Last Updated: 5 September 2026
Summary: Starby is a puzzle game available on iOS and Android. We collect minimal data, do not sell your information, and aim to respect applicable privacy laws including the GDPR, UK GDPR, CCPA and LGPD. Starby uses an anonymous account (no email/password sign-up), optional public leaderboards and competitions, optional rewarded ads, optional push notifications, and non-cash in-game coins.
Some services are shared across both platforms (Firebase account, cloud sync, leaderboards) and some are platform-specific (Apple Game Center and StoreKit on iOS; Google Play Billing on Android). Where something applies to only one platform, this policy says so.
The canonical STARBY pages at ostoya.games/starby/ set no cookies and use no third-party analytics or advertising script — see Section 19.
Starby is published and operated by Ostoya Interactive sp. z o.o. Ostoya Interactive sp. z o.o. is the data controller of the personal data processed directly for Starby's operation, except where Apple, Google, or another provider acts as an independent controller for its own platform services (see Section 10).
Address: ul. Świeradowska 47, 02-662 Warszawa, Poland
Contact: hello@ostoya.games
Business Registration: KRS 0001256202 · NIP 5214174125
This policy covers:
6757088810);games.ostoya.starby, initial release line 1.1.5);Starby provides materially equivalent gameplay on both platforms, but some services differ because they depend on the platform operator (Apple or Google). Where a service is platform-specific, it is labelled iOS only or Android only below.
See Section 5 for full purchase details. In short: Apple processes iOS payments and Google processes Android payments. Starby receives product, transaction, entitlement and purchase-status information needed to grant purchased content and prevent duplicate grants. Starby does not receive your full payment card or bank details from Apple or Google.
See Section 6. In short: where you are shown ads, Google AdMob and Google's User Messaging Platform (UMP) process advertising identifiers, consent status and ad-interaction/measurement data, subject to Apple App Tracking Transparency (iOS) and your consent choices.
Where enabled and consented to, Firebase Analytics processes pseudonymous usage data — see Section 7.
If you opt in to notifications, we process a device push token and related delivery metadata — see Section 8.
See Section 9 for the technical stores (localStorage, Capacitor Preferences, UserDefaults/SharedPreferences, Firebase offline cache, and iCloud Key-Value Storage on iOS) used to keep this information on your device.
If you contact us, we process the email address and message content you send us in order to respond.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Operate your anonymous account and sync gameplay/progress | Contract Performance |
| Display leaderboard rankings and operate competitions (e.g. Golden Tile Cup) | Contract Performance / Legitimate Interest |
| Process purchases and grant/restore entitlements | Contract Performance |
| Show personalized advertisements | Consent |
| Show non-personalized/contextual advertisements where personalized ads are not consented | Legitimate Interest |
| Operate optional analytics (Firebase Analytics) | Consent (EEA/UK) / Legitimate Interest (elsewhere, where permitted) |
| Deliver optional push notifications | Consent |
| Respond to support requests | Contract Performance |
| Prevent fraud, cheating and abuse | Legitimate Interest |
| Meet tax, accounting and legal obligations | Legal Obligation |
We do not use consent as the legal basis for processing that is essential to providing you the game (such as your anonymous account, cloud sync, or purchase fulfilment) — that processing relies on performance of our contract with you.
Starby may run limited-time, skill-based competitions such as the Golden Tile Cup on both iOS and Android, using Starby's own Firebase-backed leaderboard infrastructure. To operate these we process your event score, participation, ranking, and reward eligibility/status. Rewards are non-cash in-game coins with no real-world monetary value; no purchase is required to participate. We may delay, adjust, withhold or remove scores or rewards where we detect fraud, abuse, manipulation or technical error. See the Terms of Service for full rules.
Your chosen username, leaderboard scores, and Golden Tile Cup / competition standings may be publicly visible to other players. On iOS, your Game Center alias may also be shown where Game Center is used. Usernames must not be offensive, unlawful, impersonating, or otherwise violate our Community and Username Rules — please read that page before choosing one. We do not offer an in-app blocking or reporting tool at this time; to report an abusive username, contact support (Section 15).
Apple processes iOS purchases through the App Store using StoreKit 2. Active categories are consumable coin packs and a non-consumable "Remove Ads" purchase. Cosmetic skin products and a "Starter Pack"/welcome bonus are not currently offered; historical entitlements from either, where a device already holds them, may still be recognised. Starby receives product identifiers, verified transaction information, entitlement/restore status and consumable transaction identifiers from Apple; Starby does not receive your card or bank details.
Google processes Android purchases through Google Play Billing. The intended launch categories are consumable coin packs and a non-consumable "Remove Ads" purchase — the same categories as iOS. Skin purchases and a Starter Pack/welcome bonus are not offered on Android. Starby receives purchase and entitlement information from Google Play needed to grant products and prevent duplicate grants; Starby does not receive your card or bank details. Storefront availability, local pricing and applicable tax are presented by Google and may vary by country and account.
Coin balances and purchase journals may be stored locally on your device and in Starby's cloud data so your balance stays consistent. Your full platform purchase history remains controlled by Apple or Google respectively — Starby cannot access, export, or delete it.
Starby uses a neutral Welcome age screen before requesting non-essential advertising, analytics, push, or tracking permissions. Users who choose Under 16 or Prefer not to say receive a protected experience with restricted or non-personalized advertising and no analytics.
Apple App Tracking Transparency (ATT) controls whether Starby may ask permission to track activity across other companies' apps and websites. If you deny or restrict ATT, Starby does not access the advertising identifier (IDFA) and serves non-personalized/contextual ads where ads are available; gameplay is unaffected either way. SKAdNetwork may be used for privacy-preserving ad attribution. Google's User Messaging Platform (UMP) presents applicable privacy choices, reachable again from Settings.
Android does not use Apple's ATT framework. Where available and legally permitted, Google Mobile Ads may use the Android advertising ID and Android AdServices APIs, subject to Google UMP consent choices. Rewarded advertising is the intended Android ad format at launch; this policy does not claim that Android uses banner, app-open, or non-rewarded interstitial ads unless that is separately confirmed as implemented.
Google AdMob may process device and ad-related identifiers for ad delivery, fraud prevention, measurement, and personalization where permitted. We do not promise that every ad shown is contextual, and we do not receive Google's complete advertising profile of you — only what is necessary to serve and measure the ads shown in Starby. Personalized advertising and cross-app measurement occur only where required permissions/consent are granted. Refusing ATT (iOS) or declining optional advertising consent does not prevent basic gameplay. Rewarded advertising is always something you choose to start — it is never shown automatically.
Firebase Analytics is conditional: it is used only after applicable consent and age-gate checks pass, on both iOS and Android. We do not claim analytics is active for every session or every user. Where active, it processes pseudonymous, app-instance-level usage data for purposes such as understanding feature usage, game progression, technical stability, and aggregated/pseudonymous monetisation measurement. We do not use Crashlytics or Firebase Performance Monitoring.
Push notifications are always optional and require your permission.
iOS delivery uses Apple Push Notification service (APNs), with Firebase infrastructure involved in the notification pipeline.
Android delivery uses Firebase Cloud Messaging (FCM). Production notifications are an intended launch capability for Android; they remain optional and require Android notification permission.
When you enable notifications, we store a device push token, a hashed form of that token, opt-in status, platform, and related timestamps, used to deliver gameplay, competition/Cup, update, and re-engagement notifications. We do not currently classify these as promotional marketing campaigns; if that changes, this policy will be updated. You can disable notifications at any time in Starby's Settings or in your device's system notification settings. Notification-token records are deleted or disabled as part of account deletion where they are Starby-controlled, and server-side notification logs are also subject to a routine cleanup cycle after a limited number of days.
Starby stores a limited set of records directly on your device:
Deletion markers are also stored locally so that a stale cached copy cannot silently restore data you asked us to delete. Some platform backup behaviour (for example, whether device backups capture app storage) is controlled by Apple or Android at the operating-system level and may not be fully controllable by Starby.
| Recipient | Role |
|---|---|
| Apple | Operates the App Store, StoreKit, Apple Game Center, iCloud Key-Value Storage, APNs, and ATT/SKAdNetwork on iOS, independently of Starby, under Apple's own terms. |
| Google / Firebase | Provides the Firebase Authentication, Firestore, Cloud Messaging and (where enabled) Analytics infrastructure that powers Starby's cloud account, sync, leaderboards and optional notifications/analytics on both platforms. |
| Google AdMob and Google UMP | Deliver optional advertising and manage advertising/analytics consent choices on both platforms. |
| Google Play | Operates the Google Play Store and Google Play Billing for Android, independently of Starby, under Google's own terms. |
| Hosting provider for STARBY web pages | Delivers this website over HTTPS from cPanel-based hosting; see Section 19. |
| Email/support provider | Handles inbound support and privacy correspondence sent to our published addresses. |
Apple and Google independently operate their own platform accounts, stores, and certain platform services (Game Center, StoreKit, App Store, Google Play, Google Play Billing) — Starby does not control how they process data within those services. Firebase, Google AdMob and Google UMP process data to provide Starby's cloud, analytics, notification and advertising features under their own applicable terms. Starby controls its own Firebase account/game records and the public leaderboard/competition content it publishes.
Starby does not request access to precise device location, camera, microphone, photo library, contacts, Bluetooth, calendar, or biometrics. Advertising, consent, or security-related providers may still infer an approximate region from your IP address or similar network information as part of normal internet delivery and fraud prevention — this is not GPS or precise location.
Apple, Google/Firebase, and our hosting and infrastructure providers may process data outside your country of residence, including in the United States. Where this occurs from the EEA/UK, we rely on legally recognised safeguards such as adequacy decisions or standard contractual clauses/UK addenda with our processors. We do not claim to know, and this policy does not promise, the exact server location of every provider's infrastructure; where a specific detail is not verified, we describe the safeguard rather than an unverified location.
Depending on your location, you may have the following rights:
To exercise these rights, use the in-app account-deletion feature described in Section 17, or contact us at hello@ostoya.games. We will respond without undue delay and within applicable statutory timeframes.
Your rights under the UK GDPR mirror those above. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
You have equivalent access, correction, deletion, portability and third-party-sharing information rights under the Lei Geral de Proteção de Dados (LGPD).
Important: Starby uses a neutral Welcome age screen requesting an age category — Under 16, 16 or older, or Prefer not to say — not a verified date of birth, and does not independently verify age.
Users who choose Under 16 or Prefer not to say receive a restricted, child-protected experience: no personalized ads, no analytics, no tracking prompt, and no push-notification opt-in. Starby is not intentionally designed to collect unnecessary data from these users. Starby is not enrolled in Apple's Kids Category and is not part of Google Play Families; nothing in this policy should be read as claiming otherwise, and Starby is not described as directed specifically to children. We do not offer a verified parental-consent mechanism; parents/guardians with questions can contact hello@ostoya.games.
You can request deletion from inside the app. Starby can delete the Starby/Firebase-controlled data described in this policy, but cannot delete your Apple ID, Google account, App Store purchase history, or Google Play purchase history — those remain controlled by Apple or Google. See the full Account & Data Deletion page for exact steps, what is deleted, what may remain, and how coins/purchases are affected.
We use technical and organizational measures appropriate to the data we process, including encryption in transit (HTTPS/TLS), secure cloud infrastructure (Firebase, and iCloud KVS on iOS), access controls, and a minimal-data-collection approach.
This section covers processing by the website, separately from the app SDK activity described above.
Your rights in Section 15 apply to website processing as well. Because the smart-link log contains no identifier, we are generally unable to link a specific log line to a particular person.
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notification. Where required by applicable law, we will request your explicit consent to the updated policy before continuing to process your personal data under the new terms.
Email: hello@ostoya.games
Address: ul. Świeradowska 47, 02-662 Warszawa, Poland
Business Registration: KRS 0001256202 · NIP 5214174125