Data we collect

When you create an account, we collect your display name and email address. During passkey registration and authentication, we store credential data needed to verify your passkey — we never see or store passwords. If you upload a profile picture, the image is stored in cloud storage and served through our application.

How we use your data

• Email — account verification, recovery, and deletion confirmation only. We do not send marketing emails.
• Display name — shown in the application interface.
• Passkey credentials — used solely to authenticate you. Public keys are stored; private keys never leave your device.

Session and security data

When you log in, we create a temporary session and store basic security metadata (such as your IP address and browser information) for abuse prevention. This data is automatically deleted when your session expires.

Cookies

We use a single session cookie to keep you logged in. We do not use tracking cookies or third-party cookies.

Analytics

We track anonymous, aggregate events (such as registration and login counts) for operational monitoring. No personally identifiable information is included in analytics events.

Third-party services

• Cloudflare — hosting, data storage, analytics, and transactional email delivery via Cloudflare Email Service. All data is processed on Cloudflare's global network; no third-party services receive your information.

Data retention

• Account data — retained until you delete your account.
• Sessions — automatically expire after a period of inactivity.
• Temporary tokens (verification, recovery, deletion codes) — automatically expire within minutes to hours.

Your rights

• Export — download all your data as JSON from your account settings.
• Delete — permanently delete your account and all associated data from your account settings. Deletion cascades to all passkeys and is irreversible.
• Update — change your display name or email address at any time.

Infrastructure and security

All traffic is encrypted via HTTPS. We enforce rate limiting and security policies to protect against abuse.

Changes to this policy

We may update this privacy policy as we add new features. Continued use of Starterflare after changes constitutes acceptance of the updated policy.