Privacy Policy

1. Overview

This Privacy Policy explains how Starlight (“we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use our website, chat interface, sandbox environment, and related services (collectively, the “Service”).

By using the Service, you consent to the practices described in this Privacy Policy and our Terms of Service.

2. Data We Collect

We collect the following categories of information:

• Account information: email address, display name, authentication provider, OAuth subject identifier, and an age verification flag (confirming you are 13 or older) when you sign in with Google or GitHub.
• Conversational data: messages, prompts, generated outputs, and sandbox sessions you create or run through the Service.
• Usage data: token counts, model usage, feature usage, and billing-related metrics.
• Technical data: IP address, browser type, and request timestamps for rate limiting, security, and diagnostics.

3. How We Use Your Data

We use your data to:

• Provide, operate, and improve the Service
• Authenticate you and maintain your account
• Track usage and enforce plan limits
• Process payments and billing
• Communicate with you about your account or the Service
• Prevent abuse, fraud, and security incidents

We do not use your conversations, code, or generated content to train our models. Your conversational data is stored to provide you the Service — not to improve or train the AI. You can delete your conversation history at any time.

Legal basis for processing (GDPR). We process your personal data on the following legal bases: (a) contract — to provide the Service you requested; (b) legitimate interest — to ensure security, prevent abuse, and improve the Service; (c) consent — for optional features like memory and skill matching, which you can disable at any time; and (d) legal obligation — to comply with applicable laws.

4. OAuth & Third-Party Login

You may sign in using Google or GitHub. When you do so, we receive only the information those providers share with us, typically your email address, name, and a unique account identifier. We do not receive or store your Google or GitHub password.

You can revoke Starlight's access through your Google Account permissions or GitHub OAuth application settings at any time.

5. Data Retention

We retain your account and conversation data for as long as your account is active. You can request deletion of your account and associated data by contacting us. Some data may be retained for legal or security purposes after account deletion.

Under the GDPR, you have the right to erasure ("right to be forgotten"). Under the CCPA, you have the right to request deletion of your personal information. You can exercise these rights by using the "Delete account" feature in settings or by opening a support ticket.

6. Security

We use industry-standard measures to protect your data, including encrypted connections (TLS), hashed passwords, and access controls. No method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

7. International Data Transfers

Your data is stored on servers located in the United States. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

We use the following third-party service providers (subprocessors) to operate the Service:

• Google — OAuth authentication, AI model inference (Gemini / Vertex AI);
• GitHub — OAuth authentication;
• Cloudflare — DDoS protection, CAPTCHA (Turnstile), DNS;
• Resend — transactional email delivery;
• Stripe / Paddle — payment processing and billing;
• Zhipu AI — AI model inference (GLM).

For transfers of personal data from the European Union, the United Kingdom, or the European Economic Area, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as required under applicable data protection laws. We will update this section with specific SCC references upon entity formation and formal subprocessor agreements.

8. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and protect against abuse (such as Cloudflare Turnstile for CAPTCHA and OAuth state cookies). We do not use third-party advertising cookies.

When you visit our website, a cookie consent banner will appear at the bottom of the screen informing you about our use of cookies. By clicking "Got it," you acknowledge that you have been informed about our cookie practices. You can review this policy at any time on this page.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

GDPR (EU/EEA/UK residents):

• Access — request a copy of your personal data;
• Rectification — request correction of inaccurate or incomplete data;
• Erasure — request deletion of your personal data ("right to be forgotten");
• Restriction — request that we limit processing of your data;
• Data portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on legitimate interests;
• Withdraw consent — withdraw consent for processing based on consent at any time;
• Lodge a complaint — with your local data protection authority.

CCPA (California residents):

• Right to know — request disclosure of the personal data we collect and how it is used;
• Right to delete — request deletion of your personal information;
• Right to opt-out of sale — we do not sell your personal data, and no sale of personal data occurs;
• Right to non-discrimination — we will not discriminate against you for exercising your rights.

To exercise any of these rights, open a support ticket. We will respond within 30 days.

10. Children's Privacy

The Service is not intended for children under 13. During onboarding, we ask all users to provide their date of birth to verify they are at least 13 years old. We do not store the date of birth itself — only a boolean confirming age verification. We do not knowingly collect personal data from children under 13. If you believe we have collected such data, please contact us to request deletion.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised “Last updated” date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

If you have any questions about this Privacy Policy, or to exercise your data protection rights, you can reach us at:

Starlight AI
Open a support ticket