Privacy Policy

Last Updated: July 1, 2026

1. Who We Are

Data Controller: Stanisław Pawluczuk, operating as a sole proprietorship (Jednoosobowa Działalność Gospodarcza) under Polish law.

Address: ul. Świeradowska 47, 02-662 Warszawa, Poland

Contact: privacy [at] starby.gg

Business Registration: NIP: 1231476789 | REGON: 387249521

2. Information We Collect

2.1 Information You Provide

• Username: Optional display name for leaderboards
• Support Requests: Email and message content when you contact us

2.2 Automatically Collected Information

• Device Information: Device type, operating system, app version
• Approximate Location (service-derived): Starby does not request precise GPS location or iOS Location Services. However, some service providers — such as Google/Firebase Analytics and Google AdMob — may derive an approximate, general location (such as region or country) from your IP address for analytics, security, advertising, or service operation where permitted. This is coarse, service-derived location, not GPS.
• Game Data: Scores, achievements, gameplay statistics, selected settings, and in-game progress are stored locally on your device and may be synced via iCloud if enabled. If you use leaderboards or in-game events, your custom username, scores, monthly event participation, Cup/event rank, reward eligibility, and reward status may also be stored on our servers via Google Cloud Firestore.
• Analytics: Pseudonymous usage data via Firebase Analytics to improve the game (app-instance identifiers, not linked to your identity)
• Transaction & Purchase Data: If you make in-app purchases, we process your App Store purchase status, non-financial StoreKit transaction identifiers, in-game coin balances, and paid/earned coin ledger information. This is used to deliver purchased content, operate app functionality, prevent fraud, and support purchase restoration and cloud sync. We receive these details from Apple StoreKit and do not receive, process, or store your full payment card or financial account details.
• Push Notification Data (only if you opt in): If you enable push notifications in Starby's settings, we store a Firebase Cloud Messaging (FCM) / Apple Push Notification service (APNs) token, your push opt-in status, the date/time when push permission or token registration was first recorded, your device/app platform used for push delivery, your device's timezone, the timestamp of the last token update, and limited play-activity timing such as last play date. This information is used exclusively to deliver streak reminders and inactivity re-engagement notifications. Tokens are replaced or removed when they become invalid, when you opt out, or when they are no longer needed.

2.3 Information from Third Parties

• Advertising Partners: Google AdMob may process device and ad-related identifiers for ad delivery, fraud prevention, measurement, and personalization where permitted. Personalized advertising and cross-app tracking are used only where required permissions/consents are granted, including Apple App Tracking Transparency (ATT) on iOS and Google User Messaging Platform (UMP) privacy choices where available.
• Game Center: Player ID, scores, and achievements when you sign into Apple Game Center
• iCloud: Game progress and settings synced via Apple CloudKit
• Analytics: Firebase Analytics for pseudonymous usage statistics

3. How We Use Your Information

Purpose	Legal Basis (GDPR)
Display leaderboard rankings	Consent
Operate monthly in-game events such as Golden Tile Cup, calculate standings, verify eligibility, and grant non-cash in-game coin rewards	Contract Performance / Legitimate Interest
Show personalized advertisements	Consent
Sync game progress via iCloud	Contract Performance
Improve game performance (Analytics)	Consent (EEA/UK) / Legitimate Interest (elsewhere)
Respond to support requests	Contract Performance
Prevent fraud and abuse	Legitimate Interest
Send streak reminders and inactivity re-engagement push notifications (only if you opt in)	Consent

3.1 Limited-Time Events and Golden Tile Cup

Starby may run limited-time, skill-based leaderboard events such as the Golden Tile Cup. To operate these events we process your event score, event participation, ranking, reward eligibility, and reward status. No purchase is required to participate or to receive a reward. Event rewards are non-cash in-game coins only; they have no real-world monetary value and cannot be sold, transferred, redeemed for cash, or exchanged outside Starby. Rewards may be granted only after final score verification, and we may delay, adjust, withhold, or remove scores or rewards where we detect fraud, abuse, manipulation, or technical errors. See the Terms of Service for full event rules.

4. Advertising & Tracking Consent

Starby uses a neutral Welcome age screen before requesting non-essential advertising, analytics, push, or tracking permissions. Users who choose Under 16 or Prefer not to say receive a protected experience: no personalized ads, no Firebase Analytics, no ATT prompt, no Google UMP personalized-ad consent form, and no push notification opt-in.

For eligible adult users, Apple App Tracking Transparency (ATT) controls whether Starby may ask for permission to track activity across other companies' apps and websites on iOS. If you deny or restrict ATT, we will not access the advertising identifier and will serve non-personalized/contextual ads where ads are available.

Where Google AdMob privacy choices are required or available, Starby provides a Privacy Preferences entry in Settings that opens the Google User Messaging Platform (UMP) privacy options form. If ATT is disabled, Starby may first show a neutral explanation and link you to iOS Settings; this does not enable tracking, analytics, or personalized ads by itself.

You can change ATT preferences in iOS Settings for Starby and manage available ad privacy choices from Starby's in-app Settings → Privacy Preferences.

4.1 Cookies and App-Opened Web Pages

When you open our legal, support, or account pages from the Starby iOS app, those pages do not use cookies to track you across apps or websites. We do not use those pages to personalise ads or track you across other companies’ apps or websites.

These pages are used only to provide information such as our Privacy Policy, Terms of Service, Support, and Delete Account instructions.

5. Push Notifications

Starby sends push notifications only if you opt in. We use them to deliver streak reminders and inactivity re-engagement reminders — for example, a gentle nudge if you haven't played in a while. We do not send marketing or promotional notifications.

When you enable push notifications, we store the following information in our Firestore database:

• A Firebase Cloud Messaging (FCM) / Apple Push Notification service (APNs) device token
• Your push opt-in status
• The date/time when push permission or token registration was first recorded
• Your device/app platform used for push delivery (for example, iOS)
• Your device's timezone (so reminders are sent at a reasonable local time)
• The timestamp of the last token update
• Limited play-activity timing, such as your last play date (used only to determine whether a reminder is relevant)

This information is used exclusively to deliver and manage your notifications. It is not used for advertising, ad personalization, or cross-app/cross-site tracking. Tokens are replaced or removed when they are detected as invalid, when you opt out, or when they are no longer needed.

How to disable push notifications: Open Settings inside Starby and toggle off the notifications option, or disable Starby notifications entirely in iOS Settings → Notifications → Starby.

Legal basis (GDPR): Consent. You may withdraw consent at any time using the methods above without affecting the lawfulness of processing based on consent before its withdrawal.

Service provider: Firebase Cloud Messaging is provided by Google LLC and Apple Push Notification service is provided by Apple Inc. See Section 10 (Third-Party Services) for links to their privacy policies.

6. Children's and Protected User Privacy

If a user chooses Under 16 or Prefer not to say, or is otherwise treated as a child/protected user under applicable law, Starby automatically:

• Disables Firebase Analytics and all non-essential tracking
• Disables personalized advertising — only contextual, child-directed/non-personalized ads are shown where ads are available
• Does not request tracking consent (the iOS ATT prompt is not shown)
• Does not show the Google UMP personalized-ad consent flow or Privacy Preferences entry
• Configures AdMob with child-directed treatment flags and G content rating where applicable
• Suppresses the push notification opt-in prompt — protected users cannot enable push notifications, and we do not register, collect, or store any Firebase Cloud Messaging (FCM) or Apple Push Notification service (APNs) tokens, or any related push timestamps or platform data, for these profiles
• Limits leaderboard/profile features where needed to reduce the risk of personal information sharing

We do not require children or protected users to provide personal information to use the game. Because these profiles are designed to be anonymous and store no direct personal identifiers on our servers, data is primarily managed directly on the device using the in-app "Delete Account" feature or by uninstalling the app. We do not knowingly collect push notification tokens, contact information, advertising identifiers, or other direct personal information from users who choose Under 16 or Prefer not to say. Parents may contact us at privacy [at] starby.gg with any questions about our child safety practices.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("Right to be Forgotten")
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time
• Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the President of the Personal Data Protection Office (UODO) in Poland — uodo.gov.pl

To exercise these rights, use the "Delete Account" feature in Settings or contact us at privacy [at] starby.gg. We will respond without undue delay, in accordance with applicable statutory timeframes (within 15 days for access requests under Brazil's LGPD, within 30 days under GDPR/UK GDPR, and within 45 days under CCPA/CPRA, extendable by a further 45 days where permitted).

7.1 United Kingdom

If you are located in the United Kingdom, your rights under the UK General Data Protection Regulation (UK GDPR) mirror those listed above. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7.2 California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out: You may opt out of the "sale" or "sharing" of your personal information. Starby does not sell personal information. When personalized advertising is enabled, AdMob may share device identifiers with advertising partners, which may constitute "sharing" under the CCPA. You can control this through App Tracking Transparency (iOS) or by contacting us.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy [at] starby.gg.

7.3 Brazil (LGPD)

If you are located in Brazil, you have equivalent rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, portability, and the right to information about data sharing with third parties. To exercise these rights, contact us at privacy [at] starby.gg.

8. Data Retention

• Game Progress: Stored locally on your device and in iCloud until you delete the app or your data
• Leaderboard Data: Custom usernames and Firestore leaderboard data are retained while your account is active, and deleted upon request or after 2 years of inactivity. Scores submitted to Apple Game Center are retained by Apple and must be managed in your iOS device Settings.
• Golden Tile Cup / Event Data: Monthly event standings, reward eligibility, and reward status may be retained while your account is active and for a reasonable period after an event closes to verify rewards, investigate abuse, and correct technical errors.
• Support Requests: Retained for 2 years for quality assurance
• Analytics: Pseudonymous user-level event data is retained in Firebase for up to 14 months, after which only fully anonymized, aggregated statistics are kept.
• Push Notification Data: Your push token, opt-in status, first-recorded timestamp, device/app platform, timezone, last-token-update timestamp, and last-play-date signal are retained while you have notifications enabled. Replaced or removed when invalidated, when you opt out, or when no longer needed. Limited play-activity timing used for notification scheduling is kept only as long as needed to operate the reminder system.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States (Firebase/Google services). We ensure appropriate safeguards through:

• EU Standard Contractual Clauses
• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs, where applicable
• Data Processing Agreements with all service providers

10. Third-Party Services

Service	Purpose	Privacy Policy
Google AdMob	Advertising (interstitial and rewarded video)	Link
Firebase Analytics	Pseudonymous usage analytics	Link
Google Cloud Firestore	Leaderboard profiles, usernames, account data, event standings, reward verification, and push notification management	Link
Firebase Cloud Messaging (Google LLC)	Push notification delivery (streak reminders and inactivity re-engagement)	Link
Apple Push Notification service (APNs)	Push notification delivery on iOS	Link
Apple Game Center	Leaderboards & achievements	Link
Apple iCloud (CloudKit)	Game progress sync	Link
Apple StoreKit	In-app purchases	Link

11. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Secure cloud infrastructure (Firebase, iCloud)
• Regular security reviews
• Minimal data collection principle

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notification. Where required by applicable law, we will request your explicit consent to the updated policy before continuing to process your personal data under the new terms.

13. Contact Us

For privacy-related questions or to exercise your rights: