Privacy
F2P Club has no accounts, no sign-in and no forms that send anything. This page explains what the site stores and processes, based on how it actually works.
When you vote
When you mark a code as “Worked” or “Didn’t work”, the server stores one record containing: the code, your vote, two fingerprints (explained below), the time of your first vote and the time of your last change.
It does not store your IP address, the user-agent text your browser sends, a name, an e-mail address, an account, a cookie or any device identifier.
To stop one person from voting twice on the same code, the server combines your network address (for IPv6, only its first 64 bits), your browser’s user-agent text and the code number, and turns them into a short one-way fingerprint using a secret key. A second fingerprint leaves out the user-agent; it limits how many different people on one network can vote on one code (at most 2).
Both fingerprints are computed while your request is handled. The address and user-agent are then discarded: the site’s code does not write them to its database or to its logs.
The fingerprints are different for every code, so they cannot be used to follow you from one code to another. Without the secret key they cannot be recalculated or turned back into an address.
Each code also shows running totals of “Worked” and “Didn’t work” votes. The totals contain no fingerprints and stay with the code.
About the codes
Each code is stored with its reward, the date it was added, when it ends, and where it comes from: either an official source, with the date of that announcement, or “tested by F2P Club”, with the date F2P Club tried it, or, for games that list them, a third-party list (see below). It holds no information about visitors.
A code from an official source links to the game publisher’s own announcement. A code tested by F2P Club may also link to such an announcement, but never to a fan account or a third-party site: a link like that is refused when the code is added, and it is not stored.
“Tested by F2P Club” means F2P Club entered the code in the game and saw it work on that date. The site never tests codes on your behalf and never asks for your game account details.
A code seen on a third-party list is stored with the name of the list, if one is given, and the date it was seen there. There is no link to that list, and the code is shown as “Not verified”.
The RSS feed is a public list of the active codes. Fetching it sets no cookie and stores nothing about you.
How long it is kept
Vote records, including both fingerprints, are kept while a code is active. They are deleted automatically 30 days after the code expires or is reported as not working, by a job that runs once a day.
A code whose expiry date is not known is treated as expired 30 days after it was added, unless an expiry date is set later.
Technical records of the scheduled jobs (when they ran, how many entries they changed and any error message) contain no visitor data and are deleted after 90 days.
A log of F2P Club’s own changes to codes (adding, editing, changing the type, expiring, reactivating, deleting and undoing) is kept for auditing, with the sign-in e-mail address of the F2P Club admin who made each change. It contains no visitor data and is not deleted automatically.
On your device
Your browser remembers how you voted on each code so the page can mark your choice and, if you pick one, whether you chose the light or dark theme. These stay in your browser’s local storage and are never sent to the server.
If you choose a language, your browser remembers it under one key in its local storage, so that on a page in another language the site can offer a link to the same page in the language you chose. The choice is never sent to the server and never takes you to another page by itself.
The Tracker page remembers which codes you marked as redeemed, game by game, under one key in your browser’s local storage. The marks are never sent to the server. “Download backup” saves them to a backup file on your device and “Restore” reads one back, all inside your browser.
The wish calculator works only in your browser; what you type is not sent anywhere and not stored.
The speed-up calculator, the pull tracker and the energy timer remember what you typed under one key in your browser’s local storage, so the page shows it again next time. It is never sent to the server. The speed-up calculator’s “Download CSV” makes the file in your browser.
“Copy link” on a tool puts the values you typed into the link it copies, after the # sign, a part browsers do not send to the server. Nothing is shared until you share the link yourself.
To work offline, the site keeps copies of its pages, files and the latest code list in your browser’s cache.
Neither the site nor its visit counter (see “Visit counts and ads” below) sets cookies.
You can remove all of this at any time by clearing this site’s data in your browser settings. The site still works without it, for example in a private window.
Hosting by Cloudflare
The site runs on Cloudflare. To deliver pages, handle requests and protect the site against abuse, Cloudflare necessarily sees your IP address and the details of each request, such as the address requested and your browser’s user-agent. Cloudflare may also set its own security cookie when it checks for automated traffic. This happens in Cloudflare’s infrastructure, outside the site’s own code and database.
How Cloudflare handles this data is described in its own policy:Cloudflare privacy policy
Visit counts and ads
To see how many pages are viewed, the site uses Cloudflare Web Analytics. It sets no cookies and uses no local storage, and Cloudflare states that it does not collect personal data or track visitors across sites. It counts page views and reads the page address, the referring page, the browser and device type, the country and how fast the page loaded; it does not build a profile of you. Its script is loaded from Cloudflare (static.cloudflareinsights.com) and reports to cloudflareinsights.com; if you block it in your browser, the site works the same.
The site shows no advertising and loads no other third-party scripts, fonts or trackers; every other file is served from this site. If advertising is ever added, this page will be updated before it goes live.
Links to other sites
The “Redeem on the official page”, “Official source” and “Source” links open the game publisher’s own website or account, for example its official account on X or hoyoverse.com. Their own privacy policies apply there.
Contact
Questions about privacy on this site: [email protected]
This page describes how the site works today. When that changes, the page is updated together with the date above.