Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

The business address is published in the Legal Notice.

2. Scope

This Privacy Policy applies to the Starpolar websites at starpolar.app, starpolar.eu, starpolar.xyz, and starpolar.net, our contact and sign up forms, our newsletter, private beta programs including TestFlight and Google Play testing, and the Starpolar app including pre release versions.

To use the Starpolar app, acceptance of this Privacy Policy and the applicable Terms is mandatory. You can withdraw this acceptance at any time by deleting your account.

3. Data We Process

Depending on how you use Starpolar, we may process the following categories of data.

Website and forms
Name and email address
Platform preference and optional device information
Message content you submit in forms or surveys

App and account data processed on our servers
Account identifiers and account contact details such as email address, name, and a user identifier
Device related identifiers used for account security and app functionality
Subscription and entitlement information used to validate access to paid features
Firebase Device ID, in app User ID, and login timestamps for account security and abuse prevention

Nutrition and macro guideline data
Date of birth, weight, height, sex
Processed to calculate macro and guideline values
Stored in Firebase Firestore so your settings can currently be synchronized across your devices. You can disable this sync in the app settings and delete nutrition data there.

App content and files
Personal planning content such as schedules, routines, lists, settings, nutrition entries, and related app files may be stored on your device and in Firebase Firestore to support synchronization and app functionality. Data stored locally on your device is stored in encrypted form. In the app settings, you can delete nutrition data and remove all app files stored through the app. Complete deletion of account associated data requires account deletion.

Technical and diagnostic data
Basic technical data needed to deliver and secure the website
Crash and performance diagnostics where available and enabled
Email delivery and unsubscribe events
Session storage entries used to remember temporary interface preferences during your current visit

4. Purposes

We process personal data for the following purposes.

• Operate and secure the website and app
• Respond to inquiries and provide support
• Run beta programs including selection, invites, communication, and feedback collection
• Send newsletters and product updates when you subscribe
• Improve reliability, performance, and usability, including troubleshooting
• Validate subscriptions and feature access
• Verify eligibility and credit beta rewards to the correct account and prevent abuse
• Account security and abuse prevention, including login and device logging

5. Legal Bases

Where required under applicable law, we rely on one or more of the following legal bases.

Contract or steps prior to entering a contract
For example beta participation, account services, and support

Consent
For example newsletters or non essential product communications

Legitimate interests
For example security, fraud prevention, service improvement, and aggregated usage measurement

Specific allocations
Nutrition and macro guideline features: consent
Providing nutrition and macro data is optional. You can use core planning features without entering this information. You can withdraw consent at any time with future effect.
If you withdraw consent, we stop using this data for calculations. In the app settings, you can disable synchronization and delete nutrition data. You can also delete all app files there, while complete deletion of account associated data requires account deletion.
Login and security logs: legitimate interests
Newsletter: consent

Where we rely on consent, you can withdraw it at any time with future effect.

6. Website Hosting and Delivery

Our website is hosted and delivered via Netlify. Netlify processes technical data necessary to deliver the website, maintain security, and ensure performance.

7. Forms and Contact Requests

When you contact us or apply for beta access using our forms, we process the information you submit to handle your request, communicate with you, and where applicable enroll you in the beta or newsletter. Form submissions are processed via Netlify Forms.

8. Newsletter and Email Delivery

If you subscribe to our newsletter, we process your email address and subscription status, including subscribe and unsubscribe events, and technical delivery information. We use Resend to manage contacts and send emails.

Unsubscribe
You can unsubscribe at any time via the unsubscribe link in each newsletter email. After you unsubscribe, we retain newsletter data for 6 months and then delete it completely.

9. Beta Programs and Reward Matching

If you apply for the private beta, we may process your email address, platform preference, optional device information, and your feedback.

For reward verification and to credit beta rewards to the correct account, we process matching identifiers, including the in app User ID and account email address. We recommend using the same email address for your beta application and your Starpolar in app account so the reward can be credited reliably. If these do not match, reward credit may be delayed or denied where we cannot verify the correct enrolled participant.

10. TestFlight and Apple Data

If you use an iOS beta via TestFlight, Apple may collect and provide us with beta related diagnostics and feedback information, including crash data, usage information, and feedback content. Apple may associate this information with your TestFlight account details.

11. Google Play Testing

For Android testing via Google Play, Google may process technical and diagnostic information under its own terms and your device settings. We receive information that Google makes available to developers for testing and diagnostics, depending on the testing setup.

12. Analytics

We use GoatCounter as a privacy focused website analytics provider to measure aggregated website usage and improve the website. GoatCounter is configured in cookie-free mode, without tracking profiles and without direct personal profiling. We do not use analytics data to build user-level behavioral profiles.

GoatCounter processes technical request data to count page views and prevent abuse.

13. Recipients and Processors

Netlify processes data for website hosting and form handling. Resend processes newsletter delivery. Oracle Cloud is used for beta server hosting in the EU. Firebase Crashlytics is used for crash reporting in beta builds. Apple processes data for TestFlight participation. Google processes data for Google Play testing. We use data processing agreements with our processors where required.

14. International Transfers

Some service providers may process data outside the EU or EEA. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and provider data processing terms.

15. Retention

We retain personal data only as long as necessary for the purposes described.

Contact requests
We retain contact requests for 6 months. In specific cases, we may retain certain records for longer if they are reasonably necessary to establish, exercise, or defend legal claims, to investigate abuse, or to comply with legal obligations.

Beta applications
We retain beta applications for 6 months after submission and then delete them, unless limited retention is necessary for fraud prevention or legal defense.

Newsletter
We retain newsletter data until you unsubscribe and for 6 months after unsubscribing. After that period, we delete it completely.

Access logs
30 days.

Login and device logs
30 days.

Account deletion and restore grace period
If you delete your Starpolar account, we keep account associated data for 30 days to allow account restoration. After this 30 day period, we permanently delete the remaining account data from our servers and synced Firebase storage, including subscription and entitlement information, unless limited retention is strictly necessary for legal obligations or the establishment, exercise, or defense of legal claims.

The 30 day timeline starts when we receive a verified deletion request.

Deletion in app settings
In the app settings, you can disable synchronization, delete nutrition data, and remove all app files stored through the app. These actions affect the relevant app data and synced copies, but they do not by themselves delete your Starpolar account. Complete deletion of account associated data requires account deletion.

Server-side security logs are deleted independently after 30 days, unless an exception applies for abuse investigation or legal defense.

Limited retention for legal protection and abuse prevention
In exceptional cases, we may retain a limited subset of information beyond the periods above where it is reasonably necessary to establish, exercise, or defend legal claims, to investigate fraud or abuse, or to comply with legal obligations. Where possible, we will minimize what is retained and restrict access.

16. Your Rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw consent at any time with future effect.

If you are located in Austria, your supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde).

17. Security

We use reasonable technical and organizational measures to protect personal data, including encryption in transit and access controls.

18. Contact

For privacy requests, contact hello@starpolar.app.

To withdraw consent, a short message to hello@starpolar.app is sufficient.

For deleting nutrition data, removing all app files, or disabling synchronization, use the options in the app settings.

To request account deletion, use the in-app deletion option where available. If you cannot access the app, email hello@starpolar.app from the email address linked to your account.

We may need to verify your identity before fulfilling deletion requests. If you no longer have access to the linked email address, we may require alternative proof of account ownership. If verification is not possible, we may be unable to fulfill the request.

19. Changes

We may update this Privacy Policy to reflect changes in features, providers, or legal requirements. The date at the top indicates the current version.