Version: 2026-10-19.2 · published
Privacy Policy
Starherald — Open Beta
Last updated: 19 October 2026
Effective date: 19 October 2026
Summary
We collect only what is needed to run a multiplayer online game. To play Starherald you sign in with Steam. We do not see your email address, your password, or your payment details — Valve handles authentication, and we receive only the numeric ID of your Steam account. Only invited testers holding an invitation code register a test account with an email address and password; for those accounts we hold the email address and a password hash.
What we do hold is: your Steam ID, what your character does and owns in the game, your chat and in-game mail text (deleted after 30 days; kept so we can act on reports), reports and moderation records, and short-lived (30-day) server connection logs.
Chat and in-game mail text is sent to a third-party content-safety service for automated screening of prohibited content (see Section 5).
The Game is currently free with no paid content. We do not sell your data, we do not use it for advertising, and we do not use third-party advertising or analytics trackers. The Game is not licensed in, and is not operated or offered in, mainland China.
1. Who We Are
Flying Bird and Sea Network Technology Pte. Ltd., a company incorporated in Singapore (Unique Entity Number (UEN): 202646877D) with its registered address at 1 Pasir Panjang Road, #30-01, Labrador Tower, Singapore 118479 ("we," "us," "our"), operates the game Starherald (the "Game") and is the controller of your personal data.
Data Protection Officer (DPO): reachable at clientservice@starheraldgame.com. Contact this address for any privacy question or request.
Representative (GDPR Art. 27 / UK GDPR Art. 27)
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
• United Kingdom (UK)
• European Union (EU)
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/12279005210
2. What We Collect
| Data | What it is | Why we have it |
|---|
| Steam ID | The 64-bit numeric identifier of your Steam account | To identify your account, save your progress, and enforce bans |
| Internal account ID | A random identifier we generate and map to your Steam ID | To link your characters and records inside our servers |
| Steam login ticket | A one-time credential issued by Steam when you log in | To verify your identity and game ownership with Valve; discarded after verification, never stored |
| Game data | Characters, progress, items, currency, position, market orders, corporation membership, kills, trades, and other in-game actions | To run the Game and keep the world consistent for all players |
| Chat and in-game mail | What you type in chat and the body of in-game mail you send | To deliver messages, screen them automatically, and investigate abuse reports |
| Reports | Reports you submit or are involved in, the reported content, and surrounding context | To moderate the Game |
| Moderation records | Warnings, mutes, bans, and the reason for them | To enforce our rules consistently and handle appeals |
| Acceptance records | The version, language, and time of the Terms you accepted | To evidence the contract and notify you of changes by version |
| Server and connection logs | IP address, connection times, client version, error messages | Security, abuse prevention (including per-IP login rate limits), and debugging |
| Test-account email and password | Only for test accounts registered with an invitation code: email address and password hash (never the plain password) | Login and password recovery |
What we do NOT collect
• Steam credentials; the email address or password of players who sign in with Steam (test accounts registered with an invitation code are the exception — see the table above)
• Steam persona name, avatar, friends list, or game library
• Name, postal address, phone number, or government ID
• Payment or financial information (the Game currently has no purchases)
• Voice recordings (the Game has no voice chat)
• Device hardware information, installed software, or running processes (anti-cheat runs entirely on our servers)
• Precise location data
• Data from advertising networks or third-party trackers
3. Why We Are Allowed to Process It (Legal Bases)
If you are in the European Economic Area, the United Kingdom, Brazil, or another region that requires a legal basis for each purpose:
| Purpose | Legal basis |
|---|
| Running the Game and saving your progress | Performance of a contract (the Terms of Service you accepted) |
| Delivering chat and mail between players | Performance of a contract |
| Automatically screening chat and mail for prohibited content | Legitimate interests — keeping the Game safe and protecting minors; in some regions also a legal obligation |
| Investigating reports, enforcing our rules, handling appeals | Legitimate interests — keeping the Game safe for players |
| Security, preventing cheating and abuse | Legitimate interests — protecting the service and our players |
| Diagnosing faults and fixing bugs | Legitimate interests — improving a service you are using |
| Recording which version of the Terms you accepted | Performance of a contract and legal obligation |
| Complying with a legal obligation or responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and concluded that this processing is proportionate — it is limited to what is necessary to operate a safe multiplayer game. You have the right to object; see Section 7.
4. How Long We Keep It
| Data | Retention |
|---|
| Game data (characters, progress, items, market and trade records) | For as long as your account exists; deleted within 30 days of a deletion request; accounts inactive for 36 consecutive months may be deleted or anonymised after notice |
| Chat and in-game mail text | Automatically deleted after 30 days. Text that is part of an open report or is evidence for an enforcement action is kept until 90 days after the report is closed or the sanction expires |
| Reports and their context | 90 days after the report is closed |
| Moderation records (mutes, bans, and reasons) | For as long as your account exists; for permanent bans, the Steam ID is retained after account deletion so the ban can be enforced |
| Acceptance records | For as long as your account exists, and thereafter for any period required by law |
| Server and connection logs, including IP address | Automatically deleted after 30 days |
| Steam ID | For as long as your account exists, or until you ask us to delete it (subject to the permanent-ban exception above) |
| Test-account email address and password hash | For as long as the account exists; deleted within 30 days of a deletion request |
We may keep aggregated statistics that cannot identify any individual (for example, "average session length was 42 minutes").
5. Who We Share It With
We do not sell your personal data and we do not share it for advertising.
We share data only with service providers who process it on our behalf, under contract, and only for the purposes above:
| Provider | Purpose | Location |
|---|
| Cloud hosting provider | Server hosting, database, cache, load balancing, and client download distribution | Singapore |
| Content-safety service provider | Automated screening of chat and in-game mail text for prohibited content; we send the text and a message number, not your Steam ID | Singapore |
| Business email provider | Sending password-recovery code emails to test accounts registered with an invitation code only; stores no game data | Mainland China |
| Valve Corporation | Steam authentication and game ownership verification | United States |
The names of our current service providers are available on request by emailing clientservice@starheraldgame.com.
We may also disclose data where we are legally required to, where necessary to comply with a lawful request from authorities, or where necessary to establish, exercise, or defend a legal claim. If we merge with, are acquired by, or transfer our assets to another company, your data may be transferred as part of those assets; we will notify you beforehand.
Content involving the sexual exploitation of children will be reported to law enforcement and to the relevant reporting bodies.
6. International Transfers
Our servers are located in Singapore. If you play from elsewhere, your data is transferred to and processed in Singapore. Steam authentication involves sending your login ticket to Valve in the United States.
Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can request a copy of the safeguards we use by contacting clientservice@starheraldgame.com.
If you are in South Korea or Japan, local law requires us to tell you: the recipients are the service providers listed above (names available on request), the receiving countries are Singapore and the United States, and the purposes and retention periods are as described in Sections 2 and 4.
7. Your Rights
Depending on where you live, you may have the right to:
• Access — ask what personal data we hold about you and get a copy
• Rectification — ask us to correct data that is wrong
• Erasure — ask us to delete your account and your data
• Restriction — ask us to pause processing while a dispute is resolved
• Object — object to processing we base on legitimate interests
• Portability — receive your data in a machine-readable format
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Complain — lodge a complaint with your data protection authority
How to exercise them
Email clientservice@starheraldgame.com with your request and your Steam ID (or your Steam profile URL, so we can identify your data). If you are in the EU or the UK, you can also submit your request through our representative, Prighter, at https://app.prighter.com/portal/12279005210 (see Section 1).
We will respond within 30 days. We do not charge for this. We may ask you to verify that you control the Steam account in question — usually by asking you to confirm through an in-game channel while logged in with that account. Deleting your account makes your progress unrecoverable; records we must keep to enforce a ban or to comply with law are not deleted.
Where to complain
• EU — the supervisory authority in your country of residence
• UK — the Information Commissioner's Office (ico.org.uk)
• Singapore — the Personal Data Protection Commission (pdpc.gov.sg)
• South Korea — the Personal Information Protection Commission (pipc.go.kr)
• Brazil — the National Data Protection Authority (gov.br/anpd)
• Elsewhere — your local data protection authority
We would appreciate the chance to resolve your concern first, but you can go directly to a regulator.
California and other US state residents
We do not sell your personal information, we do not "share" it for cross-context behavioural advertising, and we do not use it for profiling that produces legal or similarly significant effects. The categories of personal information we collect are: identifiers (Steam ID, internal account ID, IP address) and internet activity information (in-game actions, chat and mail text, connection logs). You have the rights to know, to delete, to correct, and to non-discrimination; exercise them as described above.
8. Children
The Game is not intended for children under 13. Where your region sets a higher age for processing children's data without parental consent (for example 14 to 16 in some EEA countries, or 14 in South Korea), that higher age applies. We do not knowingly collect personal data from children below the applicable age. If you believe such a child is using the Game, contact clientservice@starheraldgame.com and we will delete the account and its data.
9. Security
We take reasonable technical and organisational measures to protect your data, including:
• Encryption of data in transit
• Access controls limiting who on our team can reach player data
• Automatic deletion of chat, mail text, and connection logs on the schedule above
• Storing no payment data; Steam players are authenticated by Steam, and test-account passwords are stored only as salted hashes
• Encrypted database backups, rotated and deleted on the same schedule as the source data
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority — within 3 calendar days under Singapore's Personal Data Protection Act, or within 72 hours under the GDPR, as applicable — and we will notify affected players where the law requires it.
10. Automated Decision-Making
• Content screening. Chat and in-game mail are screened automatically by a third-party service before publication and may be blocked. When a message is blocked, only you see the reason; you can edit and resend, or request human review. An automatic block is not a sanction and does not count against you.
• Anti-abuse limits. Login and message rate limits are applied automatically as temporary technical measures.
• Account sanctions. Mutes, suspensions, and bans are decided or reviewed by a person. You can appeal under Section 7 of the Terms of Service; appeals are handled by a person.
11. Changes to This Policy
We may update this policy. If we make a material change, we will notify you in the Game or on the Steam store page before it takes effect. The "Last updated" date at the top always reflects the current version.
12. Contact
Flying Bird and Sea Network Technology Pte. Ltd.
UEN: 202646877D
Registered address: 1 Pasir Panjang Road, #30-01, Labrador Tower, Singapore 118479
Data Protection Officer, privacy enquiries and data requests, abuse reports, general support: clientservice@starheraldgame.com
EU and UK representative (GDPR Art. 27 / UK GDPR Art. 27): Prighter Group — https://app.prighter.com/portal/12279005210
SHA-256: 6a5309a182050b0a69b1445b75cdd5fbfa3cb60e08e74cc21d8d4d16a95e9619