Privacy Policy

This Privacy Policy describes how Super Star Interactive (“SSI”, “we”, “us”), an independent group based in the Netherlands, processes information for its website, SSI / Star ID accounts, games and Cosmic Survivors leaderboard. Our privacy contact is MitchStar at superstarinteractive@proton.me. SSI is not an incorporated company. “Privacy contact” does not mean an appointed statutory Data Protection Officer.

This notice is information about processing, not a request for blanket consent. Agreeing to our Terms does not waive your privacy rights. The legal identity and address of the person or persons acting as data controller remain to be confirmed; this notice is not yet a complete controller-identification statement.

When you register, we process your email address, username, display name, internal account identifier, account creation and last-login timestamps, and a password hash. SSI account passwords are stored using bcrypt rather than as plain-text passwords. Passwords are received temporarily to authenticate you or set a new password.

Optional profile data includes a biography, profile-picture URL and uploaded profile images. Account records also include verification, administrator and official-status flags, and two-factor-authentication settings. Registration records the date and versions of the Terms you accepted and Privacy Policy you acknowledged, together with your declaration that you are over 13 years old. New registrations do not collect age categories, dates of birth or a separate guardian-authorisation declaration. Historical age-category declarations from an earlier registration flow may remain with existing accounts until removed under the retention/deletion policy. None of these declarations is independently verified age or guardian identity.

The account form does not request a postal address, phone number, financial information, government identification or health information. Nevertheless, information you voluntarily put in names, profiles, uploads or support messages may identify you. Do not submit sensitive or unnecessary personal information.

Account security processes use session identifiers, authentication and CSRF tokens, session IP addresses, browser/device user-agent information and session creation and last-use times. Optional two-factor authentication requires a stored authenticator secret and the codes supplied for verification.

Email verification and password recovery use temporary tokens and expiry times. The service stores hashes of verification and password-reset tokens and temporary browser-verification grants; reset requests also use an email-derived hash for throttling. Pending two-factor logins and failed-login or CAPTCHA checks produce additional temporary security state. Server and application logs may record requests, network addresses, timestamps, errors and security events. These records must not be assumed to be anonymous.

We send verification, recovery and password-change messages through the configured email service. Such messages support account operation and security. They are not marketing subscriptions.

Cosmic Survivors stores a leaderboard player name, a credential hash for its separate player-login mode, the highest submitted score, a score-update timestamp and, where linked, an SSI account identifier. Its legacy player credentials use a different hashing implementation from SSI account passwords; the SSI bcrypt description should not be read as applying to every game credential.

The public leaderboard and its API expose player names, scores and calculated ranks. The API also returns the linked SSI account identifier where present. Anyone may access, copy or retain public results. Your email address and password hashes are not fields returned by that leaderboard API.

Linking associates a game entry with your SSI account; unlinking removes that association but leaves the player name and score. Changing a profile display name does not automatically rename an existing score. Contact us if you want a leaderboard entry removed. Removal from our service cannot guarantee removal of copies already made by others.

Profiles are not universally private simply because editing them requires sign-in. Profile pictures and uploaded media may be served from publicly accessible URLs. Published blog content may include author names, profile images and official-status badges.

When a page loads an image, video or other resource from an external URL, the external provider receives the request and associated network/browser information. Do not upload confidential material or assume that an unlisted media URL is access-controlled. Contact us about accidental disclosure or an unauthorised upload.

We process account and game data to provide registration, authentication, profiles, score submission and requested account linking. Where GDPR applies, processing objectively necessary to provide agreed services is based on performance of the relevant contract. Security, abuse prevention and maintaining fair services may rely on legitimate interests, subject to necessity and a balancing assessment, particularly for children. Applicable legal duties may require other processing.

Where a feature instead requires consent, it must be sought separately and may be withdrawn. The registration switch is agreement to the Terms and acknowledgement of this notice, not consent to marketing or unrelated tracking. Supplying essential registration data is necessary to create an account; optional profile fields are not required.

The account interface uses localStorage for the sign-in token and username, and sessionStorage for temporary verification state and resend/reset waiting periods. Local storage can remain on the device until sign-out, clearing, replacement or expiry handling; browser session storage is temporary to the browsing session. An authentication token may expire before its stored copy is removed.

These mechanisms are used for account functionality and security, not an advertising subscription. The existing account code is not an advertising-analytics implementation. This statement does not certify every embedded resource or future game integration as cookie-free. Any non-essential cookies or tracking requiring consent must be assessed and gated separately; the registration switch is not a cookie-consent banner.

We do not sell personal data. Providing the Services does require disclosures to service providers and, for public features, other visitors:

• Email: the currently configured Google/Gmail SMTP service processes recipient addresses and service-email content. Replies and privacy enquiries sent to our contact address are handled through Proton Mail.
• Cloudflare Turnstile: security checks involve network and browser signals and verification results. See the Turnstile Privacy Addendum.
• Google Fonts: pages request fonts from Google’s servers, disclosing request-related information. See Google’s Privacy Policy.
• Hosting and authorised administration: infrastructure services and authorised group members may access data as necessary to operate and secure the Services. Actual hosting arrangements must be documented separately.
• External content and links: providers of media you choose to load or sites you visit operate under their own notices.

Information may also be disclosed where legally required or necessary to establish or defend a legal claim. Access should be limited to the relevant purpose.

Service providers may process information outside the Netherlands or the European Economic Area. Provider names alone do not establish where every copy is processed. Where GDPR requires safeguards for an international transfer, those safeguards must be established before relying on the transfer. Our complete provider-location inventory, processing agreements and transfer arrangements have not yet been verified. Contact the privacy address for questions; this policy does not claim that all processing occurs exclusively in the Netherlands or that every transfer has already been approved.

The group has adopted the following retention schedule:

• Accounts and profiles: retained while the account exists; deletion from active account records within 30 days of a valid deletion request, unless a specific lawful exception applies.
• Leaderboard records: retained while the leaderboard operates, unless removal is requested and required or appropriate. Removing an account association is not the same as removing its score.
• Server logs: a 30-day retention limit.
• Back-ups: a maximum 90-day retention period. Deleted data may remain in restricted back-ups until they expire. A restoration must not reinstate data subject to a completed deletion request.
• Verification and recovery links: valid for 30 minutes; two-factor login challenges are shorter-lived. Expiry prevents use but is not itself proof of physical deletion of every related database record.

Implementation notice: log rotation, back-up expiry and log and back-up retention and removal of media without recorded ownership still require operational verification. These periods describe the adopted policy, not a claim that every automatic deletion mechanism is already running. Temporary expired records must be cleaned up separately. A minimal deletion receipt containing the former internal account identifier, a hashed status token, processing state and timestamps is retained for up to 90 days to handle retries, late writes and restoration review, and is then removed by the worker. It does not include the email address, password or profile. Restoring an old back-up still requires an operator procedure; the worker is not a substitute for backup expiry.

Any retention beyond these limits requires a specific legal obligation or justified legal-claims purpose, with access restricted and the exception explained where appropriate. No blanket right to retain everything indefinitely is asserted.

We use password hashing, authentication checks, temporary recovery links, CAPTCHA checks, request limits and permission checks to reduce risks. No online service or storage system can guarantee absolute security, uninterrupted access or recovery of all lost data. You should protect your own credentials and keep copies of content where appropriate.

The limitations relating to data loss in our Terms do not remove obligations under data-protection law. Suspected unauthorised access or disclosure should be reported to our privacy contact. We must assess and make any breach notifications required by applicable law.

Where GDPR applies, you may request access, correction, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. Consent, if separately given, can be withdrawn without affecting prior lawful processing. You may complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority.

Email MitchStar at superstarinteractive@proton.me. We may request proportionate evidence of account ownership; do not send a full identification document or your password unsolicited. Account closure, score removal and linked-account removal are different actions: tell us which records you want addressed. Requests must be handled within applicable legal deadlines; exceptions will be explained. Signed-in users can request irreversible account deletion under Dashboard → Security after re-entering their password and, where enabled, an authenticator code. Accepted requests revoke sessions and are processed by a resumable worker. The active account/profile records, associated authentication and declaration records, linked Cosmic Survivors entries, blog posts carrying that author ID and deterministically owned profile-picture files are removed. Previously unlinked game entries and media without recorded ownership cannot be reliably identified by this process; contact us to request review. Logs, back-ups and copies held by others are not instantly purged by this button.

Registration requires a declaration that you are over 13 years old. There is no age-category selection, date-of-birth collection or automatic parental-verification flow. If you cannot truthfully make the age declaration, do not register. A parent or guardian should contact us concerning an account created contrary to this rule. For minors, additional authorisation may be required by applicable law. Where processing for an online service relies on consent, Dutch rules may require parental authorisation for a child under 16; this is distinct from our product age declaration. We do not claim that the age declaration alone verifies parental authorisation.

We may update this notice as the Services or processing change. The version and revision date identify the text presented at registration. Material changes should be communicated appropriately; necessary separate consent must be obtained before new consent-based processing. Continued use is not deemed blanket consent to new purposes.