KO/EN

Privacy Policy

Last updated: 2026-10-23

FlowScore (operated by FlowCoder) has no sign-up, so it does not receive account information such as a name or email address. If you email us about personal information, we receive your address and message (see “Inquiry emails” below). The information this site handles is described below.

Test records are stored only in your browser localStorage. Apart from records you submit to the Hall of Fame (see below), we keep no database of personal records. Backup files and backup codes are downloaded and kept by you; they are never sent to us. Note that share links carry your result values in the URL (?s=), so the URL may appear in the access logs of the browser and hosting server that open it. Do not create a link for a record you do not want to share.

If you close the home-screen install tip, we keep only a “closed” flag in your browser localStorage so it stays hidden. The service worker used for installing the app does not store pages or records on your device; it only shows a notice when the connection drops. On iPhone and iPad, an app added to the Home Screen keeps its records separately from Safari.

This site is delivered through Cloudflare (Cloudflare, Inc., USA). Each time you open a page, your IP address, browser information (User-Agent), the requested address (including the ?s= part of a share link) and the origin of the previous page pass through and are processed on the Cloudflare network, and if you pass a bot check Cloudflare may set a security cookie (cf_clearance; this site does not ask again for 30 minutes). This is outsourced processing and storage needed to deliver and protect the site, disclosed in this policy under Article 28-8(1)(3) of the Korean Personal Information Protection Act. We also use Cloudflare Web Analytics to see visit counts and page speed. When a page opens, your browser sends a measurement signal to Cloudflare; the beacon script removes everything after ? and # from the addresses it sends, and the signal carries the current and previous page addresses, performance values such as page load time, and the browser, operating system and device type. Cloudflare derives the country from the connecting IP. Cloudflare states that it does not use cookies or localStorage to produce these statistics and does not fingerprint visitors by IP address or similar data (the security cookie above is separate). We can only see totals by page, country and device for the last six months; we cannot see any individual visitor's records. When Cloudflare processes this information for us it follows our instructions; processing for Cloudflare's own purposes, such as security, is Cloudflare's own responsibility. Cloudflare stores information mainly in the United States and the European Economic Area and may transfer or access it from other countries for its operations. It keeps information for as long as the purpose requires or the law obliges (Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/ · contact [email protected]). If you refuse the processing needed to deliver the site, you cannot use it. You can block the measurement signal with a content-blocking extension without affecting your use of the site.

Ads are served by Google AdSense. They appear only at the end of the home and guide pages and below the result of a test you finished yourself (there are no ads on pages opened from a share link, the gear page, My abilities, this privacy policy and similar pages). When an ad is shown, third-party vendors including Google place and read cookies in your browser through the ad code and may use web beacons and similar technologies to collect information directly — this site does not receive it and pass it on. The information can include the address of the page you are viewing, behavioral data such as visits to this and other sites and ad clicks, cookie identifiers, your IP address (approximate location), and browser and device information. It is used to serve ads, to show interest-based (personalized) ads, to measure ad performance and to prevent invalid clicks. Because an ad request carries the page address, pages opened from a share link (?s=) do not load ads, so your result values are not sent with ad requests. Retention and processing follow Google's privacy policy, and Google may process the information on servers in several countries. How Google uses information from partner sites: https://policies.google.com/technologies/partner-sites.

You can turn off personalized ads in Google My Ad Center (https://myadcenter.google.com) and opt out of personalized ads from other vendors at https://optout.aboutads.info. Turning off personalized ads does not stop ads (you will still see ads that are not based on your interests) and does not stop all cookie use. You can also block or delete cookies in your browser settings. Visitors from the European Economic Area, the UK and Switzerland first see a consent message provided by Google, and can change their choices at any time from the settings link of that consent message.

On the Korean gear page and Korean test result screens, the “View Coupang search results” links are Coupang Partners affiliate links. When a purchase is made on Coupang through one of them, FlowCoder receives a commission. Clicking one takes you to Coupang, whose privacy policy then applies. The English pages have no affiliate links.

If you submit a record to the Hall of Fame, your nickname, the record value, your country (derived from the connecting IP), the primary pointer (coarse or fine, as reported by the measuring browser — it does not identify the device or the input actually used) and the submission time are stored on our ranking server (Cloudflare Workers and D1) and shown publicly on the ranking table. Records that made a board are kept until you delete them. To count daily submissions, the ranking database keeps only an HMAC value of your IP made with a separate secret key, never the IP itself, for up to two days. A submission also carries an attempt card (measurement time, device details — touch or not, primary pointer and the measured screen refresh rate — and how many times this browser has measured); the primary pointer is kept with records that made a board or await review and shown on the ranking table (deleted together with the record), while the rest is kept only while a record outside the review range awaits review, and deleted once reviewed. Pending and cancelled records are deleted within 30 days. So that the same record is not submitted twice, a receipt (attempt identifier, test, the response at the time including rank, and time — no nickname or IP) is kept without a time limit. Your browser’s localStorage keeps the attempt identifiers, tests, values and times of records submitted from this browser (the “My ranking records” list — used to delete them, and to check whether you already submitted a better record this week) and the nickname of your last successful submission (to fill in the field next time). Attempt identifiers are sent to the server when you submit (so the same record is not submitted twice) and when you ask to delete a record, and all of this is cleared by Reset everything in My abilities.

You can delete a submitted record yourself in My abilities › My ranking records, in the browser you submitted it from. The attempt identifier (shown as the confirmation code) shows the record is yours; deleting removes the row with your nickname, country and attempt card from the database at once, so it leaves the ranking table. The receipt stays so the same record cannot be submitted again, but its rank is cleared and the deletion time is added. Backup files and codes also contain confirmation codes, so anyone who has them can delete these records too. If you no longer have the confirmation code (after Reset everything or clearing browser data), a public nickname and date alone cannot show that the record is yours — contact us below and we will look for a way to verify it with you.

Ranking server data is stored in a Cloudflare D1 database run by Cloudflare, Inc. (contact [email protected]). It is stored in the Asia-Pacific region (Cloudflare does not name the country within it), and requests pass through Cloudflare’s global network. Data is transferred over the internet whenever you submit, view or delete; the purpose and retention are as above. This is outsourced processing and storage needed to provide the ranking, disclosed in this policy under Article 28-8(1)(3) of the Korean Personal Information Protection Act. If you do not submit to the ranking, no record is stored and every other feature still works (viewing the ranking table is handled like the page requests in the Cloudflare paragraph above).

You can ask at any time to access, correct, delete or stop the processing of your personal information, and you can withdraw consent. Records stored in your browser can be deleted directly with Clear records or Reset everything in My abilities or by clearing site data in your browser, and ranking records can be deleted directly in My ranking records as described above (deleting is the same as withdrawing your consent to submit). Send any other request (such as access to a ranking record or a nickname correction) to the contact below. For requests about a ranking record we confirm it is yours with that record’s confirmation code, never with a public nickname or date alone. You may also ask through a representative, in which case we confirm the authorization. We will tell you the result within 10 days of receiving the request, and if we cannot fulfil it, we will tell you why and how to object.

Inquiry emails: for emails about personal information, we keep the sender address, message, attachments and the outcome for one year after the request is handled — to answer follow-ups and to confirm what was done — and then delete them from the inbox, sent mail and trash.

Personal information is destroyed without delay once its retention period ends or its purpose is fulfilled. Ranking server records are deleted from the database: the daily-count HMAC values (two days) and pending or cancelled records (30 days) are removed automatically by a nightly cleanup job, and rows you delete are removed immediately. Deleted data can remain in Cloudflare’s database recovery history for up to 7 days or 30 days depending on the Cloudflare plan before it disappears, and we do not roll the ranking database back with this recovery feature. Inquiry emails are deleted from the mailbox after the period above. If the service closes, the whole ranking database is deleted. We do not keep personal information on paper.

To protect personal information: the ranking database never stores your IP address, only an HMAC value made with a separate secret key, kept for two days. Admin functions (review, deletion, correction) require a secret token that only the operator has. Production server secrets are injected through Cloudflare’s secret settings, not written into the code. Automatic logging of request addresses and connection details is turned off on the ranking server. The site and the ranking server are served at HTTPS addresses.

If you need advice or want to report a privacy violation, you can contact these Korean agencies (domestic numbers): Personal Information Dispute Mediation Committee (1833-6972, https://www.kopico.go.kr) · Personal Information Infringement Report Center (118, https://privacy.kisa.or.kr) · Supreme Prosecutors’ Office (1301, https://www.spo.go.kr) · Korean National Police Agency Cyber Bureau (182, https://ecrm.police.go.kr).

Privacy officer: 조용현 (FlowCoder) · contact [email protected] — send any questions, requests or complaints about personal information to this address.

Revision history