Privacy
Last updated 9 September 2026
Flapstack is a daily pancake-flipping sort puzzle made by one person. This page says exactly what the website and the iPhone app do with data. The website comes first; the app section follows and only adds to it.
The website, today
Your streaks stay in your browser. Your finished puzzles, streaks and any puzzle in progress are kept in your browser's local storage on your device. Clearing site data for flapstack.app deletes them and there is no copy anywhere else, so there is nothing to recover.
What is sent to Flapstack's server, and why. To show how your result compares with everyone else's on the same day, the site sends each finished daily to a server run by Flapstack: the puzzle number, the list of flips you made, and a random identifier your browser generated on its first visit. That identifier is not linked to your name, email, or any account, and the server keeps at most one result per identifier per day. The site also sends two small events with a timestamp and that identifier: that the page was opened, and that the Share button was tapped. Nothing else - not what you shared, not who you shared it with. Replays of earlier days are not sent. The server keeps these to compute daily statistics; the percentage shown on your result card ("you beat 63%") comes from them and appears only once enough people have played that day.
No accounts, no cookies, no analytics. The site has no sign-in, sets no cookies, and includes no analytics or advertising code. It does not use third-party fonts or scripts.
Sharing. The Share button hands the text of your result card to your device's share sheet, or copies it to the clipboard. What you do with it from there is up to you.
Hosting. The site is served by Cloudflare Pages and the server is reached through Cloudflare. Like any web host, Cloudflare sees the requests your browser makes - your IP address, the page requested, and browser headers - and applies its own privacy policy to that. Flapstack's own server logs requests briefly for operation and does not store IP addresses with results.
The iPhone app
The same data as the website, for the same reasons. The app keeps your streaks, finished days and the puzzle in progress on your device. When you finish a daily it sends the puzzle number, your flips and a random identifier the app generated on first launch, so your result can be compared with everyone else's; the server keeps one result per identifier per day. It also sends small usage events with that identifier and a timestamp: the app was opened, a daily was started or finished and how it ended, a practice stack was started or finished, a hint was used, the Share button was tapped, and whether an ad was shown or failed to load and for which slot. None of this is linked to a name, email or account, because the app has none. Your identifier is shown under Settings, About, so you can quote it.
Ads, and what Google collects. The app shows ads through Google AdMob: one after the daily result, a banner on the practice screen, and optional rewarded ads for a hint or the perfect-stack replay (you get the reward even when no ad is available). To do that, Google's advertising SDK runs inside the app and collects data on Google's behalf, as described in its own disclosure: device identifiers, including the advertising identifier if you allow tracking; a coarse location estimated from your IP address; which ads were shown and how you interacted with them; and crash and performance diagnostics. Google uses this to serve and measure ads and, where you have allowed it, to personalise them. How Google handles it is covered by Google's privacy policy and how Google uses information from apps that use its services. Flapstack itself never sees the advertising identifier.
Your choices. On first launch the app runs Google's consent flow. Where the law requires it (the EEA, the UK, several US states) that is a consent form you can decline, and you can change the answer later under Settings, Privacy options. Everywhere, iOS asks separately whether the app may track you; saying no means ads are not personalised and the advertising identifier is not shared. You can change that any time in iOS Settings, Privacy & Security, Tracking. Declining everything keeps the app fully playable.
What the app does not do. No accounts, no sign-in, no analytics SDK beyond the advertising one above, no purchases in this version (a one-time purchase to remove ads may come later, and this page will change first), no notifications yet, and nothing read from your contacts, photos or location beyond what Google infers from the IP address.
Your rights and contact
The only thing that identifies your submissions is the random identifier in your browser or app. If you want them deleted, email the address on the support page with that identifier - on the web it is shown as "device" in your browser's local storage for flapstack.app, in the app under Settings, About - and they will be removed. Clearing site data gives you a new identifier and severs the old one from you entirely.