Privacy Policy

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Thomas Zielbauer
Hardtstr. 53
85247 Schwabhausen
Germany
Email: contact@starseen.io

No data protection officer has been appointed, as there is no legal obligation to do so (Art. 37 GDPR).

Account & profile. Email address, password (stored encrypted by Supabase Auth), username, display name, bio, profile/header image, chosen accent color. Purpose: providing your user account and public profile. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention: until account deletion.

Content. Posts you publish (text, image, gallery, video, audio, playlist), tags, comments, likes, and your chosen visibility (public/followers/buddies). Purpose: displaying your work according to your settings. Legal basis: Art. 6(1)(b) GDPR. Retention: until the content or account is deleted.

Direct messages. Content and timestamps of 1:1 messages between members. Purpose: private communication. Legal basis: Art. 6(1)(b) GDPR. Retention: read messages are automatically deleted after 80 days; unread messages until read or account deletion.

Follows & buddies. Who you follow, who follows you, and private "buddy" markers visible only to you. Purpose: feed functionality and social connections. Legal basis: Art. 6(1)(b) GDPR.

Waitlist & invites. Email address, signup timestamp, optional referrer context, invite token. Purpose: managing invite-only access. Legal basis: Art. 6(1)(b) GDPR or legitimate interest in a curated user base (Art. 6(1)(f) GDPR).

Usage statistics. Anonymous, aggregated counting of post views (24h browser debounce). For profile views and fully-listened audio tracks, an additional timestamp per (visitor, target) for one-per-month counting or spam protection (cooldown) — no history of individual accesses is stored, and it is never shown who viewed a profile or post. Purpose: statistics dashboard for authors, abuse prevention. Legal basis: Art. 6(1)(b) or (f) GDPR.

The editor's audio feature can only be used after an admin has approved your unlock request and you have actively agreed to the audio-specific additional terms.

Data processed. Timestamp of your request, the decision (approved/denied) along with the deciding admin, and the timestamp and version of your agreement to the additional terms.

Purpose. Clarifying rights before use of the audio feature — protecting against distribution of copyrighted third-party content through the platform.

Legal basis. Art. 6(1)(a) GDPR (your consent to the additional terms) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in legal certainty). You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); this results in the audio unlock being revoked.

Retention. Until your account is deleted.

Purpose. The discoverer score rewards actively exploring the network (viewing new posts, fully listening to audio) with points that form a personal rank. There is no public leaderboard and no comparison between users.

Data processed (data-minimized). We store only aggregated end states: your total point balance plus daily and monthly sums, the timestamp of the first visit to a post (for one-time point awarding), and the completion timestamp of fully-listened audio files (for the repeat cooldown). We do not store playback histories, second-by-second telemetry, or repeated access timestamps. Supporter status is a purely cosmetic feature with no effect on points or rank.

No visitor lists. It is never shown who visited a profile or viewed a post — only aggregated totals.

Legal basis. Art. 6(1)(b) GDPR (performance of a contract) — discovery is a core feature of the platform.

Retention & deletion. Data is stored until your account is deleted, at which point it is automatically deleted in full (cascade via the user reference). Daily data is continuously cleaned up automatically.

This platform is technically operated via Supabase (database, authentication, file storage, realtime features). Our Supabase project runs in the EU region of Frankfurt am Main, Germany. Processing takes place under a data processing agreement pursuant to Art. 28 GDPR.

Website delivery. The site itself is delivered via Vercel Inc. (USA). In doing so, Vercel processes the technical connection data of every request — IP address, timestamp, requested address and browser identifier — in server logs, in order to deliver the site and defend against attacks. This is based on a data processing agreement pursuant to Art. 28 GDPR; the associated transfer to the US is covered by the EU Standard Contractual Clauses under Art. 46 GDPR. Your content and account data themselves are not stored at Vercel but at Supabase in the EU.

The server functions of this application are pinned to the EU region of Frankfurt am Main, Germany — that is where the code accessing your data runs. Delivery is a separate matter: Vercel operates network nodes worldwide that accept and encrypt connections and route them to the nearest region, and the routing layer in front of the application does not run exclusively in Europe for technical reasons. Contact with a node outside the EU can therefore not be entirely ruled out; it is covered by the Standard Contractual Clauses named above.

Your data is not transmitted to advertising networks or third-party analytics/tracking services, and no marketing or tracking cookies are set. The only things stored on your device are three, and each is either technically necessary or triggered by you: a session cookie from Supabase Auth while you are signed in; a language cookie, set only if you change the language; and your light/dark preference in the browser’s local storage, likewise only after your own choice. No consent under § 25 TDDDG is required for these, which is why this site shows no cookie dialog.

View counts. How often a post has been read is counted on the server only, and only for signed-in members; the same post counts at most once per person within 24 hours. A single timestamp per person and post is stored for this and is overwritten on each count — no reading history is created. The view count itself is a plain number on the post and carries no personal reference. Nothing is stored on your device for it.

Payment processing (in preparation). For the optional Supporter program, integration of the payment processor Stripe, Inc. is planned. This integration is not yet active as of this notice — supporter status is currently granted manually by the operators, without the platform processing any payment or card data. Once the Stripe integration goes live, we will update this notice beforehand accordingly (including notes on a possible data transfer to the US based on the EU Standard Contractual Clauses under Art. 46 GDPR).

Transfers to third countries. Your content and account data are held at Supabase in the EU region of Frankfurt am Main. A transfer to a third country takes place solely as part of the technical delivery via Vercel and is covered by the EU Standard Contractual Clauses under Art. 46 GDPR; the processing server functions themselves are located in Frankfurt am Main. Beyond that, your personal data is not transferred to countries outside the EU/EEA.

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR) — e.g. your agreement to the audio additional terms
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work, or place of the alleged infringement

Many of these rights can be exercised directly in your account settings (editing, export, account/content deletion). For anything else, contact the address below.