Privacy Policy
Last updated: September 2026
Introduction
This Privacy Policy explains how STARKO collects, uses, and protects your information when you use our trivia game. We are committed to safeguarding your privacy and being transparent about our data practices.
Data We Collect
We collect the following information: your email address (for authentication via email code), the username you choose, your timezone (so the daily bonus resets at your local midnight), game progress data (stars, discovered countries, scores, streaks), purchase records (product, amount and Stripe payment reference; card details never reach our servers), referral attribution (who invited you, if you signed up through an invite link), device fingerprint information (browser, platform, language settings, screen size, timezone and CPU-core count, combined into a one-way hash used only to detect multiple accounts on one device; the hash is kept for 90 days), your IP address and browser user-agent in security and session logs (removed after 90 days), and usage analytics (pseudonymous, tied to an internal user ID and never to your email or name; only with your consent). We do not collect passwords: authentication is handled through one-time codes sent to your email.
How We Use Your Data
Your data is used to: provide and improve the game experience, maintain your account and game progress, detect and prevent cheating and abuse, send transactional emails (sign-in codes), process purchases via Stripe, credit referral rewards, and generate analytics to improve the game.
Reminder emails (optional)
We only send return reminders by email if you turn that option on in your profile; it is off by default and is never inferred from signing in, purchases, analytics consent or installing the app. We store your choice, its date, the language and the version of the wording you saw, and we log every activation and deactivation. Reminders are rare (at most one every two days, usually far fewer) and every email carries a link to stop them without signing in. We keep a record of each email sent (segment, date and delivery state, never the content) for 90 days; permanent bounces and spam complaints block future sends even if you opt in again. The consent log is kept for as long as the account exists and deleted with it. Sign-in codes are transactional emails and do not depend on this option.
Push notifications
Push reminders require your separate opt-in in Profile and permission from your browser or device. We store the push endpoint and encryption keys, account binding and consent version to send life-recharge reminders through your browser’s push service. You can disable one or all devices in Profile; browser permission is managed in device settings. Revoked keys are cleared immediately and revoked endpoints are removed during daily cleanup once pending work ends. Terminal send records are retained for 90 days; unresolved delivery errors remain until reviewed. All push data is removed when your account is deleted. Messages already accepted by the push service cannot be recalled. Push permission does not grant email or analytics consent.
Third-Party Services
We use the following third-party services: PostHog (usage analytics, only with your consent), Neon (database hosting), Upstash (Redis for game sessions and rate limiting), Cloudflare R2 (image storage and delivery), Stripe (payment processing), Resend (transactional email), Vercel (hosting and deployment), and Google AdSense for Games (H5 Games Ads), specifically rewarded video ads shown only when a player chooses to watch one to recover a life, together with Google's consent management for those ads. We do not show banner, interstitial, or display ads. Each service has its own privacy policy governing the data they process.
Cookies
STARKO uses essential cookies for: locale preference (starko_locale), authentication session management, trial-mode progress before you sign in (starko_trial, encrypted, expires after 1 hour), referral attribution when you arrive through an invite link (starko_ref, 30 days), and campaign attribution when you arrive through an ad link (starko_utm, 90 days — stores the campaign tags from the link's address; they are shared with analytics only if you accept analytics cookies). Optional cookies and storage are set only if you accept them in the cookie banner: PostHog analytics, and the cookies Google's ad SDK may set for rewarded videos. Your cookie choice and a few interface preferences are kept in your browser's local storage. We do not use tracking cookies for advertising purposes beyond what Google AdSense may set for ad personalization.
Data Retention
Your game data is retained while your account is active. Security logs are anonymised after 90 days (IP address and browser identifiers removed) and device fingerprints are deleted after 90 days. Sign-in sessions expire after 30 days. If you delete your account, your personal data will be removed within 30 days. Aggregated analytics data may be retained indefinitely.
Your Rights
You have the right to: access your personal data, request correction of inaccurate data, request deletion of your account and data, export your game data, and withdraw consent for optional data processing. To exercise these rights, contact us at privacy@starko.app.
Children
STARKO is an educational trivia game suitable for all ages. We do not knowingly collect personal information from children under 13 without parental consent. If you believe a child under 13 has provided us with personal information, please contact us so we can take appropriate action.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the game or sending an email. Continued use of STARKO after changes constitutes acceptance of the updated policy.