Privacy

Your collection is stored on your device. You can use the whole app without an account, and nothing leaves your device until you sign in.

What is stored on your device

The countries and territories you have marked, the status you gave each one, and any year, month, date or note you added. The capitals and the regions you have marked, which are kept the same way and travel with everything else. Places you added yourself. The travellers in your collection, including any children you added, which is a name and nothing else. Achievements worked out from the above. Which countries you have broken into their regions. Your settings: which bag you are carrying, how patches are arranged, which flag you chose where more than one exists, and whether you dismissed the install prompt.

Also a queue of changes waiting to upload, and a log of any conflict between two devices, so nothing is lost silently when they disagree.

This lives in your browser’s storage. Clearing site data, or uninstalling the app, removes it. On iPhone and iPad, Safari deletes it after seven days without a visit unless the app is added to the home screen, which is why the app asks.

The app asks your browser for a permission called persistent storage, so that what is saved here is not deleted to make space when the device runs short of room. It reads nothing and it uploads nothing. Your browser may grant it, refuse it or ask you, and Settings, Options says which of those happened on this device.

If you turn on trip reminders, the app asks your browser for a second permission, to show notifications. It is offered only at the moment you put a date on an upcoming trip, and nothing is sent unless you agree. The reminder is the only notification this app sends: the day before a trip you gave a date to, naming the place and the date. There is nothing about achievements, nothing asking you to come back, and no way for the app to send you anything else.

What is stored on a server, and only if you sign in

Nothing at all until you sign in. After that, a copy of everything above except your settings, held so your collection can move between your devices, plus your email address so you can sign back in.

One thing that used to be a setting now travels with the rest: which countries you have broken into their regions. Turning Spain on again on every device you own is the app forgetting something you told it. The line is that a choice about your collection travels and a fact about a device does not, so which bag you are carrying, how your patches are arranged and whether you dismissed the install prompt all stay on the device they were set on.

If you sign in with Google, Google tells us your email address and confirms it is yours. We do not receive your Google password and cannot act on your Google account.

If you turn on trip reminders, this device’s notification address is stored under your account as well, because a reminder has to be sent while the app is closed and something has to send it. That address is the one thing in this app that does not stay on your device. Turning reminders off deletes it, and so does signing out.

The server is Supabase, in Sweden. Access is scoped so an account can read and write only its own rows, enforced by the database rather than by the app.

What is never collected

No location. The app never asks for it and could not use it. No contacts, photos, camera, microphone or calendar. No payment details, because nothing is for sale. No advertising identifiers.

No analytics of any kind. There is no third-party tracking code in this app, no tag manager, no session recorder and no crash reporter. Nothing reports which countries you marked or which screens you opened. This is a deliberate position rather than an oversight, and adding any of it later would mean changing this page in the same breath.

Children

Children can be added as travellers under an adult’s account. They have no logins and no accounts of their own, and the only thing stored about them is a name and the places marked for them. The adult who owns the account controls all of it and can delete any of it.

Sharing

Nothing is shared with anyone by default. There is no public profile unless you make one, no discovery, no followers and no feed. If a sharing link is ever added, it will be off until you turn it on.

Getting your data out

The app saves your whole collection as a file, at any time, without signing in. The JSON file restores everything; the spreadsheet is for reading. Both are on the collection screen under Your data.

Getting rid of it

Removing the app, or clearing site data, deletes the copy on that device. If you have never signed in, that is the only copy and there is nothing else to delete.

If you have an account, you can delete it from inside the app, under Account. Everything stored under it goes 30 days later, and until then signing in and choosing to keep the account stops it. After that it is permanent and cannot be reversed by anyone.

Keeping it

While your account exists, so does its data, because that is the point of it. Deleted rows are kept as markers for a while so other devices learn they were deleted, which is what stops a place you removed on one phone reappearing from another.

Your rights

You can see everything held about you by exporting it, correct any of it by editing it, and delete all of it from inside the app. If you want something else, or want to ask what is held, write to hello@flagsonbags.com.

Changes

If this changes, the date below changes with it. A change that means more data is collected will be said plainly in the app rather than left here to be discovered.

Last updated 21 August 2026.