Last Updated: 21 October 2026
Summary: Starby is a puzzle game available on iOS and Android. We collect minimal data, do not sell your information, and aim to respect applicable privacy laws including the GDPR, UK GDPR, CCPA and LGPD. Starby uses an anonymous account (no email/password sign-up), optional public leaderboards and competitions, optional rewarded ads, optional push notifications, and non-cash in-game coins.
Some services are shared across both platforms (Firebase account, leaderboards) and some are platform-specific (Apple Game Center and StoreKit on iOS; Google Play Billing on Android). Where something applies to only one platform, this policy says so.
The canonical STARBY pages at ostoya.games/starby/ set no cookies and use no third-party analytics or advertising script — see Section 19.
Starby is published and operated by Ostoya Interactive sp. z o.o. Ostoya Interactive sp. z o.o. is the data controller of the personal data processed directly for Starby's operation, except where Apple, Google, or another provider acts as an independent controller for its own platform services (see Section 10).
Address: ul. Świeradowska 47, 02-662 Warszawa, Poland
Contact: hello@ostoya.games
Business Registration: KRS 0001256202 · NIP 5214174125
This policy covers:
6757088810);games.ostoya.starby, initial release line 1.1.5);Starby provides materially equivalent gameplay on both platforms, but some services differ because they depend on the platform operator (Apple or Google). Where a service is platform-specific, it is labelled iOS only or Android only below.
See Section 5 for full purchase details. In short: Apple processes iOS payments and Google processes Android payments. Starby receives product, transaction, entitlement and purchase-status information needed to grant purchased content and prevent duplicate grants. Starby does not receive your full payment card or bank details from Apple or Google.
See Section 6. In short: where you are shown ads, Google AdMob and Google's User Messaging Platform (UMP) process advertising identifiers, consent status and ad-interaction/measurement data, subject to Apple App Tracking Transparency (iOS) and your consent choices.
Where enabled and consented to, Firebase Analytics processes pseudonymous usage data and, from version 1.2.1, Firebase Crashlytics processes crash and error reports — see Section 7.
If you opt in to notifications, we process a device push token and related delivery metadata — see Section 8.
See Section 9 for the technical stores (localStorage, Capacitor Preferences, UserDefaults/SharedPreferences, Firebase offline cache, and iCloud Key-Value Storage on iOS) used to keep this information on your device.
If you contact us, we process the email address and message content you send us in order to respond.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Operate your anonymous account and sync gameplay/progress | Contract Performance |
| Display leaderboard rankings and operate competitions (e.g. the Golden Tile Cup, which ended on 2 August 2026) | Contract Performance / Legitimate Interest |
| Process purchases and grant/restore entitlements | Contract Performance |
| Show personalized advertisements | Consent |
| Show non-personalized/contextual advertisements where personalized ads are not consented | Legitimate Interest |
| Operate optional analytics and crash reports (Firebase Analytics and, from version 1.2.1, Firebase Crashlytics) | Consent (EEA/UK/Switzerland; Turkey from version 1.2.1) / Legitimate Interest (elsewhere, where permitted) |
| Deliver optional push notifications | Consent |
| Respond to support requests | Contract Performance |
| Prevent fraud, cheating and abuse | Legitimate Interest |
| Meet tax, accounting and legal obligations | Legal Obligation |
We do not use consent as the legal basis for processing that is essential to providing you the game (such as your anonymous account, cloud sync, or purchase fulfilment) — that processing relies on performance of our contract with you.
Starby has run limited-time, skill-based competitions such as the Golden Tile Cup, which ended on 2 August 2026, using Starby's own Firebase-backed leaderboard infrastructure, and may run similar competitions in the future. To operate such a competition we process your event score, participation, ranking, and reward eligibility/status. Rewards are non-cash in-game coins with no real-world monetary value; no purchase is required to participate. We may delay, adjust, withhold or remove scores or rewards where we detect fraud, abuse, manipulation or technical error. See the Terms of Service for full rules.
Your chosen username, leaderboard scores, and competition standings (including past Golden Tile Cup results) may be publicly visible to other players. On iOS, your Game Center alias may also be shown where Game Center is used. Usernames must not be offensive, unlawful, impersonating, or otherwise violate our Community and Username Rules — please read that page before choosing one. We do not offer an in-app blocking or reporting tool at this time; to report an abusive username, contact support (Section 15).
Apple processes iOS purchases through the App Store using StoreKit 2. Active categories are consumable coin packs and a non-consumable "Remove Ads" purchase. Cosmetic skin products and a "Starter Pack"/welcome bonus are not currently offered; historical entitlements from either, where a device already holds them, may still be recognised. Starby receives product identifiers, verified transaction information, entitlement/restore status and consumable transaction identifiers from Apple; Starby does not receive your card or bank details.
Google processes Android purchases through Google Play Billing. The intended launch categories are consumable coin packs and a non-consumable "Remove Ads" purchase — the same categories as iOS. Skin purchases and a Starter Pack/welcome bonus are not offered on Android. Starby receives purchase and entitlement information from Google Play needed to grant products and prevent duplicate grants; Starby does not receive your card or bank details. Storefront availability, local pricing and applicable tax are presented by Google and may vary by country and account.
Coin balances and purchase journals are stored locally on your device and, where your platform supports it, in your own platform backup (Section 9). Your full platform purchase history remains controlled by Apple or Google respectively — Starby cannot access, export, or delete it.
Starby uses a neutral Welcome age screen before requesting non-essential advertising, analytics, push, or (on iOS) tracking permissions. For players who choose Under 16 or Prefer not to say, Starby sends no analytics or crash data; ads are requested with Google's child-directed treatment and a maximum content rating of G; there are no personalized ads, no App Tracking Transparency prompt (iOS), no typed public nickname (an automatically generated leaderboard name is used) and no push-notification opt-in. You can later change your age setting only toward more protection.
Apple App Tracking Transparency (ATT) controls whether Starby may ask permission to track activity across other companies' apps and websites. If you deny or restrict ATT, Starby does not access the advertising identifier (IDFA) and serves non-personalized/contextual ads where ads are available; gameplay is unaffected either way. SKAdNetwork may be used for privacy-preserving ad attribution. Google's User Messaging Platform (UMP) presents applicable privacy choices, reachable again from Settings → Privacy Preferences where your region requires it.
Android does not use Apple's ATT framework. Where available and legally permitted, Google Mobile Ads may use the Android advertising ID and Android AdServices APIs, subject to Google UMP consent choices. On Android, Starby uses rewarded ads you choose to watch and, from version 1.2.1, the interstitial ads described in Section 6.3. Starby does not use banner, native or app-open ads.
Google AdMob may process device and ad-related identifiers for ad delivery, fraud prevention, measurement, and personalization where permitted. We do not promise that every ad shown is contextual, and we do not receive Google's complete advertising profile of you — only what is necessary to serve and measure the ads shown in Starby. Personalized advertising and cross-app measurement occur only where required permissions/consent are granted. Refusing ATT (iOS) or declining optional advertising consent does not prevent basic gameplay. Rewarded advertising is always something you choose to start — it is never shown automatically. Starby also shows a full-screen interstitial ad automatically after about every fifth completed game, when you return to the Main Menu (including from the win screen) or press Restart; the next run starts only after the ad closes. No ad is shown while a run is being played, and none if you have purchased Remove Ads. Remove Ads removes only these interstitial ads; rewarded ads you choose to watch remain available.
Firebase Analytics is conditional: it is used only after applicable consent and age-gate checks pass, on both iOS and Android. We do not claim analytics is active for every session or every user. Where active, it processes pseudonymous, app-instance-level usage data for purposes such as understanding feature usage, game progression, technical stability, and aggregated/pseudonymous monetisation measurement. Starby does not use Firebase Performance Monitoring. From version 1.2.1, players aged 16 or older whose analytics is active also send crash and error reports through Firebase Crashlytics (for example: which screen was open, whether a run was active, device model, OS version, a stack trace), so we can find and fix crashes. In version 1.2.1 and later, analytics and crash reports start in the EEA, the UK, Switzerland and Turkey only if you agree; elsewhere they are on by default for players aged 16 or older and can be switched off at any time in Settings → Share usage stats. Switching them off stops collection, resets the analytics identifier and deletes unsent crash reports. They are never collected for players who chose Under 16 or Prefer not to say, and they contain no names, nicknames, e-mail addresses or advertising identifiers.
Analytics and crash data are used only to understand how Starby is played and to fix crashes. We do not sell them, do not share them with anyone except Google as our processor, and do not use them to target advertising. Firebase Analytics keeps user-level event data for up to 14 months after your last activity; according to Google's Firebase documentation, Crashlytics keeps crash stack traces and associated identifiers for 90 days before it starts removing them. Where Starby must ask for your consent (EEA, UK, Switzerland, Turkey), nothing is collected until you agree.
Push notifications are always optional and require your permission.
iOS delivery uses Apple Push Notification service (APNs), with Firebase infrastructure involved in the notification pipeline. On iOS, Starby currently does not ask for notification permission and does not offer a notification setting. If you enabled notifications in an earlier version, you can stop them in iOS Settings → Notifications → Starby.
Android delivery uses Firebase Cloud Messaging (FCM). Notifications are optional and require Android notification permission.
When you enable notifications, we store a device push token, a hashed form of that token, opt-in status, platform, and related timestamps, used to deliver gameplay, competition, update, and re-engagement notifications. We do not currently classify these as promotional marketing campaigns; if that changes, this policy will be updated. You can stop notifications at any time in your device's system settings (iOS: Settings → Notifications → Starby; Android: Settings → Apps → Starby → Notifications). Notification-token records are deleted or disabled as part of account deletion where they are Starby-controlled, and server-side notification logs are also subject to a routine cleanup cycle after a limited number of days.
Starby stores a limited set of records directly on your device:
Deletion markers are also stored locally so that a stale cached copy cannot silently restore data you asked us to delete. Some platform backup behaviour (for example, whether device backups capture app storage) is controlled by Apple or Android at the operating-system level and may not be fully controllable by Starby.
| Recipient | Role |
|---|---|
| Apple | Operates the App Store, StoreKit, Apple Game Center, iCloud Key-Value Storage, APNs, and ATT/SKAdNetwork on iOS, independently of Starby, under Apple's own terms. |
| Google / Firebase | Provides the Firebase Authentication, Firestore, Cloud Messaging and (where enabled) Analytics and, from version 1.2.1, Crashlytics infrastructure that powers Starby's cloud account, sync, leaderboards and optional notifications/analytics on both platforms. |
| Google AdMob and Google UMP | Deliver optional advertising and manage advertising/analytics consent choices on both platforms. |
| Google Play | Operates the Google Play Store and Google Play Billing for Android, independently of Starby, under Google's own terms. |
| Hosting provider for STARBY web pages | Delivers this website over HTTPS from cPanel-based hosting; see Section 19. |
| Email/support provider | Handles inbound support and privacy correspondence sent to our published addresses. |
Apple and Google independently operate their own platform accounts, stores, and certain platform services (Game Center, StoreKit, App Store, Google Play, Google Play Billing) — Starby does not control how they process data within those services. Firebase, Google AdMob and Google UMP process data to provide Starby's cloud, analytics, notification and advertising features under their own applicable terms. Starby controls its own Firebase account/game records and the public leaderboard/competition content it publishes.
Starby does not request access to precise device location, camera, microphone, contacts, Bluetooth, calendar or biometrics. On iOS, when you tap Save Image on a score or milestone card, Starby asks permission to add that one image to your Photos. This is add-only permission: Starby cannot read, list or upload your photo library. Advertising, consent, or security-related providers may still infer an approximate region from your IP address or similar network information as part of normal internet delivery and fraud prevention — this is not GPS or precise location.
Apple, Google/Firebase, and our hosting and infrastructure providers may process data outside your country of residence, including in the United States. Where this occurs from the EEA/UK, we rely on legally recognised safeguards such as adequacy decisions or standard contractual clauses/UK addenda with our processors. We do not claim to know, and this policy does not promise, the exact server location of every provider's infrastructure; where a specific detail is not verified, we describe the safeguard rather than an unverified location.
Depending on your location, you may have the following rights:
To exercise these rights, use the in-app account-deletion feature described in Section 17, or contact us at hello@ostoya.games. We will respond without undue delay and within applicable statutory timeframes.
Your rights under the UK GDPR mirror those above. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
You have equivalent access, correction, deletion, portability and third-party-sharing information rights under the Lei Geral de Proteção de Dados (LGPD).
Important: Starby uses a neutral Welcome age screen requesting an age category — Under 16, 16 or older, or Prefer not to say — not a verified date of birth, and does not independently verify age.
Players who choose Under 16 or Prefer not to say receive a restricted, child-protected experience: Starby sends no analytics or crash data; ads are requested with Google's child-directed treatment and a maximum content rating of G; there are no personalized ads, no App Tracking Transparency prompt (iOS), no typed public nickname (an automatically generated leaderboard name is used) and no push-notification opt-in. In version 1.2.1 and later you can change your age category in Settings → Age range, but only toward more protection; version 1.2.1 asks every player once more. Starby is not intentionally designed to collect unnecessary data from these users. Starby is not enrolled in Apple's Kids Category and is not part of Google Play Families; nothing in this policy should be read as claiming otherwise, and Starby is not described as directed specifically to children. We do not offer a verified parental-consent mechanism; parents/guardians with questions can contact hello@ostoya.games.
You can request deletion from inside the app. In-app deletion removes the leaderboard entries of this installation's anonymous account. Every reinstall creates a new anonymous account, so entries made before a reinstall or on another device are not removed by that button; email hello@ostoya.games with those usernames and we will remove them. Starby can delete the Starby/Firebase-controlled data described in this policy, but cannot delete your Apple ID, Google account, App Store purchase history, or Google Play purchase history — those remain controlled by Apple or Google. See the full Account & Data Deletion page for exact steps, what is deleted, what may remain, and how coins/purchases are affected.
We use technical and organizational measures appropriate to the data we process, including encryption in transit (HTTPS/TLS), secure cloud infrastructure (Firebase, and iCloud KVS on iOS), access controls, and a minimal-data-collection approach.
This section covers processing by the website, separately from the app SDK activity described above.
Your rights in Section 15 apply to website processing as well. Because the smart-link log contains no identifier, we are generally unable to link a specific log line to a particular person.
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notification. Where required by applicable law, we will request your explicit consent to the updated policy before continuing to process your personal data under the new terms.
Email: hello@ostoya.games
Address: ul. Świeradowska 47, 02-662 Warszawa, Poland
Business Registration: KRS 0001256202 · NIP 5214174125