Privacy Policy

1. Data We Collect

A. Account & Authentication Data

When you create a StarFyre Account directly or via a third-party Single Sign-On (SSO) provider such as Google or GitHub, we collect only the absolute minimum information required to establish your identity:

• Email Address: Used for account uniqueness and communication.
• Basic Profile Info: Name and avatar (if provided by your SSO).
• Note: We explicitly do not request access to your repositories, drive files, or contacts during the initial account creation phase.

B. Integration Data (Opt-In Only)

If you choose to export your creations to a third-party service (e.g., a private GitHub repository or Google Drive), you will be prompted with a separate, explicit authorization request for that specific action.

• We store the resulting integration tokens (OAuth Access/Refresh tokens) securely.
• These tokens are encrypted at rest using AES-256-GCM.
• We act purely as a conduit to push your requested export. We do not read, scan, or mine your external repositories or drives.

C. Bring Your Own Key (BYOK) Data

If you supply your own API keys (e.g., OpenAI, Anthropic, Google Gemini) to power StarFyre's AI routing:

Your keys are encrypted when you save them and are never shown to you or to us again, only their last four characters. They are used only to make the AI requests you ask for.

D. Other Information We Keep

• Email: Sign-up and password-reset links are emailed through Cloudflare Email Service. Links expire after 30 minutes and work once.
• Agreement records: We keep which version of the Terms and Privacy Policy you accepted, how, and when.
• Security log: We log sign-in and account events (what happened and when) with a one-way, keyed code in place of your network address. We keep these for 180 days.
• StarFuel history: Every top-up, grant, use and refund of your StarFuel, with the app and a short reason.
• Sessions: A sign-in session lasts 24 hours unless you extend session length via your account or software settings, or sign out sooner.

2. How We Use Your Data

We use your data solely to:

• Provide, maintain, and secure your StarFyre Account and associated applications.
• Process the specific AI generation, routing, or export requests you initiate.
• Manage your StarFuel balance (our internal compute credit ledger).

What we WILL NOT do:

• We will never sell your personal data.
• We will never share StarFyre usage telemetry back to third-party OAuth providers (Google, GitHub, etc.).
• We will never train our proprietary models on your private intellectual property or manuscripts without your explicit, separate consent.

3. Data Storage & Security

We utilize Cloudflare's robust edge infrastructure (Cloudflare D1, Workers) to store and process your data.

• Encryption: Passwords (if you set one) are never stored. We store only a salted hash made with PBKDF2-SHA256. Third-party API keys and OAuth integration tokens are AES-256-GCM encrypted at rest.
• Access Control: Admin-level access is set up directly in our database, not through the website, and cannot be granted from the site. No page or tool in StarFyre shows anyone your saved keys or passwords. Admins can look up your StarFuel balance and history to help you and to correct mistakes, and each such lookup is logged.

4. Your Rights & The Right to Be Forgotten

You have full control over your data:

• Revocation: We do not currently connect to your Google or GitHub accounts beyond signing you in. If we add export to those services, you will be able to revoke access at any time from your account page, and each connection will ask for your permission first.
• Deletion: When you delete your StarFyre account, we permanently remove your sign-in methods, sessions, saved AI keys, routing settings, StarFuel history, consent records and integration tokens. Two things stay: records of software you bought (so that signing up again with the same verified email brings your purchases back), and security log entries, which no longer point to your account and are deleted after 180 days.

5. Genesis Project Data

• What is stored: When you use Genesis while signed in, your questions, your answers, the facts and notes you save, the groupings and "holes" a scan lists, and where your stars sit on the map are stored in our database (Cloudflare D1) under your StarFyre account. Only you can read your builds through Genesis. While you are not signed in, your work stays in your own browser.
• AI processing: When you ask for suggested questions, starting points, star titles or a Black Hole scan, the text needed for that request is sent through the StarFyre AI relay to an AI provider, which produces the answer. The provider is Cloudflare Workers AI, or another provider we select and list in the product, such as Anthropic or Google through Cloudflare AI Gateway. The relay does not store your text or the AI's reply. It records only counts (how much text was processed and its cost), the model used and whether the request worked, so we can keep costs within limits and fix problems. Providers process your text under their own terms.
• What is kept from the AI: Text that Genesis does not work with (graphic material, sexual content involving a minor, child sexual abuse) is withheld from the AI.
• Checks on your device: Genesis looks at what you type, on your device, to show a care note when a subject is heavy. That check is not sent anywhere and is not logged.
• Locked stars: A star locked for a topic Genesis does not allow keeps its text in your build, out of the AI and out of your export, so that you can delete it and so that support can review it if you contact us. We may preserve and report it where the law requires.
• Training: StarFyre does not use your builds to train AI models.
• Export: You can export a build as Markdown (.md) or JSON at any time.
• Deleting a build: Deleting a build inside Genesis removes it from our live database straight away. Copies kept by our database provider for backup and recovery expire on that provider's schedule.
• Deleting your account: Deleting your StarFyre account permanently deletes your Genesis builds and associated text from our live database automatically. Cost and usage records kept by the AI relay are anonymized so they can no longer be associated with you.
• After a refund: If your access to Genesis ends (for example after a full refund), Genesis keeps only the words you typed yourself, as a Markdown and a JSON file, for 90 days, so you can download them from your account. It does not keep anything the AI wrote or suggested, or any text that matches a suggestion word for word. Your builds are deleted when that file is made, and the file is deleted after 90 days.
• The free demo: Without an account, Genesis lets you try a limited demo that saves and exports nothing. To keep that demo to three free AI tries per visitor, Genesis stores a one-way hash of your network address (never the address itself) and a first-party cookie called gdemo with a random number, for up to 30 days. They are used for nothing else and are not shared. Your demo work is not stored on our servers.
• Counts, not people: Genesis keeps anonymous totals of steps per day (for example how many visits, how many purchases). A total holds a day, a step and a number, and nothing that identifies anyone: no identifier, cookie, address or referring site. Genesis does not load analytics scripts from other companies.
• Not a place for records: Genesis is a creative tool. Please do not store medical, legal, financial or other sensitive records in it. Memoir builds can contain sensitive personal information that you choose to write; it is yours, and you can delete it.

6. Contact Us

If you have any questions or concerns regarding this Privacy Policy or how your data is handled, please contact us at support@starfyresoftware.com.