StarMate Privacy Policy

1. Who we are and what this covers

StarMate App Inc, a Delaware corporation ("StarMate", "we", "us"), operates the StarMate mobile application for iPhone and Android (the "App") and the website at starmate.app (the "Website"; together, the "Services"). We are the controller of the personal data described in this policy. Our postal address is c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, United States, and our contact for every inquiry is support@starmate.app.

This policy applies to the App — on iPhone, where it is distributed through Apple's App Store, and on Android, where it is distributed through Google Play — and to the Website. Both versions of the App handle personal data the same way, except that three things exist only in the iPhone app — Sign in with Apple, the coarse device location used in Local mode, and usage analytics (section 3.15). Where something differs between iPhone and Android, this policy says so. It does not cover third-party websites we link to, or Apple's and Google's own services (the App Store, Sign in with Apple and push delivery on iPhone; Google Play on Android), which are governed by their own terms.

2. The short version

• You create an account with an email address (or, on iPhone, Sign in with Apple) and a verified phone number. Neither is shown to anyone.
• StarMate needs your birth date, exact birth time and birth place to build your birth profile, StarCast and Cosmic Tea. They are never shown to other users; only your age is.
• Other people see your first name, age, photos, city, an approximate area, interests, languages, prompts and — only if you turn it on — your gender identity. Who you are interested in is never shown.
• Location is coarse by design: on iPhone, your position is rounded to about a kilometre on your phone before it leaves the device, and only when you use Local mode. The Android app does not use your device's location at all.
• Photos, profile text, Plans, Communities and chat messages are screened by automated moderation, and reports are reviewed by people.
• Some text in insight features (StarCast, MATE, Cosmic Tea) is written with the help of a third-party AI language model that receives minimised, structured data — not your email, phone number or raw birth details. This happens only if you allow it; you can turn the permission off at any time in Safety & Privacy, and the features written with AI are then off for you.
• The iPhone app sends usage analytics to Amplitude — what you do in the app, such as opening Discover or joining a Plan, linked to your account, never your messages, photos or exact location — to help us improve StarMate. You can turn it off in Safety & Privacy. The Android app sends no usage analytics.
• We do not sell personal data, we do not show advertising, and the App contains no advertising SDK.
• You can delete your account in the app at any time; deletion is immediate and permanent. Usage analytics already sent are deleted when you ask us (section 3.15).

3. The data we collect, and why

For each category below we say what it is, how we get it, why we use it, whether it is required, who can see it, whether a service provider processes it, how long we keep it, and what you control. "Processors" are the providers listed in section 8.

3.1 Account and sign-in

• What: email address; phone number; if you use Sign in with Apple (iPhone only), the identifier Apple gives us, the name Apple passes on if you share it, and a token Apple issues that lets us revoke StarMate's Sign in with Apple access when you delete your account (stored encrypted); one-time sign-in codes (kept only until they expire or are used); session tokens; an app-generated device identifier (not the advertising identifier); the time of sign-in and sign-out.
• How: you enter them at sign-up; the device identifier is generated by the App.
• Why: to create and secure your account, sign you in without a password, keep bots and duplicate accounts out, recover the account and end sessions on a specific device.
• Required: yes — an email address (or, on iPhone, Apple sign-in) and a verified phone number are needed to open an account. The phone number keeps bots and duplicate accounts out and lets you recover your account, which matters on a service where people meet in person.
• Who sees it: nobody but you and StarMate. Never shown on your profile.
• Processors: our SMS provider delivers phone codes; our email provider delivers email codes; Apple operates Sign in with Apple.
• Retention: for the life of your account; deleted with it. One-time codes expire within minutes. If you use Sign in with Apple, deleting your account also asks Apple to revoke StarMate's access (see Account Deletion).
• Controls: sign out of a device (You → Account); delete your account.

3.2 Consents and age confirmation

• What: your confirmation that you are 18 or older; your acceptance of the Terms of Use, this Privacy Policy and the Community Guidelines, with the version and time of acceptance; your optional permission to send the data described in section 6 to our AI provider for the written features (the "AI permission"); your optional consent to chat personalisation for MATE; and any later withdrawal.
• Why: to meet our legal obligations and to run features that depend on your permission.
• Required: the age confirmation and the three document acceptances are required to use StarMate. The AI permission and chat personalisation for MATE are optional: StarMate works without them, and they are off unless you turn them on.
• Retention: for the life of your account. The history of changes to your privacy settings is kept in an internal audit log for the same period.
• Controls: the AI permission and chat personalisation for MATE can be given or withdrawn at any time in You → Safety & Privacy. The required acceptances can only be withdrawn by deleting your account.

3.3 Profile

• What: first name; up to six photos (at least one, with a visible face); city of residence; date of birth (see section 5); gender identity, including a self-described option, and whether it is shown; relationship intention; interests; languages; short prompt answers and a free-text "in your own words"; and, privately, who you are interested in.
• How: you enter them during onboarding and in You → Edit Profile. Photos are chosen with the system photo picker or the camera — StarMate does not access your photo library as a whole.
• Why: to show other people who you are, to run Discover, and to match romantic requests by who you are and who you are interested in.
• Required: name, city and one photo are required to appear in Discover and to create Plans. Gender identity and "Interested in" are asked only the first time you take a romantic action; Communities, social Plans and social discovery work without them.
• Who sees it: see section 4. "Interested in" is never shown to anyone. Gender identity is shown only if you switch it on, and is automatically hidden while you are travelling in a country on our identity-risk list.
• Processors: photos are stored with our object-storage provider and screened by an automated image-moderation service; profile text is checked against our moderation term list on our own servers.
• Retention: for the life of your account; photos and text are deleted with it (section 10).
• Controls: edit or remove anything in Edit Profile; "Show gender identity" and "Pause romantic Discovery" in Safety & Privacy.

3.4 Selfie verification

• What: the frames captured during a short live camera check, the head-movement telemetry the check asks for, the result of comparing your face with your profile photos (a similarity score), and your verification status and history.
• How: from your phone's front camera when you start verification in You → Verification.
• Why: to confirm that a real person is behind the profile and that the profile photos are of that person, to reduce impersonation and to protect meetings in real life.
• Required: no for browsing, Communities, social Plans and chats; yes to send a romantic request or create a Community.
• Who sees it: other users see a verified badge only. The captures are never shown to anyone.
• Processors: the face comparison is performed by Amazon Rekognition (Amazon Web Services), which compares the capture with your profile photo and returns a similarity score. StarMate does not create or store a biometric template; the comparison result is a number.
• Biometric notice. Verification compares the face in your live selfie with the face in your profile photo, to confirm that the photos on your profile show you. It is optional for social use and never starts on its own: it begins only when you tap to start it, and starting it is your consent to this comparison. We use the selfie, the frames and the result for verification only, never sell, lease or trade them, and share them only with the service providers that store them for us (Cloudflare) and perform the comparison (Amazon Web Services).
• Retention: the selfie and the frames captured during the check are deleted as soon as the check is decided, whether it passes or fails. What stays is the result, the similarity score, your verification record and, if you pass, a private copy of the profile photo you were matched with, so that the badge stays tied to that photo. They are kept while your account exists and deleted with it.
• Controls: verification is optional for social use; delete your account to remove the verification record.

3.5 Location, city and travel

• What: your city of residence (chosen from a list); on iPhone, in Local mode, one coarse location fix taken while you use Discover, rounded to about one kilometre on your phone before it is sent; in Travel mode, the destination city and dates you enter.
• How: the city is chosen by you; the coarse fix comes from iOS Location Services only if you allow "while using the app" — the Android app does not ask for location access and uses your city instead; travel details are entered by you.
• Why: to show people and Plans around you or where you are going, and to hide your gender identity in countries where showing it can be unsafe.
• Required: a city is required. Location permission is optional — you can browse a city instead.
• Who sees it: other users see your city and, when you use Local mode on iPhone, an approximate area label. Nobody ever sees your exact position, and StarMate never receives it either.
• Retention: the latest coarse position is kept only as long as needed to run Discover and is replaced by the next one; travel details expire with the trip.
• Controls: iOS Settings → StarMate → Location; "Show approximate area" in Safety & Privacy; edit or clear a trip in Discover.

3.6 Discovery, requests and Connections

• What: profiles you save (private; they are never told); your Discover filters; Connect requests you send or receive, with their context message; invitations to Plans; requests to join Plans, with their message and any question-and-answer thread; the Connections that result; Together invitations, activation, pause and end events.
• Why: to run the request, confirmation and Connection model, to enforce daily request limits, and to open chats only after something mutual.
• Who sees it: the other person in a request sees your message and your profile; nobody else. Saved profiles and filters are private.
• Retention: for the life of your account; deleted with it. Declined requests disappear from the sender's view.

3.7 Plans

• What: Plans you create — format, activity, title and description, time or window, area and exact place, visibility, capacity, rules — and Plans you request, join, confirm, leave or are removed from; invite links and their use; the private feedback you give after a Plan; the Plan's status history.
• Why: to publish and run Plans, to share the exact place only with approved participants, to expire and renew Plans, and to suggest a next step.
• Who sees it: a Plan's public details are visible according to its visibility setting (public, Community-only, invite-only). The exact place is visible only to approved participants. Post-Plan feedback is private to you — it is used to decide whether to suggest a next Plan and is never shown to anyone.
• Processors: free text is screened by our moderation term list on our servers.
• Retention: for the life of your account; Plans you created are deleted with it.

3.8 Communities

• What: Communities you create — name, description, rules, image, category, access type — your memberships and roles, join requests and their decisions, invite links, and admin actions (kept in an admin audit log).
• Who sees it: a Community's profile is visible according to its access type; members see the member list; admins see join requests.
• Retention: for the life of the Community. If you delete your account, Communities you created pass to another admin or the longest-standing member, or are deleted if you were the only member.

3.9 Chats and messages

• What: text messages and photos you send in personal, Plan, Community and Together chats; replies; read state; the Plan pinned to a chat; system messages about Plan changes; your mute state.
• Why: to deliver messages to the people in the chat, to show what has been read, and to keep group chats consistent with their Plan or Community.
• Who sees it: the members of that chat. StarMate staff can access message content only for safety reviews of a report, for legal compliance, or to fix a technical problem, under access controls and an audit trail.
• Processors: chat photos are stored with our object-storage provider and screened by the automated image-moderation service; message text is checked against our moderation term list on our servers before it posts. With both members' consent, MATE may send a conversation's recent text messages to our AI provider to word a suggestion (section 6).
• Retention: messages stay in the chat for its life. Deleting your account removes your messages everywhere and removes your personal one-to-one chats entirely.
• Controls: mute, leave, report and block from any chat; chat personalisation for MATE in Safety & Privacy.

3.10 Insight features

• What: your birth profile; Daily Opening and StarCast records (one per local day, with a short history); MATE suggestions and whether you used, edited or ignored them; Cosmic Tea readings for a pair (the shared reading, your private "Your Side", your Ask MATE questions and answers); the deterministic pair calculations behind a Tea; Together's shared StarCast.
• Why: to provide Daily Opening, StarCast, MATE, Cosmic Tea and Together. See section 5 for what is calculated and section 6 for what is written with AI.
• Who sees it: your birth profile, Daily Opening, StarCast and MATE suggestions are private to you. A Cosmic Tea's shared parts are visible to the two people in the pair; your "Your Side" and your Ask MATE answers are visible only to you and are not present in the other person's data at all.
• Retention: StarCast history is kept for 14 days on a rolling basis; the rest for the life of your account. Text written before you withdraw the AI permission stays readable. A Cosmic Tea is revoked immediately if either person blocks the other.

3.11 Reports, blocks and moderation

• What: reports you file (target, reason, details, the message reported; for a report about AI-written text, the text you saw and where in the App it appeared); reports filed about you; your block list; moderation cases, decisions, warnings, suspensions, restrictions and appeals; the audit trail of those actions; and, when an account is banned, one-way hashes of its identifiers (below).
• Why: to keep StarMate safe, to enforce the Community Guidelines, to handle appeals, and to meet legal obligations.
• Who sees it: our safety team, which reviews reported content within 24 hours. The person you report is not told who reported them; the person you block is not told.
• Retention: reports and moderation records are kept while the accounts involved exist. After you delete your account, reports you filed are kept without your account attached, and moderation actions are kept with the account reference removed, for as long as they are needed to keep enforcement consistent, enforce bans and establish or defend legal claims.
• Banned accounts: when our safety team bans an account for a serious or repeated violation, it may keep one-way hashes of the account's email address, phone number, Apple, Google or Facebook sign-in identifiers and device identifiers, each with a masked hint (for example j***@example.com), so that the same person cannot sign up again. The identifiers themselves are not stored. The hashes stay after the account is deleted, until the ban is lifted.

3.12 Notifications

• What: a push registration token for your device; your notification preferences by category (requests, Plans, messages, Together invitations, account warnings, and marketing news, which is off unless you opt in); a delivery log.
• Processors: Firebase Cloud Messaging (Google) delivers notifications, on iPhone through Apple Push Notification service. Google receives the registration token and a Firebase installation identifier for that purpose.
• Controls: You → Notifications; iOS Settings → Notifications → StarMate, or Android Settings → Apps → StarMate → Notifications.

3.13 Support and privacy requests

• What: what you send us by email, your Support ID if you include it, and our replies.
• Retention: as long as needed to handle the request and any claim related to it.

3.14 Device, security and diagnostic data

• What: server logs with the IP address, time, requested endpoint, app version and outcome of each request; rate-limit and daily-limit counters; internal audit logs (privacy-setting changes, verification attempts, AI usage recorded as token counts and timing — not the content); crash-free operation data that iOS may share with us through App Store Connect according to your iOS analytics settings; and, on Android, the crash and stability statistics (Android vitals) that Google Play may share with us through Play Console if you have turned on usage and diagnostics sharing.
• Why: to run and secure the Services, to detect abuse, to enforce limits and to diagnose problems.
• Not collected: the App includes no advertising or crash-reporting SDK (the iPhone app's usage analytics are described in section 3.15), does not use an advertising identifier (Apple's IDFA or Google's advertising ID), does not track you across other companies' apps or websites, and on iPhone does not request App Tracking Transparency permission because it does not track.
• Retention: server logs are kept only as long as they are needed to run, secure and troubleshoot the Services. Automated database backups are kept for the limited period set in our hosting configuration and then deleted automatically.

3.15 Usage analytics (iPhone)

• What: events that describe what you do in the App — for example that you signed up or finished onboarding; opened Discover, your birth chart, StarCast or a Cosmic Tea; viewed a profile, a Plan or a Community; sent a request to connect or to join a Plan; created or joined a Plan or a Community; or sent a message (only its type — text, photo, voice or sticker — never its content); and when the App is installed, updated, opened and moved to the background, and how long a session lasts. With each event: your StarMate account ID once you are signed in; a random identifier the App creates for this installation and replaces when you sign out (not Apple's advertising identifier or vendor identifier); the IP address of the request, from which Amplitude derives an approximate city, region and country; and your device model, operating system and version, language and app version. Events about a Plan carry its type and format; events about a Community carry its category and internal ID. If you share or open an invite link, the event carries a short one-way hash of the link — not the link itself — which lets us connect an invite to the account created from it. When you sign up, we record the sign-up date and method and whether you came through an invite link.
• Not collected: message text, photos, voice messages, your name, email address, phone number, birth data, precise location, payment data, or invite links themselves.
• How: the Amplitude SDK in the iPhone app sends events as they happen. Events before you sign in — installing, opening the App, starting sign-up, opening an invite link — carry only the random installation identifier, and are linked to your account once you sign in. The Android app sends no usage analytics.
• Why: to understand how StarMate is used and to improve it — which features people use, where sign-up or onboarding stops, and whether people come back. Never for advertising, never sold, and never used to track you across other companies' apps or websites.
• Required: no. Usage analytics are on unless you turn off "Share usage analytics" in You → Safety & Privacy. The setting applies to that device; once it is off, the App records nothing more (events from up to the last half-minute may still be delivered).
• Who sees it: StarMate's team, in Amplitude. Never other users.
• Processors: Amplitude, Inc. (United States).
• Retention: events are kept in Amplitude until you ask us to delete them or the Amplitude project is deleted. Deleting your account stops collection but does not delete events already sent; to have them deleted, email support@starmate.app and we will delete them through Amplitude.

3.16 Purchases

The current release of the App contains no in-app purchases and collects no purchase or entitlement data. If paid features are introduced, they will be sold through Apple's in-app purchase system on iPhone and Google Play Billing on Android; Apple or Google would process the payment, and a subscription-management service would process purchase and entitlement records so that access can be restored across your devices. We will update this policy before any such feature launches.

4. What other people can see

Hidden inputs stay hidden: a Cosmic Tea may say that two people's rhythms differ, but it never reveals something one of you entered privately.

5. Birth data and calculated insights

StarMate asks for your date of birth, your time of birth to the minute and your place of birth. From these, our own software calculates the values behind your birth profile, using the calculation method you choose in the App; daily values for StarCast; pair-level factors for Cosmic Tea; and further values derived from your birth date and name. These calculations are deterministic: the same inputs always give the same numbers, and no language model is involved in producing them.

• Your date of birth is required because StarMate is for adults only. Your time and place of birth are required for your birth profile; the App asks for the exact time and states that accuracy matters.
• These insights are personalised reflection. They are not scientific, medical or psychological assessments, they are not evidence about you or anyone else, and they are not used to make decisions with legal or similarly significant effects. Compatibility from these calculations appears only as a soft ranking signal in romantic Discover, never as a filter that hides people.
• Your birth date, time and place never leave our servers. The values calculated from them are put into words by our AI provider only with your explicit permission (section 6).
• Birth data and all calculated results are deleted with your account. Changing your birth details recalculates everything from the new values.

6. AI-assisted features

Some text in StarMate is written with the help of a third-party large language model ("AI provider"): the wording of Daily Opening and StarCast, MATE's suggestions (request messages, Plan titles, profile prompts, next-step lines, post-Plan replies), and the written parts of Cosmic Tea (Connection Signature, Quick Sip, dynamics, First Date Playbook, Timing, "Your Side", Ask MATE answers).

• Provider. Our AI provider is OpenAI (API). OpenAI may use what we send only to provide its service to us, and its data-processing terms bind it to give that data the same or equal protection as this policy (section 8). Google (Gemini API) and xAI are configured only as inactive fallbacks and receive no data while inactive. Under OpenAI's API terms, data sent through its API is not used to train OpenAI's models and is kept for up to 30 days to monitor for abuse, then deleted.
• What is sent. Structured, minimised payloads: derived calculation and dimension results (not your raw birth date, time or place); a Plan's activity, title, description, rules, format, timing, city and — where you can see it — its place; the profile text you wrote (prompts, interests, intention, languages, city); a first name where the text concerns another person (the Plan's creator when you write a request, the other person in a conversation); your own private answer about a past Plan when MATE words your reply to it; your draft text when you ask MATE to improve it; your locale; and — only when both people in a chat have switched on "Chat personalisation for MATE" — the recent text messages of that conversation.
• What is not sent. Your email, phone number, exact location, photos, verification captures, device identifiers, and any message from a chat without both members' consent.
• Safeguards. The model does not calculate scores; it writes words around numbers we computed. Every output is checked against a schema and length limits, screened by our moderation term list and a fixed list of forbidden claims, and discarded if it fails. System prompts require the model to identify as an assistant and forbid statements about what the other person secretly wants or intends, sexual instructions, predictions of marriage, pregnancy, infidelity or break-ups, and medical or therapeutic claims.
• Retention on our side. We keep the generated text as part of the feature (section 3.10) and a usage log with token counts and timing — not the prompts.
• Your permission. Nothing about you is sent to the AI provider unless you have allowed it in the App, which names the provider. The permission is optional: you can give it when you sign up or at any time later, and withdraw it at any time in You → Safety & Privacy. Our servers check it before every request to the AI provider, including the ones that run in the background, such as the daily StarCast wording. Without it, the features written with AI are off for you, and the rest of StarMate works as usual. A text that would use two people's data, such as a Cosmic Tea, is written only if both of them have given the permission. Text written before a withdrawal stays readable.
• Reporting. If AI-written text is offensive, harmful or wrong, report it from its menu in the App. The report, with the text you saw, goes to our safety team (section 3.11).
• Your choices. Chat personalisation for MATE is off unless you turn it on, and can be withdrawn at any time. MATE only suggests; nothing is sent to anyone unless you send it.

7. Purposes and legal bases

We do not use personal data for advertising, we do not sell it, and we do not use it to build profiles for any purpose other than the Services described here. We do not make automated decisions about you that produce legal or similarly significant effects. Compatibility ranking signals and moderation screening are reviewed by people where they affect your access.

8. Who we share data with

We share personal data only with service providers that process it on our instructions, with other users as described in section 4, and where the law requires. We never sell it and we never share it with data brokers or advertisers.

Each service provider in this table receives only the data listed for it and may use it only to provide its service to us. Its agreement with us, including its data-processing terms, binds it to keep that data confidential and secure and to give it the same or equal protection as this policy. Apple and Google Play handle what they receive for app distribution, Sign in with Apple, push delivery on iPhone and purchases under their own terms and privacy policies, which give it the same or equal protection.

We may also disclose data to comply with a law, regulation, legal process or lawful government request; to enforce our Terms and Community Guidelines; to protect the safety of a person; or, if StarMate App Inc is involved in a merger, acquisition or sale of assets, to the successor, who will be bound by this policy for the data transferred.

9. International transfers

StarMate App Inc is based in the United States and our providers operate in the United States and the European Union. If you use StarMate from outside the United States, your data will be transferred to and processed in the United States and in the countries where our providers operate. Where the law of your country requires a transfer mechanism (for example, for the EEA, UK and Switzerland), we rely on the standard contractual clauses in our providers' data-processing terms.

10. How long we keep data

• Account, profile, birth data, verification, discovery, Plans, chats, insight features and settings: for the life of your account, and deleted immediately when you delete it (see Account Deletion). Photos and other stored files are removed from storage at the same time; if a removal fails, it is logged for follow-up.
• StarCast history: 14 days, rolling.
• One-time sign-in codes: until used or expired (minutes). Sign-in sessions: until you sign out or they expire (refresh tokens expire after 30 days of inactivity).
• Reports you filed: kept with your account reference removed. Moderation actions: kept with the account reference removed. Deletion record: an internal identifier and date only, kept to show that the deletion happened. These records are kept as long as they are needed to keep enforcement consistent, enforce bans and establish or defend legal claims.
• Hashed identifiers of a banned account (section 3.11): until the ban is lifted, including after the account is deleted.
• Usage analytics (iPhone): kept in Amplitude until you ask us to delete them or the Amplitude project is deleted. Deleting your account does not delete them by itself — ask us and we will (section 3.15).
• Server logs: only as long as they are needed to run, secure and troubleshoot the Services. Automated database backups: for the limited period set in our hosting configuration, then deleted automatically. Both may contain your data for that time after you delete your account.
• Support correspondence: as long as needed to handle the request and any claim related to it.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk: connections between the App, the Website and our servers are encrypted in transit (HTTPS), sign-in uses one-time codes rather than passwords, session tokens are short-lived and can be revoked per device, photos are uploaded to storage through short-lived signed URLs, staff access to message content is limited to safety, legal and technical needs and is logged, and privacy-sensitive changes are recorded in an audit log. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

12. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy;
• Correct inaccurate data — most of it directly in the App;
• Delete your data — you can delete your account in the App at any time (You → Account → Delete account), or ask us;
• Portability — receive the data you provided in a structured, machine-readable format;
• Restrict or object to certain processing, including processing based on legitimate interests, such as usage analytics, which you can turn off in Safety & Privacy;
• Withdraw consent at any time where processing is based on consent (the AI permission and chat personalisation for MATE in Safety & Privacy; marketing notifications in Notifications), without affecting processing before withdrawal;
• Opt out of marketing — marketing notifications are off unless you turn them on, and we send no marketing email or SMS;
• Complain to a supervisory authority (section 14) or appeal our decision on a request (section 13).

To exercise a right that you cannot exercise in the App, email support@starmate.app from the address registered to your account. We will verify your identity — usually by confirming control of that email — and respond within the time the applicable law allows (30 days for most requests; 45 days under US state laws, extendable once). You may use an authorised agent where the law permits; we will ask for proof of authorisation. We will not discriminate against you for exercising your rights.

Some data cannot be removed on request without deleting your account (for example, data another user needs to see the Plan you both confirmed), and some may be retained after deletion as described in section 10.

13. United States state privacy rights

If you live in a U.S. state with a consumer privacy law (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or Montana), you have the rights in section 12 as your state's law provides them, including the right to know what personal data we collect and why, to get a copy, to correct it, to delete it, and to appeal a refusal. We do not sell personal data, we do not share it for cross-context behavioural or targeted advertising, and we do not use it for profiling with legal or similarly significant effects, so there is nothing to opt out of in those categories. We use sensitive personal information — sexual orientation in the form of "Interested in", gender identity if you choose to enter it, and the face comparison used for verification — only to provide the Services you ask for, and with your consent where the law requires it. This policy is our notice at collection: section 3 lists the categories of personal data we collect, why and for how long, section 7 the purposes, and section 8 who receives them.

To appeal a decision on a request, reply to our response or write to support@starmate.app with "Appeal" in the subject. If we deny your appeal, we will tell you how to contact your state attorney general.

14. EEA, UK and Swiss residents

If you are in the European Economic Area, the United Kingdom or Switzerland, StarMate App Inc is the controller of your data and the legal bases in section 7 apply. Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time. Where we process special-category data — sexual orientation ("Interested in"), gender identity you choose to enter, and the face comparison in verification — we do so with your explicit consent, which you can withdraw as described above. You have the right to lodge a complaint with your local supervisory authority; the UK authority is the Information Commissioner's Office.

15. Mobile messaging (SMS) privacy

When you provide your mobile phone number to StarMate, we may use that information to deliver account authentication, security verification, and other account-related SMS messages.

Mobile phone numbers collected for SMS messaging purposes are processed in accordance with this Privacy Policy and applicable laws.

StarMate does not sell, rent, share, transfer, or otherwise disclose mobile opt-in data, SMS consent records, or mobile phone numbers to third parties for their own marketing or promotional purposes.

Any third-party service providers used to facilitate SMS delivery act solely on our behalf and are contractually required to protect user information and use it only for the services requested by StarMate.

SMS consent is not shared with third parties for marketing purposes. See the SMS messaging program terms for message frequency, rates and how to opt out.

16. Children

StarMate is for adults 18 and older. The App refuses sign-up for anyone whose date of birth shows they are under 18, and every account confirms being 18 or older. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete the account. If you believe a minor is using StarMate, email support@starmate.app.

17. This website

starmate.app is a static website served through Cloudflare. It sets no cookies, loads no analytics, advertising or social-media scripts, and embeds no third-party content. The only thing it may store on your device is your language choice, if you make one, in your browser's local storage — an essential setting that is never sent to us. Cloudflare records standard server logs (IP address, time, requested page, browser type) to serve and protect the site. See the Cookie Policy.

18. Changes to this policy

When we change this policy in a way that matters, we will publish the new version here with a new effective date, and the App will ask you to accept the new version before you continue. Earlier versions are available on request.

19. How to contact us

All inquiries — privacy, legal, general and customer support: support@starmate.app.
Post: StarMate App Inc, c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, United States.