Privacy policy

Last updated October 3, 2026

SECOND STRIKE (secondstrike.io) is made by Clouthier Simulation Labs, a sole proprietorship operated by Kyle Clouthier in Petawawa, Ontario, Canada. This page explains what the game stores, where, and why. The short version: accounts are optional, no ads, chat is passed along and not kept (unless someone reports it), and we never sell anything about you. We use Google Analytics to count visits, with advertising features off.

What stays on your device

The game saves your settings in your browser's local storage: your player name, difficulty, sound and troop settings, which tips and tutorial steps you have seen, the cosmetics you have equipped, and, if you bought something, your restore code and what it owns. When you install the app, your device also caches the game files and map images so it opens quickly. This never leaves your device unless noted below. Clearing your browser data for secondstrike.io erases it.

What reaches our server

What	When	Why	Kept
Your player name, your moves, emotes and chat messages	During an online match	To pass them to the other players in your match, and (moves only) to replay the match on the server to score it fairly	Chat is not stored, except as described in the next row. The last lines of a war are held in memory only while it lasts. Moves are kept in memory only until the match is scored, then thrown away
A report about a player: who reported, who was reported, the reason and note, and (for a report made in a war) the reported player's and the reporter's recent chat lines in that war, plus a one-way hash of the reported player's IP address	When someone presses REPORT	So we can check what happened and act. If we ban a player, the hash of their address is used to block it for the length of the ban; the address itself is never stored	Reports for up to 1 year; address hashes until the ban ends
Your callsign and tag, rating, match results, medals, clan, friends list and notifications	If you sign in and play online, join a clan or add friends	Leaderboards, your service record, clans, friends and the bell. Your callsign, clan, stats, medals, avatar and whether you are playing right now are public on your service record	Until you ask us to delete your account
Your Discord user ID and the access tokens Discord gives us when you sign in with Discord	If you sign in with Discord	To keep your SECOND STRIKE card on your Discord profile (callsign, rating, wins, wars, medals) and your rank role on the official server up to date after each ranked war	Until you remove SECOND STRIKE in Discord (User Settings, Authorized Apps) or ask us to delete your account
Your Discord or Google profile picture address	Only if you switch on "show my picture" on your service record	To show it as your avatar to other players. Switch it off any time and it is removed	Until you switch it off
A creator or referral code you chose to support	If you enter one in Settings or open someone's referral link	Kept on your device and attached to your purchases so that person can be paid their share. Opening a link adds one to that code's visit count; nothing about you is stored with it	With the order record
Your Twitch user id, channel name, display name and profile picture	Only if you press LINK MY TWITCH on your service record and log in on Twitch	To show your stream in LIVE NOW on the start screen (and announce it on our Discord) while you stream SECOND STRIKE. We ask Twitch only who you are; we do not keep your Twitch login token	Until you unlink it
Your referral code, its visit and sale counts, your PayPal email and your confirmation that you are an adult (or that it is a parent or guardian's PayPal)	If you make a referral link in your service record and set up payouts	To credit sales to you and pay you by PayPal. The buyers' names and emails are never shown to you	As long as the code exists, and payout records as long as tax law requires
What you type to a parody leader, with a summary of the match (sizes, the doomsday clock)	When you use TALK	To write the leader's reply. The text is sent to DeepSeek, an AI model provider, without your name or any id	Not stored by us
Anonymous event counts (for example "a match started", "the store opened")	While you play	To see whether the game works and people come back	Daily totals only; no id, name or address is attached
When the game hits an error: the error message, where in the game's code it happened, and whether you were on a phone or a computer	Only when something breaks (at most three per visit)	To find and fix bugs	The last 60 are kept in the server's memory only and are gone when it restarts; no id, name or address is attached
Your email and your restore codes	Only if you choose to sign in (Discord, Google or email link)	So your purchases follow you to any device. Sign-in is handled by Google Firebase Authentication	Until you ask us to delete your account
Store order id, item, amount, time and restore code	When you buy something	To confirm the payment with PayPal and let you restore your items on another device	As long as needed for records and restores

Our server and hosting (Google Cloud and Firebase) keep standard request logs that include IP addresses, for security and troubleshooting. The server also holds IP addresses in memory for a few minutes to limit abuse. We do not use them for anything else.

Payments

Payments are processed entirely by PayPal. We never see your card or bank details, and we do not store your name or email from PayPal. PayPal's own privacy statement applies to what you give them.

Other services the page loads

NASA GIBS (gibs.earthdata.nasa.gov) for the satellite imagery of the Earth.
Google Fonts (fonts.googleapis.com) for the game's typefaces.
PayPal's checkout script, only when you open checkout in the store.
Google Firebase, only if you sign in.
Google Analytics (googletagmanager.com, google-analytics.com), to count visits, pages, how many matches start and store purchases. Advertising features and Google signals are off and IP addresses are anonymised. In the European Economic Area, the UK and Switzerland it runs without cookies; elsewhere it sets first-party analytics cookies (_ga), which you can block or delete in your browser.

These services receive your IP address when your browser fetches from them, as any website does.

Age

SECOND STRIKE is for players 18 and older. We do not knowingly collect anything from anyone younger.

Your choices

You can play without an account and without ever going online. You can mute or report any player by clicking their name in the chat. You can clear everything on your device by clearing site data for secondstrike.io. To ask for your account or purchase record to be removed or corrected, email us with your email address or restore code.

Contact

Clouthier Simulation Labs · info@secondstrike.io

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If this policy changes, the date at the top changes too.