Who we are
Free to Lose Games, Inc, based in Canada, operates f2l.io and Steel Requiem at sr.f2l.io. In this policy, “we” means Free to Lose Games, Inc. We are responsible for the personal information we collect through these services, including our playtest, Google sign-in, cloud saves, and support.
For privacy questions or requests, contact privacy@f2l.io. You do not need a game account to contact us.
What we collect and why
Google sign-in
If you choose Google sign-in, we receive your Google account identifier, email address, and confirmation that Google has verified that address. We use them to sign you in, check playtest access, and connect your cloud save across devices. Approved playtest email addresses may also be held in an access list.
We request only the openid and email permissions. We do not request your Google password, inbox, contacts, Drive files, or Google Play Games activity. We do not retain Google access or refresh tokens for ongoing access to your Google account.
Game progress
Steel Requiem stores runs, fleet and equipment choices, achievements, career records, and saved mission progress in your browser. When you play with an eligible Google sign-in, cloud synchronization automatically stores a copy of that progress with us, including save times and revision information. Device graphics and display settings remain local.
Cloud saves are linked to an identifier derived from your Google account ID. This is still account-linked information, not anonymous data. We use it to save, restore, and synchronize your progress; saves are not publicly listed.
Messages you send us
If you email us or use our contact form when available, we receive your email address, your message, any name you provide, and related delivery or submission information. We use this to answer you and handle support or privacy requests. Form submissions are stored privately in Cloudflare with a submission time and message status. We do not add the visitor’s IP address or CAPTCHA token to the stored form message.
Technical and security information
Visiting our services sends technical information such as your IP address, requested URL, browser and device details, request time, and response status to our hosting provider, Cloudflare. We use infrastructure logs, service metrics, and request limits to operate the services, diagnose faults, and prevent abuse. These are separate from your saved game progress.
The contact form uses Cloudflare Turnstile to check for spam. Turnstile processes browser and connection signals, including your IP address. Cloudflare also uses those signals to improve its bot detection, as explained in its Turnstile Privacy Addendum.
How long information stays
Cloud saves: we retain your current save and the preceding successful revision so that progress can be recovered and synchronized. New saves replace older revisions. Cloud saves currently have no automatic inactivity expiry; you can request deletion.
Contact and support records: we keep correspondence to respond to you and handle related follow-up, disputes, or legal obligations. Contact-form messages currently have no automatic expiry. You can request deletion of records that are no longer needed.
Access and security records: playtest access information is kept while needed to manage access. Infrastructure logs and security signals are subject to our providers’ retention controls. Browser storage and sign-in cookie periods are described above.
Information needed to meet a legal obligation or resolve a dispute may be retained longer, with use limited to that purpose. Deletion from a live service may not immediately remove copies from provider recovery systems.
Your choices and privacy rights
You can browse f2l.io without a Google account. Where password access is available, you can play using browser saves without connecting Google. Signing out stops cloud synchronization from that session; disconnecting Google or signing out does not by itself delete saved information.
Email privacy@f2l.io to request access to, a copy of, correction of, or deletion of information associated with you. Include the email address used to sign in or contact us and describe your request. We may need to verify that the information belongs to you. Please do not send passwords or Google login codes.
For cloud-save deletion, sign out on your devices and tell us whether you also want playtest access removed. Browser copies must be cleared separately on each device; reconnecting a browser that still has a save can upload that progress again.
Depending on the law that applies to you, you may also have rights to restrict or object to processing, receive a portable copy, or withdraw consent. We respond under the applicable legal requirements. You may raise a concern with us or with your privacy regulator, including the Office of the Privacy Commissioner of Canada.
Grounds for processing and security
Where a legal basis is required, we process information to provide the services you request, for legitimate interests in securing and maintaining those services and responding to inquiries, to meet legal obligations, or with consent where required. If processing depends on consent, you can withdraw it; this does not change the lawfulness of processing that already occurred.
We use HTTPS, signed sign-in sessions, restricted access to stored messages, and account checks for cloud saves. No online system can guarantee absolute security.
Children
Our services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact privacy@f2l.io so we can investigate and remove it where appropriate. Additional protections may apply under local law.
Changes to this policy
We will update this page and its “Last updated” date when our practices change. For material changes, we will provide an appropriate notice through the website or game. If a new use of Google account information requires consent, we will request it before using that information in the new way.