Privacy Policy

The short version

• There is no account, no login, no payment and nothing to install.
• Making, rerolling and reading flags happens entirely in your browser — those choices never reach us.
• We store a flag only when you mint a share link. That flag then becomes publicly viewable.
• Ads come from Google AdSense and aggregate measurement from Google Analytics; both use cookies, and Google’s consent message asks you first wherever consent is required.
• We never sell personal information, and we will delete a shared flag on request.

What you type, and what leaves your browser

The maker asks for four things: a name or house, three values you stand for, one charge, and a palette family. All four are processed locally — the heraldry engine that composes your ensign and writes its meaning-key is JavaScript running on your device. Choosing, raising and rerolling flags therefore sends nothing to us at all; you can use Vexil end to end without transmitting a single one of your answers.

The name is optional. It is used only to seed the design and to caption it, and by design it is never drawn on the flag itself, because good flags carry no lettering.

Shared flags are public

When you press Share, we save that one flag so the link keeps working for whoever you send it to: your four choices, the caption generated from them, and the date it was made. Nothing else — no visitor profile, no device fingerprint, no contact details. The saved flag is served back at its own address and used to draw its preview image, and it is also listed in the public gallery of the day’s recent flags at /today, under the caption — which includes the name you typed.

So please treat anything you type as public. Don’t put a full legal name, an email address, a phone number or anything else you would not want on a public page into the name field. If you have already shared a flag you would rather remove, email us the link and we will delete it.

Cookies and advertising

Vexil is free because it is supported by ads served through Google AdSense. Google and its partners use cookies and similar technologies — including the DoubleClick DART cookie — to serve and measure ads based on your visits to this and other sites. Where consent is legally required (the EEA, the UK and Switzerland, among others), Google’s certified consent message is shown before any advertising cookie is set, and you can accept, reject or change your choice there at any time. On top of that, every page sets Google Consent Mode advertising signals — ad storage, ad user data and ad personalisation — to DENIED by default, so they stay off until you actively grant them.

You can opt out of personalised advertising across the web at Google Ads Settings, or opt out of third-party vendor cookies at aboutads.info/choices. Vexil sets no advertising cookie of its own and uses no ad network other than Google.

Analytics

We use Google Analytics 4 to count pageviews and a handful of product events — a flag raised, a reroll, a share, a download — so we can tell which parts of the toy people actually use. Those events carry no personal data: no name, no flag contents, no identifier we could tie back to you. Measurement is aggregate and can be switched off through the same consent message that controls ads.

Hosting and server logs

Vexil runs on Amazon Web Services. Like any web host, AWS records standard technical request data — IP address, timestamp, requested URL, user agent — in short-lived operational logs used only to keep the site up and to investigate errors or abuse. We do not use those logs to profile visitors and we do not join them to anything you make.

How long we keep things

A shared flag is kept until you ask us to remove it — a permanent link is the entire point of sharing one. Operational logs are held transiently by our host. Aggregated analytics follow Google Analytics retention defaults and contain no personal identifiers.

Children

Vexil is a general-audience toy. It is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has shared a flag that identifies them, email us and we will delete it.

Your rights (GDPR and CCPA)

Because there are no accounts, we hold almost nothing that identifies you. Where you do have rights over data we hold — a flag you shared, for instance — you can:

• ask what we hold and get a copy of it;
• ask us to correct or delete it;
• withdraw consent for ads and analytics at any time through the consent message;
• object to processing, or ask us to restrict it.

We do not sell personal information and we do not share it for cross-context behavioural advertising beyond the Google ad serving described above. To exercise a right, email auto-ai-agency@quantum-solutions.hr — include the flag link if your request is about a shared flag. We answer verified requests within 30 days.

Changes to this policy

If what we collect changes, this page changes with it and the date at the top moves. Material changes are summarised here rather than quietly edited in.

Who we are

Vexil is operated by the AI Agency. For privacy questions, data-rights requests or takedowns, email auto-ai-agency@quantum-solutions.hr.