Privacy policy

Last updated: 1 October 2026 · Effective: 1 October 2026

This policy covers the Starlaw game for iOS and Android (the “app”), the game servers behind it, and the website at playstarlaw.com.

At a glance

• You can play without giving us your name or email. A guest account is tied to an identifier for your device. Linking Apple, Google or an email address is optional.
• We store what the game needs to run: your ship and its progress, the names you give ships and planets, your chat messages, and your purchases.
• We use three analytics and crash tools: Mixpanel, Google Analytics for Firebase and Firebase Crashlytics. We use them to understand how the game is played and to fix crashes. Where the law requires your consent for analytics, they run only after you agree.
• We do not sell your data, show ads, track you across other apps, or use your device’s advertising ID.
• You can delete your account in the app at any time. That erases your account and game data right away.
• Questions or requests: hello@playstarlaw.com.

1. Who we are

Starlaw is developed and operated by Okan Demir, an individual developer. Okan Demir is the “controller” of your personal data under the EU and UK GDPR, and the “business” under US state privacy laws. In this policy, “we”, “us” and “our” mean Okan Demir.

Contact for every privacy question or request: hello@playstarlaw.com.

We have not appointed a Data Protection Officer. We are not required to, given the size and nature of our processing.

2. Information we collect

2.1 Information you give us

2.2 Information created while you play

2.3 Information collected automatically by analytics and crash tools

2.4 Server logs

Our servers record technical logs when your app connects: IP address, time, the request made, and any error. We use them to keep the service running and to stop abuse.

2.5 Information from third parties

• Apple and Google, when you sign in with them: an account ID and, if you allow it, your email address. We do not request your name or profile photo.
• Apple, Google and RevenueCat, when you buy something: confirmation that the purchase is valid, and its product and transaction details.

2.6 What we do not collect

We do not collect your name, phone number, postal address, contacts, photos, microphone or camera input, or precise (GPS) location. We do not collect the advertising identifier (IDFA on iOS, Advertising ID on Android). The app requests no sensitive device permissions.

2.7 The website

playstarlaw.com sets no cookies, runs no analytics, and loads no third-party scripts or fonts. Like any web server, our host processes your IP address to deliver the pages.

3. How we use your information, and our legal basis

The GDPR requires a legal basis for each use. Here are ours:

Legitimate interests. When we rely on legitimate interests, we have checked that our interest is not outweighed by your rights. You can object at any time (see section 10).

Is providing data required? You only need to give us what the game needs to run. If you do not link an email, Apple or Google account, you can still play as a guest. A guest account cannot be recovered if you lose the device. If you decline analytics, the game works exactly the same.

Automated decisions. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share information with

We do not sell your personal information. We share it only with the service providers below, who process it on our behalf and under contract, and only for the purposes listed.

Other players see your ship name, the planet names you assign, your ship on the map, and the chat messages you send them.

We configure Google Analytics for Firebase with ad personalization and Google signals turned off. We do not link it to any advertising product.

We may also disclose information when the law requires it, to protect players’ or others’ safety, or as part of a sale or transfer of the game. In a transfer, this policy would continue to apply to your data, or you would be notified.

5. Tracking, analytics and your choices

• No cross-app tracking. We do not link your data with data from other companies’ apps or websites for advertising, and we do not share it with data brokers. That is why the app never shows Apple’s “Allow tracking?” prompt.
• Analytics consent. In the EEA, UK and Switzerland, Mixpanel and Google Analytics for Firebase start only after you agree. You can withdraw consent at any time in the app’s settings. Withdrawing does not affect processing that happened before.
• Crash reporting helps us fix problems that affect everyone. To object to it, contact us.

6. International transfers

Our servers and database are in Germany, and Mixpanel stores our data in the EU. Google, RevenueCat and Resend may process data in the United States. For those transfers, we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission’s Standard Contractual Clauses (and the UK Addendum) otherwise. To get a copy of the safeguards, email us.

7. How long we keep it

8. Deleting your account

You can delete your account inside the app. Deletion is permanent and cannot be undone. It immediately erases your account, linked sign-in methods, sessions, ship, fleet, routes, stations, missions, level, chats and the planet names you gave. If you signed in with Apple, we also revoke the app’s access to your Apple ID.

Data kept after deletion is listed in section 7. Copies held by our analytics and crash tools expire on the schedule in section 7. To have them deleted sooner, or if you cannot open the app, email hello@playstarlaw.com from the address linked to your account, or describe your account (ship name, platform, roughly when you started playing) so we can find it.

9. Security

All traffic between the app and our servers is encrypted (TLS). Our database is not reachable from the public internet, and access is restricted to the developer. Session tokens are stored only as hashes. No system is perfectly secure. If a breach puts your data at risk, we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data (in the app, or by email);
• restrict or object to our processing, including processing based on legitimate interests;
• data portability: receive your data in a machine-readable format;
• withdraw consent at any time, where we rely on consent;
• complain to a data protection authority (see section B below).

To exercise a right, email hello@playstarlaw.com or use the in-app controls. We may need to confirm you own the account first, for example by email or from inside the app. We answer within one month (45 days for US state law requests), and we do not charge for requests. We will never treat you differently for exercising a right.

11. Children

Starlaw is not directed to children under 13, and you must be at least 13 to play. In the EEA and the UK, if you are under 16 (or a lower age set by your country), you need permission from a parent or guardian to play. We do not knowingly collect personal data from children under 13. If we learn that we have, we delete the account and its data. Parents who believe their child has given us data can email hello@playstarlaw.com.

12. Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell you in the app or by email before it takes effect. Where the law requires it, we ask for your consent again.

13. Contact

Email hello@playstarlaw.com with any question or request about your privacy. You can also use the contact form in the app.

A. Notice for US residents

This section applies to residents of California and of other US states with consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon). It is also our notice at collection.

Categories collected in the last 12 months, using California’s categories:

Retention for each category is in section 7.

Sale and sharing. We do not sell personal information, and we do not “share” it for cross-context behavioral advertising. We have not done so in the last 12 months, including for consumers under 16. Because there is nothing to opt out of, we show no “Do Not Sell or Share” link. We still treat a Global Privacy Control signal as a valid opt-out request.

Sensitive personal information. We do not collect sensitive personal information, or use it to infer characteristics about you.

Your rights. You can ask to know what we collect, use and disclose; to delete or correct it; to opt out of sale, sharing, targeted advertising or profiling (none of which we do); and not to be discriminated against for asking. Submit a request by email to hello@playstarlaw.com or with the in-app account controls. An authorized agent can submit a request for you with your written permission. We will verify the request before acting on it. If we deny your request, you can appeal by replying to our decision, and you can contact your state attorney general if the appeal is denied.

B. Notice for the EEA, UK and Switzerland

• Controller: Okan Demir, hello@playstarlaw.com.
• Legal bases for each purpose are in section 3. Transfers and safeguards are in section 6.
• Your rights are in section 10. You can also complain to the data protection authority in the country where you live or work, or where you believe an infringement happened. A list of EU authorities is at edpb.europa.eu. In the UK, it is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first.