STARDIG Privacy Policy

1. Information We May Process

Depending on the features you use, STARDIG may process:

• Account data: when you optionally link an Apple account, the Apple account identifier, identity token, authorization code, and linking state, or when you link a Google account on Android through Google Credential Manager, the Google ID token, nonce, and linking state, plus an opaque STARDIG account ID and session data issued through Cloudflare. STARDIG does not request email or full-name scopes for Sign in with Apple. Google Credential Manager may transiently provide profile fields such as an email address, display name, or profile photo to the app during account selection, but STARDIG does not retain those fields in its account database or cloud save and does not store the raw Google ID token. The verified provider and subject are converted to a keyed HMAC identifier and linked to the opaque STARDIG account ID. If you link neither Apple nor Google, guest progress remains only on the device and no remote STARDIG account or cloud save is created.
• Game data: progress stored on the device and, if you use cloud save after linking an Apple or Google account, progress, inventory, virtual currency, formations, settings, stage results, and reward history stored through Cloudflare
• Purchase and linking data: the STARDIG iOS app may sell a one-time Remove Ads product on the App Store that permanently stops interstitial ads. The Android app sells no paid products and does not run the RevenueCat purchase-management components. Payment is processed by the Apple App Store, and STARDIG does not receive payment-method details. To confirm purchases and restore them across devices, App Store transaction receipts, transaction and product identifiers, and the Remove Ads entitlement state are processed through RevenueCat, Inc.’s purchase-management components. These components may create and send an anonymous RevenueCat App User ID when the app launches, regardless of purchase. Buying requires linking an Apple account, and when you link an Apple account on iOS, the link between the RevenueCat App User ID and your STARDIG account ID is maintained.
• Service and security data: the status and request identifiers of sign-in, session-refresh, cloud-save, account-deletion, purchase-status, and reward requests, limited security records, app version, device and operating-system details, and network error information
• Game-data delivery information: on first launch, the app shows how much data it will download, and after you confirm, STARDIG downloads cryptographically signed, non-executable game data from Cloudflare CDN/R2. More data may be downloaded later when you use new crew members, stages, or videos. Wi-Fi is recommended. Once successfully cached, the data is downloaded again only when files are missing or updated. Standard CDN/R2 request information, such as IP address, request time, requested file, and response status, may be processed during delivery.
• Advertising data: Google AdMob, the Google Mobile Ads SDK, and UMP may process ad requests, impressions, interactions, reward completion and consent state; IP address and approximate location inferred from IP; app interactions such as app launches, taps, and video views; diagnostics such as crash and performance data; Android advertising ID, App Set ID, and similar available device identifiers. This data may be used for ad delivery, personalization, frequency management, measurement, analytics, fraud prevention, and security, and may be shared with Google and the ad-technology providers shown in the consent flow, in line with the consent choices you make. App activity and advertising identifiers used for personalized ads count as behavioral information under Korean law, and you can refuse their use as described in Section 6.
• Ads shown: a rewarded ad opens only when you select the button for a 400-mineral reward on the result screen after a failed attempt. STARDIG first shows the reward and an option to skip, and if you continue, a full-screen rewarded ad opens. If you skip, neither the ad nor the reward is provided. On iOS, non-rewarded interstitial ads may appear automatically before or after result screens such as a stage clear. They never appear during combat or loading, and their spacing and daily number are limited. Buying Remove Ads stops interstitial ads. The app does not show banner ads.
• iOS advertising identifier: on iOS, STARDIG may ask through the App Tracking Transparency (ATT) prompt for permission to use the device advertising identifier (IDFA) for personalized ads and ad measurement. Declining does not affect gameplay, and you can change it in device settings at any time.
• Notifications: if you allow notifications, the app schedules and shows notifications on the device, such as daily mission and return reminders. No server push notifications are used, and you can change notification permission in device settings.
• Support data: your email address, support message, and files you choose to attach

2. How We Use Information

• Provide sign-in, account linking, cloud saves, and game progress
• Process and restore game progress, items, currency, and rewards
• Deliver cryptographically signed required game data through CDN/R2, verify cache state, and provide missing or updated files
• If paid products are introduced, validate purchases, grant entitlements, restore across devices, and reflect refund state
• Respond to support requests and verify account ownership
• Prevent abuse and security incidents
• Deliver, personalize, measure, and analyze rewarded and interstitial ads and manage how often they appear; manage consent; verify reward completion; prevent fraud; and confirm and restore Remove Ads purchases
• Comply with legal obligations and resolve disputes

Where consent is required by law, processing occurs after consent is obtained. Other processing may rely on a legitimate need to provide the service, fulfill your requests, keep the service secure and improve it, or on a legal obligation.

3. Service Providers and Sharing

STARDIG may use:

• Apple for optional Sign in with Apple and distribution through the South Korean App Store
• RevenueCat, Inc. for purchase-management components and RevenueCat compatibility and user linking; if paid products are introduced, also for receipt validation, entitlement management, and cross-device restoration and refund-state updates
• Cloudflare, Inc. for Apple and Google sign-in validation, STARDIG accounts and keyed HMACs or hashes stored instead of plaintext provider subjects and session tokens, cloud saves, transmission, security processing, and database operation of account-lifecycle and reward APIs, and storage and delivery of signed, non-executable game data through CDN/R2
• Google LLC for distribution through Google Play in South Korea, optional Google sign-in through Google Credential Manager on Android, AdMob ad delivery, personalization, measurement, analytics and fraud prevention, and UMP consent management. Ad-technology providers shown in the consent flow may also process advertising data within the choices you make

Of these, we entrust the tasks listed above to Cloudflare, Inc. and RevenueCat, Inc.; the entrusted tasks and safeguards are set out in each provider’s data processing terms. Apple and Google sign-in and distribution, and Google AdMob advertising, are processed by each provider under its own policy.

We do not sell personal information outside what is necessary to provide the service. We may provide information to the relevant authorities when required by law or court order, or when necessary to protect users or for security.

Apple Privacy PolicyRevenueCat Privacy PolicyCloudflare Privacy PolicyGoogle Privacy Policy

4. International Transfers

When you use STARDIG, personal information is transferred abroad as listed below. Transfers happen over the network when you use the related feature in the app. Each provider’s contact details are in the privacy policy links in Section 3.

• Cloudflare, Inc. (United States and countries with Cloudflare data centers): account, cloud-save and session data, sign-in validation data, and game-data request records such as IP address and request time. Used for the tasks in Section 3 and kept until the retention period in Section 5 or the processing contract ends
• RevenueCat, Inc. (United States): the anonymous RevenueCat App User ID, App Store transaction receipts, transaction and product identifiers, and entitlement state (iOS). Used to confirm and restore purchases and kept until account deletion or the processing contract ends
• Google LLC (United States): Android Google sign-in data and the advertising data in Section 1. Used for sign-in and ad delivery and measurement, and kept for the period set by Google’s policy
• Apple Inc. (United States): Sign in with Apple linking and revocation data (iOS). Used for sign-in and unlinking, and kept for the period set by Apple’s policy

If you do not want your information transferred abroad, you can play as a guest without linking an account (no cloud save) or refuse personalized ads as described in Section 6. To refuse even the minimum transfers needed to deliver game data and ads, you must stop using the app.

5. Retention and Deletion

We retain information only as long as necessary for the purposes described in this policy. When an account-deletion request is completed, account-linked progress, cloud saves, sessions, provider links, and the RevenueCat user link are deleted or de-identified.

To prevent relinking of a deleted provider account, avoid duplicate deletion, and let an offline device complete its local reset, we permanently retain a keyed-HMAC tombstone of the provider and subject, a status-token hash, and the minimal deletion receipt and provider result. These records contain no email, name, profile photo, raw provider subject, raw ID token, or game progress and are not used for restoration or advertising. Limited backup records required for legal or security reasons may remain for a separate required period.

Deleting the app from your device may not automatically delete server-side account data.

When a retention period ends or the purpose is fulfilled, information is destroyed without delay. Electronic files are deleted in a way that cannot be recovered, and information that must be kept by law is stored separately for the required period.

6. Your Choices and Rights

You may request access, correction, deletion, restriction, withdrawal of consent, or objection where applicable. Some requests may be limited by law. Send requests to the email below; we will respond within 10 days of receipt.

You can start account deletion from the in-app Account & Cloud screen. If you cannot use the app, you can start an external deletion request by email using the public STARDIG Account Deletion instructions. See that page for the detailed ownership-verification items and methods.

In the UMP flow you may choose Consent, Do not consent, or Manage options. Where applicable law requires a choice, you can reopen the privacy options from the app settings to change or withdraw consent. You can also manage iOS tracking permission and Android advertising settings in device settings. Where applicable under U.S. state privacy laws, you may use the privacy options to opt out of the sale or sharing of personal information or targeted advertising. Withdrawal does not affect processing that was lawful before withdrawal.

Deleting a STARDIG account deletes the STARDIG-side account link and game data; it does not delete your Google Account, Gmail, or data in other Google services. Data that Google or AdMob retains under its own policies, and your advertising choices, must be managed separately through your Google Account, device advertising settings, and the in-app privacy options.

STARDIG Account Deletion

7. Children and Minors

STARDIG is not directed to children under 14. Where local law requires it, minors must obtain consent from a parent or guardian. If the Operator learns that a child’s information was processed without required consent, the Operator will take steps to delete it.

8. Security

We use reasonable safeguards including HTTPS/TLS encryption in transit, access controls, non-retention of raw Google ID tokens, keyed hashing of session tokens and provider subjects, and security features provided by our service providers. No internet storage or transmission method can be guaranteed to be completely secure.

9. Changes

We may update this policy when the service or applicable law changes. Material changes will be announced in the app or on the official support page.

10. Contact

Operator: NeoLion Co., Ltd.

Privacy officer: Yewon Seo, CEO

Address: 27 Seungbang-gil, Gwanak-gu, Seoul, Republic of Korea

For privacy-related questions, contact us at the email below.

11. Remedies

For help with a privacy complaint in South Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr