Legal · Privacy Notice
Your data, and how little of it we see
We designed Starvellan to learn as little about you as we can. Accounts, Glints and progress are kept in your own browser. Our server only ever receives messages you choose to send through the contact form, along with the technical details every website needs to stay secure.
Last updated 19 October 2026
1. At a glance
- Accounts are stored only in your browser and never sent to our server, so we cannot see them.
- Guests play demo games on practice credits held in the page's memory, and nothing is saved.
- There are no cookies, adverts, analytics or trackers, and no third-party scripts, fonts or content.
- The server stores contact-form messages for up to 12 months and short-lived anti-flood counters for one hour.
- We never sell personal data. The only party that handles it for us is our hosting provider.
2. The data controller
The controller of personal data processed through starvellan.co.uk is Noti Digital Monoprosopi IKE ("we", "us"), registered in the Hellenic Republic under G.E.MI. no. 168204703000 (VAT: EL801924756), registered office: 56 Stereas Ellados Street, Nea Penteli 152 39, Greece.
Please send any question about your data to privacy@starvellan.co.uk. This notice describes how we handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
3. What your browser holds
Creating an account makes the site's code save it in your browser's local storage, on your own device. The record includes:
- your email address, player name, first name and, if you supplied it, last name;
- your date of birth and the part of the UK where you live, collected to confirm you are 18 or over and UK-resident;
- your password and recovery key, held only as PBKDF2-SHA-256 hashes;
- your Glints balance, level, experience and Club tier, rounds played per game, favourites and recently played games;
- your Observatory progress: the Compass Wheel, Star cards, Missions and the Orbit meter;
- your player care settings (time reminder and any break in progress) and your sound setting.
A few smaller entries sit alongside it: which account is signed in, a count of failed sign-in attempts, your answer to the age question and your storage choice. Each one is listed, with what it holds and how long it lasts, in our Cookie Policy.
We receive none of this. It remains on your device until you delete the account, sign out or clear this site's data, and since we never get a copy we cannot read, correct, back up or restore it.
4. When you write to us
Messages sent through the contact form are stored on our server with your name, email address, chosen topic, the message itself, and the IP address and time of sending. If you email us instead, we receive your address and whatever you write. We use these details only to read and answer you and to handle misuse of the form.
5. What the server records
Every page request reaches our server with your IP address and basic details such as the page, the time and your browser type, as with any website. We do not use them to identify you, profile you or follow you around the web.
To keep the contact form from being flooded, the server keeps a short-lived counter for each IP address that has used it. The counter stores the IP address only as a hash, with the times of recent requests, and is wiped after one hour. Our hosting provider may also keep ordinary web server logs, for a limited period, for security and fault-finding.
6. Purposes and lawful bases
| Data | Purpose | Lawful basis |
|---|---|---|
| Account data in your browser | Providing the account you asked for; it is processed only by the site's code on your device. | Contract: delivering the service you signed up for |
| Date of birth and part of the UK | Keeping the site to adults who live in the UK. | Contract, plus our legitimate interest in an adults-only site |
| Contact-form messages and emails | Reading and answering what you send. | Legitimate interests: responding to you |
| IP address and time on a message | Spotting and handling misuse of the form. | Legitimate interests: site safety |
| Rate-limit counters and server logs | Protecting the server and the form from attacks and floods. | Legitimate interests: security |
| Sound setting for guests | Remembering your sound preference, only if you accept optional storage. | Consent |
Wherever we rely on legitimate interests, we have balanced them against your rights and kept the data to a minimum. No decisions with legal or similarly significant effects are made about you by automated means.
7. Retention periods
- Contact-form messages: deleted after 12 months at the latest, or sooner if you ask and we no longer need them.
- Rate-limit counters: one hour.
- Hosting provider's web server logs: a limited period, for security only.
- Data on your device: kept until you remove it. It is under your control and we hold no copy.
9. Where data is stored
Data in your browser stays on your device. Starvellan is hosted in the United Kingdom, so contact-form messages and server records are kept on UK servers. Our company is based in Greece, so when our team views those records from there, that counts as a transfer to the European Economic Area, which UK adequacy regulations recognise as giving adequate protection. Any access from elsewhere outside the UK is allowed only with the safeguards UK GDPR requires, such as the UK International Data Transfer Agreement or Addendum. Ask us at privacy@starvellan.co.uk if you would like details.
10. Security measures
Every page is served over HTTPS. Your browser hashes passwords and recovery keys with PBKDF2-SHA-256 and a random salt before anything is stored. On the server, contact messages sit in protected files that cannot be opened from the web. You can help by locking your device, signing out on shared ones and keeping your recovery key to yourself.
11. Your rights under UK GDPR
You are entitled to:
- request a copy of the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data erased;
- restrict our use of it, or object where we rely on legitimate interests;
- receive data you provided in a portable format;
- withdraw consent at any time, where consent is our basis.
For contact messages and server records, email privacy@starvellan.co.uk. We answer within one month; complex requests may need up to two further months, and we will tell you if so and why. We may first need to confirm who you are, usually by replying to the address the message came from.
Your account data is already in your hands, so there is no need to ask us. Your account page shows your details and lets you delete the account, and clearing this site's data removes everything else. The Cookie settings link in every footer lets you change your storage choice whenever you like.
12. Raising a concern
If you are unhappy with how we have handled your data, please tell us first at privacy@starvellan.co.uk so we can try to put it right. We acknowledge complaints within 30 days and keep you informed.
You may also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, online at ico.org.uk or by phone on 0303 123 1113.
13. Under-18s
Starvellan is for adults aged 18 or over only. We do not knowingly collect data from anyone younger, and the sign-up form rejects a date of birth under 18. If you believe a child has sent us a message, tell us and we will delete it.
14. Updates to this notice
This notice will be updated if our handling of data changes, for instance if a future feature sends data to our server. The date at the top marks the current version. We will not introduce trackers or advertising without first updating this notice and our Cookie Policy and, where the law requires, asking for your consent.
