in Denmark, the GDPR applies to everything on this page, and to every visitor, wherever they are.

When you create an account: a username, an email address, a password, and your birth year.

• Your password is never stored. What we keep is an argon2id hash, which cannot be reversed into the password you chose.
• The birth year is a year, never a full date of birth. It answers the age question with meaningfully less identifying information.

When you sign in: a session identifier, the browser user-agent string, and a hashed form of your IP address. These are what let you stay signed in and let you see and revoke your other sessions.

When you download a map: which map, which edition, your account if you are signed in, a hashed IP address, and the country Cloudflare reports for the request. This is what produces a creator’s download count.

When you answer the cookie banner: your choices, the version of this policy they were given against, and a hashed IP address. If you are not signed in, a random identifier is stored in your browser so we can remember the answer without knowing who you are.

When a moderator acts: what was done, to what, by whom, and a hashed IP address. This is an audit trail, and it is the record we would answer an appeal or a copyright dispute from.

What you post: maps and their files, descriptions, screenshots, changelog entries, comments, ratings, favourites and follows. Most of this is public by design — that is the point of the site.

Not in any table, not in any log. What is stored is a hash, and not a plain one: a secret value known only to the server is mixed in before hashing.

The distinction matters. There are only about 4.3 billion possible IPv4 addresses, so a plain SHA-256 of an IP address can be reversed by simply hashing all of them — it looks like protection and provides none. Mixing in a secret makes that attack impossible without the secret.

That secret is rotated periodically. Rotation is what limits how long two records can be linked to one another: after it changes, the same visitor hashes to a different value, and old rows can no longer be matched to new ones.

Flamezam sets two cookies. Neither is used for advertising or tracking across sites.

• fz_session — keeps you signed in. It holds an opaque token, not your details, and it is set only after you sign in. Without it there is no way to have an account.
• fz_anon_id — a random identifier, set only if you answer the cookie banner while signed out, so we can remember your answer. It identifies a browser, not a person, and is attached to nothing else.

That is the complete list. No advertising cookies, and nothing that follows you to other sites. If that ever changes, the banner will ask first, and the version number of this policy (2026-08-27) will change with it so an old answer is not quietly carried forward.

Three, and no others.

• Cloudflare hosts the entire site — the application, the database, the map files and the images. Everything described on this page sits on their infrastructure. Their bot-protection widget also runs on the sign-up, sign-in and password-reset forms, to keep automated abuse off those endpoints.
• Resend sends email, and only three kinds: confirm your address, reset your password, and confirm that a deletion has been scheduled. They receive your email address because there is no way to send you an email without it. There is no newsletter and no marketing email.
• YouTube, and only if a creator has attached a video to a map and you open that map’s page. Videos are embedded through youtube-nocookie.com, which does not set a tracking cookie for a visitor who does not press play.

We also use Cloudflare Web Analytics to see which pages people actually reach — page views, which site linked here, roughly which country, and how fast pages loaded. It is how we find out that a map nobody can discover exists, or that a page is slow on mobile.

It sets no cookies and does not build a profile of you. There is no identifier that follows you between visits or to any other site, which is why it needs no banner and no permission — there is nothing to permit.

Nothing is sold, and nothing is shared with data brokers or advertisers. There is no advertising on Flamezam today.

The database holding everything personal is located in Western Europe. Map files and screenshots are stored separately; those are files creators chose to publish, not personal data.

• Your account: until you delete it.
• Individual download records: 18 months, then deleted automatically. The daily totals built from them are kept, so a creator’s download history survives while the per-event rows do not.
• Sessions: until they expire, and for seven days after you sign out, so a stolen token cannot be replayed in the gap.
• Email confirmation and password reset links: until they expire, then deleted.
• Abandoned uploads: a file uploaded to a form you never finished is deleted within about a day.
• Moderation records: kept, because they are the record an appeal or a copyright dispute is answered from.

You can request deletion from your settings. A person reviews the request, and once it is approved your account goes dark for 30 days — invisible to everyone, and fully restorable by you in case the request was a bad day rather than a decision. After that window it is anonymised automatically.

What is erased: your email address, your username, your password hash, your avatar, your birth year, and anything you wrote in the “why are you leaving” box. Your sessions and any pending links are destroyed immediately when the request is approved.

What survives, under an empty byline: maps you published, and comments and ratings you left. We are honest about this rather than quiet about it: deleting a popular map because its creator left punishes the players who were depending on it, and removing one side of a conversation makes the rest unreadable. The content stays; the person attached to it does not.

If you want a map itself taken down as well as your account, say so when you write to us and we will do it before anonymising the account.

You can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything wrong;
• delete your account, as described above;
• stop processing your data where we rely on your consent;
• withdraw a consent you gave — including through the cookie banner, at any time.

Write to contact@flamezam.com. There is one person answering, so allow a few days rather than a few minutes.

If you think we have handled your data badly, you can complain to the Danish supervisory authority, Datatilsynet, which supervises us because that is where we are established. If you live elsewhere in the EU or EEA, you can complain to your own national authority instead.

You must be at least 13 to have an account. We ask for a birth year rather than “are you over 13?” on purpose — a yes/no question tells you which answer opens the door, so it measures willingness to click rather than age.

If advertising is ever introduced, personalised advertising will not be shown to anyone under 16, and an unknown birth year is treated as under 16 rather than over it. “We do not know” must never resolve to “target them”.

If you believe a child under 13 has an account here, email contact@flamezam.com and we will remove it.

Passwords are hashed with argon2id at parameters recommended for password storage. Session cookies cannot be read by JavaScript, which is what stops a script on a page from stealing one. Every uploaded file is inspected before it can be downloaded by anyone.

No site can promise it will never be breached, and we are not going to. If a breach affects you, we will tell you what happened and what to do about it.

This policy is versioned (2026-08-27). When it changes in a way that affects the choices you were offered, the version changes with it and the banner asks you again rather than assuming your previous answer still applies.