1. Who is responsible
Starfield Inc., a Delaware corporation, 2140 South DuPont Highway, Camden, Kent County, Delaware 19934, USA ("Starfield", "we") is the controller of the personal data described here. Contact us about privacy at support@starfield.net.
When an organization runs an event and receives participants' contact details, it uses them as its own controller, under its own privacy notice.
2. What we collect and why
| Data | Examples | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Account | Email address, name, username, profile, avatar, profile links, sign-in methods (email code, GitHub, Google) | To give you an account and run the service | Contract |
| Sign-in and security | Sign-ins, sessions, IP address, browser, failed codes, the domain of your email address | To keep accounts secure and stop abuse, such as throwaway accounts | Legitimate interests (security) |
| Agent activity | What a connected agent did for you, and which agent app connected, once per connection per day | To show you what your agents did, to secure the service, and to count how agents are used | Legitimate interests |
| Events | Signup form answers, statements you accepted, enrollment, teams | To run the events you enter | Contract |
| Team chat and files | Messages and files you share with your team | To let teams work together | Contract |
| Projects and judging | Projects, public and private answers, files, scores, prizes | To run submissions, judging, and prizes | Contract |
| Contact sharing | Your name and email, sent to an event's listed organizations | Only for events whose signup form says so; a condition of entering that event | Consent, as a condition of entering that event (Q-254) |
| Visits | One row per day you open your home page or a dashboard, kept in our own database | To see whether events keep people engaged | Legitimate interests |
| Choices | Your acceptance of the terms, your cookie choice, with their time and version | To prove what you agreed to | Legal obligation; legitimate interests |
| Analytics | Pages viewed, clicks, page speed, linked to your user ID | To improve Starfield Labs | Consent, only if you accept Analytics |
| Support | What you send to our support mailbox | To answer you | Legitimate interests |
| Staff audit log | A record of every action our staff take, which may name you | To keep staff accountable and the service secure | Legitimate interests |
We do not sell your personal data, and we do not use it to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
3. Who we share it with
We use these service providers, under contracts that limit them to processing data on our instructions:
| Provider | What it does for us | Where |
|---|---|---|
| Google Cloud | Hosting, database, file storage | Belgium (EU) |
| Cloudflare | Network edge, security, staff sign-in | Global network |
| Mailgun | Sends sign-in codes, account notices, and notifications | EU |
| ZeroBounce | Checks whether an email domain is disposable, at sign-up | EU |
| Google Cloud Vision | Screens uploaded avatars for unsafe images | EU |
| Google Web Risk | Checks links on profiles against lists of unsafe sites; it receives the link, not who added it | Outside the EU |
| PostHog | Product analytics, only if you accept Analytics; IP addresses discarded | EU |
We also share data:
- with event organizers and judges, for the events you enter;
- with other members, as you choose: your teammates see your team activity, and anyone sees what you make public;
- on our Discord server, where we post announcements and winners, which may include team names and usernames;
- with GitHub or Google, if you sign in with them, which tells them you signed in to Starfield Labs;
- with authorities, when the law requires it, or to protect people's safety or our rights;
- with a buyer or successor, if Starfield's business is sold or merged, under this notice.
4. International transfers
We keep our main data in the EU. Some providers process data in the US or elsewhere. We rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses and the UK addendum.
5. How long we keep it
| Data | Kept for |
|---|---|
| Sign-in codes | 15 minutes, or until used |
| Your account and profile | Until you delete your account |
| Agent activity entries | 90 days |
| Which agent app connected (one row per connection per day) | 13 months |
| Visit rows | 13 months |
| Signup form answers | 2 years after the event ends |
| Team chat and team files | 12 months after the event ends |
| Projects' private answers and files | 2 years after the event ends |
| A project's public fields, prizes and scores | As long as the project exists |
| Terms acceptances, accepted statements, cookie choices | 6 years after your account is deleted, linked only to an internal ID |
| Staff audit log | 6 years; free text about you is cleared when your account is deleted |
| Data export archive | 7 days after it is ready |
| Email sending logs at Mailgun | Up to 30 days; message content up to 1 day |
| Analytics at PostHog | Until you delete your account; PostHog completes deletion within 7 days |
| Backups | 7 days |
| Records that must outlive a deleted account (see section 7) | Kept with an internal ID only; a locked copy for 6 years |
6. Your rights
Depending on where you live, you have the right to access, correct, delete, or export your data, to object to or restrict our use of it, to withdraw consent at any time, and to complain to a data protection authority, such as the one where you live or work. You can do most of this yourself in your settings; for anything else, email us. We answer within one month. We will not treat you differently for using your rights.
7. Deleting your account
You can delete your account in your settings. We then erase your personal data across Starfield Labs, normally within 24 hours, and always within 30 days, and email you when it is done. After deletion:
- What you added to things others own, such as a team's project, stays, shown as by "a deleted member".
- Your team chat messages and files are erased, leaving a note that a deleted member's message was removed.
- We keep, linked only to an internal ID and with no name or email: your terms acceptances, accepted statements and cookie choices for 6 years; and a minimal record that the account existed and was deleted, with a locked copy kept for 6 years, so a backup restore cannot bring your data back.
- We keep records the law requires, for the period it requires.
- Copies already sent to an event's organizations are in their control.
8. Exporting your data
You can ask for a copy of your data in your settings. We gather it from every part of Starfield Labs into one archive, with a README that explains each file, and email you when it is ready. Only you can download it, for 7 days.
9. AI agents
When you connect an agent, the agent's provider may receive data the agent reads from Starfield Labs on your behalf. That provider handles it under its own terms and privacy notice, not ours. You can see what your agents did, and revoke them, in your settings.
10. Cookies and similar storage
We store only what Starfield Labs needs to work, unless you accept Analytics in our cookie banner. You can change your choice at any time with "Cookie settings" in the footer. Your choice lasts 6 months or until this notice changes. We honor Global Privacy Control.
| Name | Type | Category | Lifetime | Purpose |
|---|---|---|---|---|
| labs.session_token, __Secure-labs.session_token | Cookie | Necessary | The session's | Keeps you signed in |
| labs.state, __Secure-labs.state | Cookie | Necessary | 5 minutes | Finishes a GitHub or Google sign-in safely |
| labs-theme | Cookie | Necessary | 1 year | Keeps the theme you chose |
| labs-consent | Cookie | Necessary | 6 months, deleted at sign-out | Keeps your cookie choice |
| labs-cache | IndexedDB | Necessary | 24 hours, cleared at sign-out | Shows your last data when the app reopens, including offline |
| labs-pending-sign-out | Local storage | Necessary | Until the sign-out reaches us | Finishes a sign-out made offline |
| labs-network-reload | Session storage | Necessary | The tab's | Stops the offline app reloading twice |
| labs-shell-{release} | Cache storage | Necessary | Until the next release | Starts the signed-in app with no network |
| /sw.js | Service worker | Necessary | Until the browser removes it | Starts the app offline and installs new releases |
| labs-utm | Local storage | Analytics | 30 days, deleted on withdrawal and at sign-out | Remembers which campaign or site brought you |
| ph_{key}_posthog | Local storage | Analytics | Until you withdraw, deleted at sign-out | PostHog analytics |
| ph_{key}_{item} | Session storage | Analytics | The tab's, deleted on withdrawal and at sign-out | PostHog analytics in this tab |
11. Age
Starfield Labs is for people 16 or older. If we learn that someone younger has an account, we delete it.
12. Security
We protect your data with encryption in transit and at rest, access controls, sign-in without passwords, and an audit log of staff actions. See /security.
13. Changes
We post each new version here with its date, and keep earlier versions at /privacy/ followed by their version.