Legal notice and privacy
Last updated: 8 November 2026
1. Legal notice
Mundoo ("the game") is a free web game about flags.
Using the game
You can play for free without an account. To save your progress you need an account, and to create one you must be 14 or older. Under-14s can play as guests, without an account.
By using the game you agree:
- Not to choose usernames that are offensive, impersonate someone else or include other people's personal data.
- Not to cheat or use software to manipulate games, scores, coins or rankings, and not to try to access other people's accounts or overload the server.
If someone breaks these rules, we may remove their username or their account.
Coins and in-game items
In-game coins are earned by playing and can only be used to get decorative items (outfits, backgrounds, frames and effects). They can't be bought with real money, have no monetary value, and can't be exchanged for money or transferred to anyone else. If the account is deleted, they are lost.
Intellectual property
The game, its code, its design and its characters belong to its owner or their authors and may not be copied or reused without permission. It also uses third-party material under free licences:
- Flag images: flag-icons (MIT licence).
- Country outlines and data: Natural Earth (public domain).
- Fonts: Lilita One and Nunito (SIL Open Font License).
- 3D graphics: three.js (MIT licence).
Flags are official symbols of each country; the game uses them for educational and entertainment purposes only.
Liability
We try to keep the game always working and its data (country names, capitals, borders...) correct, but we can't guarantee it. The game may change, go down for maintenance or stop being offered.
Governing law
This notice is governed by Spanish law. If you are a consumer, you may go to the courts where you live.
Owner of the game: Ruben Navarro Martinez · Contact: [email protected]
2. Privacy policy
Here we explain what personal data we process, why, and what your rights are, under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Controller
Ruben Navarro Martinez. For any privacy matter, write to [email protected].
What data we process and why
If you play without an account (guest), we don't store anything about you on the server. The little that is saved (preferences, profile, today's daily challenge and Expedition) stays only in your browser (see Cookies).
If you create an account, we store:
- Email: so you can sign in. There are no passwords: you sign in with a one-time code we send to your email, or with your Google account. If you sign in with Google, we also store the identifier Google gives your account (not your Google photo or name).
- Username, nationality (if you choose one) and character: for your profile.
- Game data: games, duels, daily challenge, collection, Expedition progress, level, coins and items, plus the date you joined and your last visit.
If you send us feedback with the "Feedback" button, we store the text, the language and your account's email, so we can reply. It can only be sent with an account, and the message is linked to it.
IP address: the server uses it on the spot to stop abuse. We don't store it in our database, but the hosting provider may keep it for a few days in its technical logs, for operation and security.
What other players see
If you have an account, other players can see your username, character, nationality, level and 1 vs 1 rating (in duels and in rooms with friends, where your join date, duel record and best achievements are also shown). In 1 vs 1, if nobody is online, another player may face a recording of one of your duels (a "ghost"), with your name and character. Your email is never shown to anyone.
Why we may process it (legal basis)
- Account, profile and game data: because they are needed to provide the service you ask for when you create the account (Art. 6(1)(b) GDPR).
- Feedback messages: your consent when you send them (Art. 6(1)(a) GDPR). You can withdraw it at any time by asking us to delete them.
- IP and abuse limits: our legitimate interest in keeping the game safe and running (Art. 6(1)(f) GDPR).
How long we keep it
- Account data is kept as long as the account exists. You can delete it yourself at any time (Profile → Account → "Delete my account"): everything is deleted immediately and forever.
- When the account is deleted, your feedback messages remain, but without your email and no longer linked to you. Your name is also removed from duels other players played against you.
- Of your duels, only the most recent keep the recording that can appear as a ghost; older ones lose it.
Who it is shared with
We don't sell or give your data to anyone. It is only processed, on our behalf and under contract, by the technical providers that run the game:
- Railway Corporation (USA): hosting of the server and the database, on servers in the European Union.
- Cloudflare, Inc. (USA): protection against attacks and fast delivery of the website; visits go through it, with their IP. It also counts visits with Cloudflare Web Analytics: aggregate figures (how many visits, which pages, from which country and type of device), without cookies and without tracking you across other websites; our legitimate interest is knowing how many people play and what works.
- Brevo (Sendinblue SAS) (France): sending the emails with your sign-in code; it receives your email address.
If you choose to sign in with Google, Google confirms who you are and gives us your email and its identifier; Google processes that data as an independent controller, under its privacy policy.
Railway and Cloudflare are US companies, so there may be international data transfers. These are made with the safeguards required by the GDPR: the EU-US Data Privacy Framework and the European Commission's standard contractual clauses, which are part of each provider's data processing agreement.
We would only give data to the authorities if required by law.
Your rights
You can ask at any time to access your data, correct it, delete it, take it with you in a common format, object to its processing or restrict it. Write to [email protected] from your account's email; we'll reply within one month at most. To delete your account you don't need to write: it's in your profile.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) or to the authority in your country.
Security
Connections are encrypted (HTTPS), we don't store passwords, sign-in codes are single-use and expire quickly, and the server limits abuse. No system is perfect, but we look after your data as best we can.
Changes
If we change this policy (for example, if we add ads), we'll update it here with its date and, if the change is important, announce it in the game.