Privacy Policy
Effective 2026-09-21 · Flotillas Adrift (flotillasadrift.com)
Overview
Flotillas Adrift is a free browser game. This page explains, plainly and specifically to what the game actually does, what information it stores, where it lives, what's visible to other players by design, and how you can have it removed. It applies to flotillasadrift.com and nowhere else.
Account & sign-in
The game runs in one of two modes. Which one you get depends only on whether cloud sync is configured for the build you're playing — you don't choose it.
- Cloud mode — sign in with Google or with an email + password account, via Google Firebase Authentication. We never see or store your password ourselves; Firebase handles that. Signing in with Google shares your Google account's basic profile info (display name, email address) with Firebase, subject to Google's own privacy terms.
- Local mode — no account at all. You pick a commander name and play under a profile kept entirely on your own device (browser local storage). Your gameplay state itself is never uploaded to any cloud database in this mode — but, like any website, the page still makes ordinary network requests to load the game and its assets (see Third parties).
Data we store (cloud mode)
When you're signed in, your flotilla's data lives in Google Firestore (part of the same Firebase project as sign-in), organized as a handful of small documents:
| What | Contains | Purpose |
|---|---|---|
| Cloud save saves/<your account id> |
Your full flotilla state — city layout, economy, military, population, inbox, settings. | Lets your progress follow you between devices. |
| Public roster entry roster/<your account id> |
A public slice of your flotilla: nation/ruler name, team color, strength, population and civic stats, your flag, alliance tag, and your reputation ("infamy") score and its underlying prisoner/slave-treatment tallies. | Powers the Radar, the Flotillas board, and other players' ability to view your flotilla's country page — see Public by design. |
| Private flotilla records rosterForces/<your account id> rosterPrivate/<your account id> |
The parts of your flotilla other players are not meant to read: your military composition, and the remainder of your nation state that the public slice above leaves out. | Lets the server resolve combat, dues and other actions against your real numbers without publishing them. Your own account and our server functions can read these; other players cannot. |
| Messages messages/<message id> |
Direct messages you send to, or receive from, other players (sender, recipient, subject, body, timestamp). | In-game diplomacy/messaging. |
| Alliance membership alliances/<alliance id> |
One shared document per alliance: member list, ranks, applications, treasury/aid ledger, and posted charter documents. | Multiplayer alliances — visible to fellow members and, for public documents, to anyone. |
| Flag image uploads flagUploads/<your account id> |
A downscaled image you submit to fly as a custom flag, held pending human review before it's approved. | Lets an admin manually screen custom flag art (an automated filter can't read pixels). |
| Crash & problem reports problemReports/<report id> |
Two paths write here, with different amounts of detail. If the app crashes: which screen you were on, the error message, the first 20 lines of the technical stack trace, your account id, and the build version you're running — nothing else. If you use Settings → Report a problem or idea: whatever you typed into that form, plus your browser's user-agent string, your window size, save metadata (age in days and a sync counter — not your save's contents), a short list of your most recent client-side errors, and internal diagnostic snapshots comparing your client's simulation state to the server's. Never your save's actual contents, message contents, or other players' information. | Lets us find and fix bugs, and act on feedback you send us. Your device sends this to our server; neither you nor other players can read it back afterward — only we can. |
| Global news votes globalNews/<headline id> |
Notable in-game events you generate (wars, etc.) and the up/down votes you cast on the shared news wall (one vote per player, attributed to your account). | A shared, cross-player news feed. |
| Harbor Guestbook guestbooks/<flotilla owner's account id> |
Dated, one-line signatures commanders leave on a flotilla's dock — including any you leave on someone else's, and any others leave on yours. | A public guest book shown on each flotilla's country page. |
| Completed trade record exchangeLedger/<trade id> |
A permanent record of a completed player-to-player trade you're party to: both accounts involved and the settled terms. | A public trade history shown on the flotilla page. |
| Season Hall of Fame seasons/<season id> |
Only if you finish in the top 3 when a competitive season closes: your account id, nation/ruler name, flag, and season score. | A permanent public "Hall of Fame" podium record. |
| Battle-report share link shareLinks/<short id> |
A short, 48-hour link you mint to share one of your battle reports — holds the encoded report and your account id, then expires automatically. | Lets a battle report be shared as a short link instead of a long one. |
| Integrity flag (rare) gatewayQuarantine/<your account id> |
A public yes/no flag (plus a short reason) the server sets only if automated fair-play checks find your published stats implausible. Backed by private, server-only gameplay records used solely to run that check — never publicly readable, and not new personal data, just play-history signals. | Keeps the Radar and Flotillas boards leaderboards trustworthy for everyone. |
| Device lease heartbeat leases/<your account id> |
A small timestamp + device id, refreshed periodically. | Stops two of your own devices from overwriting each other's save at the same time. Not shown to anyone else. |
| Signal Flags push token signalFlags/<your account id> |
Only if you opt in (Settings → Signal Flags): a device notification token issued by Firebase Cloud Messaging, plus whether the feature is currently on. | Lets us send you, at most, one push notification a day when something happens in your game. Turn it off in Settings, or revoke notification permission in your browser, at any time — see Third parties. |
There is no payment or billing data of any kind — the game is free and has no purchases.
Public by design
Flotillas Adrift has a social/leaderboard layer, and some of what you do is meant to be visible to every other player — this isn't a data leak, it's how the Radar, Flotillas, alliances, and rival "dossier" pages work. Specifically: your nation name, ruler name, flag, team color, population and civic statistics, military strength (a summary number, not exact unit counts unless another player scouts you in-game), alliance tag, reputation score and its underlying prisoner/slave-treatment counters, public alliance charters, your votes/posts on the shared news wall, any guestbook entry you sign or receive on a flotilla's dock, the settled terms of a completed trade you're party to, and — only if you place on the podium — your name and score in a season's permanent Hall of Fame record, are all readable by anyone who plays the game. Choose your commander/nation names and public flotilla details with that in mind.
A small integrity/fair-play check also runs on the server: in rare cases, if a flotilla's published stats look implausible, its roster entry is marked with a public "unverified" flag on the Radar and Flotillas boards. That check runs only on gameplay data you've already published — it doesn't collect anything new about you — and the flag itself is the only thing made public; the internal records used to run the check are never shown to anyone, including you.
Because this information is public by design, other players' browsers may already have fetched and cached a copy of it before you change or remove it — see Deleting your data for how that limits what a reset or deletion request can actually take back.
A direct message is only readable by its recipient once sent — your own copy of what you sent lives in your account's message history (part of your cloud save), not re-read back from the server's copy. Your cloud save itself (full internal state) is only readable by your own account.
Data kept only on your device
Independent of cloud mode, the game keeps some things in your browser's local storage: your local save (used directly in local mode, or as an offline cache in cloud mode), UI preferences (layout toggle, icon style, etc.), a stable per-device id used for the device-lease/multi-tab protections above, and — in local mode only — your named local profiles. None of this is transmitted anywhere unless you're signed into cloud mode. Clearing your browser's site data removes all of it.
Third parties we use
The game's data and server logic run on Google Firebase products, plus one font host — no ad networks, no analytics SDKs, no other embeds. See Google's Privacy Policy for how Google itself handles data across all of the below.
- GitHub Pages — hosts the game's web app itself (the page you're playing on right now). Loading the page is an ordinary web request to GitHub's servers, which — like any web request — exposes your IP address to GitHub. See GitHub's Privacy Statement.
- Firebase Authentication — handles sign-in (Google or email + password) in cloud mode, as described above.
- Firebase Firestore — the cloud database holding everything in the table above (cloud save, roster entry, messages, alliances, and the rest) in cloud mode.
- Firebase Cloud Functions — server-side code (running on Google's servers, not in your browser) behind some of the game's logic: an automated integrity/fair-play check on published stats, the scheduled job that sends the daily Signal Flags push (below), the scheduled job that closes out a competitive season and writes its Hall of Fame record, and a periodic automated replay check used for that same fair-play verification. These don't collect new personal data — they operate on gameplay data already described in this policy.
- Google Cloud Run — the crash and problem reports described above are sent here rather than to a Firebase Cloud Function. (An experimental in-development command layer also runs on Cloud Run and can carry ordinary gameplay actions, but only for our own admin accounts while it's being tested — it does not currently handle any other player's traffic.) Same operator, same Google infrastructure as the rest of this list — called out separately because it's a different network address, not because it collects anything new.
- Firebase Cloud Messaging (FCM) — powers the optional Signal Flags push notification (Settings → Signal Flags, off by default). Turning it on registers a small service worker (firebase-messaging-sw.js) in your browser and mints a device notification token, which we store (signalFlags/<your account id>) and use only to deliver, at most, one push notification a day when something happens in your game. To revoke it: turn Signal Flags off in Settings (we stop sending to that token), or revoke notification permission for the site in your own browser's settings at any time — either one is honored immediately.
- Google Fonts — the main game app's typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com. Your browser makes a request to Google's font servers to fetch them, which — like any web request — exposes your IP address to Google. We don't use this for tracking and receive no data back from it. (This page and the other static content pages use your device's own fonts and don't make that request.)
We do not use any advertising network, analytics SDK, or other third-party service or embed. The Firebase infrastructure above is Google's, and processes data in the United States.
No ads, no analytics, no tracking
Flotillas Adrift carries no advertising, no advertising networks, and no third-party analytics or tracking scripts (no Google Analytics, no Meta/Facebook Pixel, no ad tech, no session-replay tools). We don't sell or share your data with advertisers because there aren't any. We don't run any gameplay analytics or advertising trackers of our own, and we keep no separate log of your play beyond the gameplay data described above — though our hosting and infrastructure providers (GitHub Pages for the web app, Google Firebase/Cloud Run for the backend) may, as an ordinary part of running their servers, process limited technical request and security logs (things like IP address and request timestamps) that we don't access or use ourselves.
How long we keep it
Cloud data (save, roster entries public and private, messages, alliance membership, flag uploads, guestbook entries, trade records, device lease) is kept for as long as your account is active, so your progress persists across sessions and devices. It is not automatically purged after inactivity — an idle flotilla just sits as-is until you return, reset it, or ask us to remove it. Two exceptions: a battle-report share link expires automatically 48 hours after you create it, and a Hall of Fame podium record is a permanent historical record of that season and isn't removed when an account is reset (see Deleting your data).
Deleting your data
In-app: "New flotilla & reset" (Settings → Danger Zone)
Every account has a self-serve reset in Settings, sometimes called "scuttling" the flotilla. A signed-in account clears three gates before it fires: an explicit "are you sure", a sign-in link we email to your account address (which you must open on the same device, within 15 minutes, to prove you control the inbox), and finally typing your account email or flotilla name. A local-only save has no address to mail, so it keeps the two gates that don't need one. Once armed, the reset:
- Erases the local save on that device,
- Deletes your cloud save document outright, and
- Deletes your public roster entry and its two private companions, so your flotilla stops appearing on Flotillas, the Radar and other players' dossiers.
Be aware of what this does not do: it does not delete your Firebase sign-in account, and it does not retroactively erase records tied to your account id that other players' clients already hold a copy of or that live in shared documents — for example messages you've sent or received, your membership entry inside an alliance's shared document, your news-wall history, a guestbook signature, a completed trade record, or a Hall of Fame podium placement (a permanent historical record of that season, kept the same way a real leaderboard would be). This control is meant for "start over," not "erase every trace."
Full erasure request
For complete removal — your Firebase sign-in account, cloud save, roster entries, messages, alliance membership record, any pending flag upload, your guestbook entries, your Signal Flags push token, and any active battle-report share link — email admin@flotillasadrift.com from the address tied to your account (or otherwise identify your account/commander name) and ask for your data to be deleted. We'll confirm and remove it by hand within 30 days, subject to any verification we need to do and any legal or security retention we're required to keep. One exception: a Hall of Fame podium record is a permanent historical record of a closed season (like a real league's past results) and isn't something we remove on request, though we can still scrub your account id from it on ask. As noted above, a deletion also can't reach into other players' already-cached copies of anything that was public.
Children's privacy
Flotillas Adrift is a general-audience strategy game and is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has created an account or provided data to us, contact admin@flotillasadrift.com and we will delete it.
Changes to this policy
If this policy changes in a meaningful way, we'll update the effective date above. Continued use of the game after a change means you accept the updated policy.
Contact
Questions, requests, or reports: admin@flotillasadrift.com
See also: Terms of Service · Play Flotillas Adrift →