Who this service is for

Starlight offers games for children with accounts managed by parents or guardians aged 18 or older. The registration form requires an adult attestation and agreement to this notice. Email verification confirms control of an email address; it does not verify age or satisfy every jurisdiction’s parental-consent requirements. The operator must establish any legally required verifiable parental-consent process before launch.

Information we store

Parent accounts contain an email address, an authentication identifier, a password hash managed by Supabase Auth, consent preferences and an adult-attestation timestamp. We do not ask for children’s full names, birthdays, schools or contact details.

Child profiles contain a nickname and an avatar. Game records contain the game identifier, timestamps, tutorial status, score, completion count, learning practice count and achievement codes. Feedback stores the parent account identifier, category, message and submission date. Do not include sensitive personal information in feedback.

Why we use it and where it goes

We use these records to authenticate parents, separate family records, save game activity and respond to feedback. Supabase provides authentication and PostgreSQL storage; Vercel is the planned application host. Those providers may process technical request data such as IP addresses and security logs. The operator must document the chosen hosting regions, processor terms, lawful bases and any international-transfer safeguards before launch.

Browser storage and optional Google services

Essential cookies maintain the parent session and selected player. Guest practice is stored locally in this browser. Optional analytics and advertising default to off and require the site operator’s configuration plus a signed-in parent’s preference. Guest visitors receive no Google tracking through this implementation.

If enabled, Google Analytics receives public page paths and limited game events, such as game starts and completions. We do not intentionally send account IDs, nicknames, emails or URL query parameters. Google may still process IP addresses, browser details and cookie identifiers. Google signals and advertising personalisation are disabled.

If enabled after review, Google Ad Manager may display non-personalised, child-directed advertisements in the home-page margins. Ad providers may still process technical data and storage. Ads do not appear inside games. Parent preferences can stop future optional requests. This does not automatically erase records already held by Google.

Your controls

Parents can export their family’s records, delete an individual profile or delete the entire account. Profile deletion cascades to its game data and achievements; account deletion also removes feedback and every associated child. A current password is required for full account deletion. Contact the operator for access or deletion help if you cannot sign in.

You can clear guest progress using your browser’s site-data settings. Turning off analytics removes first-party GA cookies where the browser permits. Provider backup copies and security logs may remain under the providers’ configured retention schedules.

Retention and launch decisions

Live account and game records currently remain until the parent deletes them. Feedback remains until account deletion or operator removal. No automatic inactivity purge is configured in this first version. Before launch, the operator must adopt appropriate retention periods, configure provider logs and backups, and document how privacy requests are handled.

The legal operator identity, privacy contact, hosting locations, parental consent method, Google retention settings and applicable regional requirements must be completed and reviewed by qualified counsel. This draft is not a claim of compliance with COPPA, GDPR, the Australian Privacy Act or any other law.