Toast Flipper Privacy Policy

Last updated: November 7, 2026

This privacy policy covers the game Toast Flipper (full game, demo and playtest) and its online features. Our website and shop are covered by the general privacy policy on lonosgames.com.

1. Who is responsible

Linus Krüger (Lonos Games)
c/o POSTFLEX PFX-012-176
Emsdettener Straße 10
48268 Greven
Germany
Email: contact@lonosgames.com

2. Playing offline

Your save (progress, best times, skins, settings, level drafts) is stored locally on your computer. If Steam Cloud is on, Steam syncs that file through Valve's servers. We never receive it.

3. What we process

Posting times, publishing, liking and reporting levels need a Steam login. Without one you can only view and play leaderboards and community levels, and we store nothing about you.

When you use online features (leaderboards, community levels, race mode), we process:

- Steam ID, Steam name and Steam avatar (link): at start, the game asks Valve whether your Steam login is genuine and receives your Steam ID, name and avatar. Why: login, and showing your name and avatar on leaderboards and your levels.

- A secret login key (we only store a hash of it). Why: so only you can upload times and levels under your name.

- Best times on story and community levels. Why: leaderboards and rewards.

- Community levels: level data, level name, clear time when published, dates. Why: publishing levels and showing them to others.

- Likes, reports and levels started/cleared (with your player ID). Why: counting likes and difficulty, preventing duplicate likes and reports, moderation.

- Race mode: room code and connection data (a WebRTC offer, which contains your IP address). Why: connecting two players. Deleted after 10 minutes.

- IP address. Why: technically needed to talk to the server (see section 5). We do not store it in our database.

Visible to other players: your name, avatar, leaderboard times, your published levels (with your name as creator) and their like count and difficulty. Who liked or reported a level is not public.

The game has no ads, tracking or analytics.

4. Legal bases

- Art. 6(1)(b) GDPR (contract): leaderboards, community levels, Steam login and race mode are game features you choose to use, and they cannot work without this data.

- Art. 6(1)(f) GDPR (legitimate interests): preventing cheating and abuse, moderating reported levels, keeping the server secure.

Storing your save locally is strictly necessary for the game (§ 25(2) no. 2 TDDDG).

5. Recipients and service providers

- Cloudflare, Inc. (USA) runs our server and database as our processor. It processes your IP address to deliver requests and block attacks. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply.

- Valve Corporation (USA) verifies your Steam login and provides your name and avatar. Avatars load directly from Steam's servers. Valve is responsible for this itself (see Valve's privacy policy).

- Race mode: races run directly between the two players (peer to peer). Your opponent can technically see your IP address. To set up the connection, the game asks STUN servers run by Cloudflare and Google LLC (USA) for your public IP address. Only race people you give your room code to.

- Other players see the public data listed in section 3.

6. How long we keep data

- Names, avatars, times, levels, likes and reports are kept while you use the online features, or until you ask us to delete them.

- A published level is deleted from the server when you unpublish it. Uploading a changed version resets its leaderboard and stats.

- Race connection data is deleted after 10 minutes.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR).

Email contact@lonosgames.com with your Steam ID (or the name you play under). We reply within one month.

You can also complain to a data protection authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de.

8. Children

Steam requires you to be at least 13. We process nothing beyond what is listed above and never ask for real names, addresses or contact details.

9. Changes

When the game gets new online features, we update this policy. The version published here applies.

here applies.