Privacy Policy

Who is responsible

Starfall is developed and operated by Slashforward, operated by Wouter Neuteboom in Leiderdorp, the Netherlands. Slashforward is the controller for the personal data described in this policy.

Information we process

Starfall processes the information needed to create and run your account, keep one persistent game universe in sync and provide the social and safety features you choose to use.

• Email address, Supabase authentication ID, session credentials and provider identifiers for email, Apple or Google sign-in. A provider may also supply basic profile details such as your name.
• Commander profile, colonies, resources, buildings, research, fleets, scans, missions, combat reports and other game actions.
• Friendships, diplomacy, conversations, chat messages, blocks and private safety reports or evidence.
• For optional gem purchases: your Starfall account UUID, Apple transaction and product identifiers, gem quantities, processing dates and refund adjustments. Apple handles payment details; Starfall does not receive your card or bank details.
• Notification preferences and, when remote notifications are enabled, a random installation ID, APNs or FCM push token, platform, language and app version.
• When you sign in or open the app while signed in, app installation details: the same random installation ID, platform, how the app was installed (App Store, TestFlight, development build or web), app version, build number and release ID, operating-system version, device model (for example iPhone16,2), language, time zone and when the installation was first and last seen.
• When diagnostic reporting is enabled for a release, limited error reports for signed-in users, including the release ID, platform, app version and build, current route path, error message and stack trace, component or source details, and for backend failures the function name and broad error class or code.
• Support correspondence, including your email address, commander name, app version and the problem details you choose to send.

How we receive information

Most information comes directly from you or from actions you take in the game. Authentication providers return the identifiers and basic profile details needed to sign you in. Your device supplies app installation and compatibility details when you use the app signed in, and notification information when that feature is enabled. Apple supplies signed purchase and refund information for gem purchases. Starfall does not access your address book, precise location, photos, microphone, card or bank details, or advertising identifier, and does not store your IP address with app installation details. If you enable motion parallax, the app processes device-orientation readings on the device to animate the interface and does not send those readings to Starfall’s backend.

What other players can see

Starfall is a multiplayer game. Your commander name, civilization, selected title, rank, score, leaderboard breakdown, named worlds and some game or combat results may be visible to other signed-in players. Chat messages are visible to the members of that conversation. A reported message and relevant context may also be accessed by authorized moderation personnel and service providers operating under our instructions. Private safety reports are otherwise kept confidential unless disclosure is needed to protect someone or comply with law.

Information on your device

Starfall stores its authentication session, preferences, a random installation ID used for push and app installation details, notification schedules, recent navigation state, per-account seen or read markers and short recovery records for unfinished building actions on your device. Some records contain your account UUID or internal game-object identifiers. Most local preferences and markers have no automatic expiry. Clearing app data or uninstalling normally removes them, although eligible app data may be included in an operating-system device backup.

Why we use it

We use account, game and social information to perform our agreement with you and provide Starfall. We use limited security, moderation and reliability information, including app installation details, for our legitimate interests in protecting players, preventing abuse, understanding how accounts were created, supporting the right app version, fixing faults and keeping the service dependable. Remote notifications depend on your device permission and category choices. When diagnostic reporting is enabled for a release, reports are sent automatically for signed-in users and Starfall does not currently provide an in-app diagnostic-reporting switch. We may also process information to comply with law or protect someone’s vital interests.

Diagnostic safeguards

Before sending a diagnostic report, the app removes query strings and attempts to redact email addresses, JWT-like tokens and common token, code, key and secret parameters. Automated redaction may not catch every identifier, so diagnostic access is restricted and reports are used only for reliability and security work. Starfall does not use a third-party analytics or crash-reporting SDK.

Service providers

Supabase provides authentication, database, realtime and backend functions. Apple and Google process sign-in information when you choose their login service. Apple Push Notification service processes device tokens when remote push is enabled on iPhone; Firebase Cloud Messaging does so in an Android release when configured. An email provider carries support correspondence. We require providers that process data on our behalf to protect it consistently with applicable law, our instructions and this policy. Starfall has no advertising SDK or data broker, and we do not sell personal information.

Purchase verification and retention

For Apple In-App Purchases, Starfall supplies an account UUID as an app account token so that Apple-signed transactions can be linked to the correct game account. Our server checks the transaction with Apple, delivers the gems once and processes signed refund updates. We do not send gameplay consumption data to Apple for refund decisions. Purchase and refund records are restricted to trusted server operations and retained for seven years after their last recorded processing activity, including after account deletion, for purchase support, dispute handling and financial recordkeeping. A daily bounded cleanup removes expired detailed records; it keeps only a transaction fingerprint without the account UUID, product, amount or dates to prevent the same old purchase being redeemed again. These records are not used for advertising or tracking.

International processing

Some providers may process information outside your country or the European Economic Area. Where required, we use an applicable transfer mechanism and other safeguards. Contact us for information about the safeguards relevant to your data.

Retention and deletion

Account, game and social information is generally kept while your account is active. App installation details are kept while your account is active, limited to a small number of recent installations, and are deleted with your account. Diagnostic reports are kept only as long as reasonably necessary to investigate reliability and security issues; the current operational target is about 30 days. Support correspondence and moderation records may be retained for as long as needed to handle the request, protect users, prevent abuse, resolve disputes and meet legal obligations. After confirmed account deletion, player-owned data is removed from the active service except for those limited records. Deleted data may remain in protected backup or recovery copies until their ordinary rotation and is not returned to active use unless needed for disaster recovery. Local preferences, markers and recovery records remain until you clear app data or uninstall Starfall.

Your choices and rights

You can manage notification categories in Starfall and request permanent account deletion from Profile → Account & safety. There is currently no in-app data-export tool. Email us to ask for access, correction, a portable copy, restriction or deletion of your personal data, or to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. We normally respond within one month. You may complain to your local data protection authority, including the Dutch Autoriteit Persoonsgegevens.

Account deletion details

Starfall first attempts to unregister the device from remote push and cancel Starfall-managed local notifications; those cleanup steps can fail. After the backend confirms the deletion request, the app clears its locally stored authentication session and signs you out. Clear the app’s data or uninstall it to remove remaining local preferences, markers and recovery records. The Account & data deletion page explains the in-app and email routes.

Security

Starfall uses authenticated access, row-level database policies, restricted backend functions, encryption in transit and access controls intended to limit personal data to people and systems that need it. Where Sign in with Apple revocation credentials are stored, they are encrypted at rest. No system can be guaranteed completely secure, so please report suspected account or data issues to support.

Automated decisions

Starfall does not use personal data to make solely automated decisions that produce legal or similarly significant effects. Filters and rate limits can stop or delay content automatically, but account moderation decisions are subject to review by an authorized person.

Children

Starfall is intended for users aged 13 or older. We do not ask for a date of birth and currently do not provide an in-app age-verification or parental-consent flow. If you believe a child under the applicable minimum age has provided personal information, contact us so we can investigate and delete it where required.

Changes to this policy

We may update this policy when Starfall, its providers or legal requirements change. The date at the top will be updated, and material changes may also be announced in the app.