Privacy
Starfall Spire is a single-player game by Kayce Thomas. This page covers the web game, the iOS and Android apps, emails to our support and feedback from testing the iPhone and iPad app with TestFlight. Effective 5 October 2026. Last updated in November 2026.
What the game stores
Your progress, a Rift run you're partway through, settings, backups and any licence key are saved on your device (browser local storage, or the app's own storage). So is a note of how many optional ads you've watched there, when the game suggested the Seal or the Vault and what you answered, which updates with new things to buy with shards have reached you there (so the Vault isn't suggested as one arrives), which of the Tome's Notices you've seen and which News from the spire popups you've closed there, whether you turned on Try new things (Labs) in the Tome, and a random number for each new feature the game can turn on for some players first, which decides whether this device is one of them. The game also keeps a few notes of its own, mostly so it doesn't tell you the same thing twice: which of the Tome's Events it has already told you about, that you chose Watch ad when it explained the Arcane Boost, the last week of Star Chart tasks you've seen, the last version it asked you to update to, whether it still has to suggest cloud save after a purchase, the version of the app in which it last asked the store to show its rating sheet, and when (Ratings below), the filter you last picked for your feats, when you last saved a wizard name, so the Rift tab can say which of your runs have it, and the latest copy of the game's settings from our server (Online features below). On an iPhone or iPad, so is a parent's answer to a request to approve part of an update, and that the game asked, and when. The game never sends any of these anywhere, and the random numbers have nothing to do with your player id. A Rift run can still say whether battle tags are open on your device, which a request to your parent can rule out. There are no accounts, and the game sends none of this to a server unless you use the online features below. Of all this, play counts send the week you started playing and, if you said yes to counts, that you did. In the apps, your device's own backups can keep a copy of all of this too: an iCloud or computer backup on iPhone, and on Android your phone's backup to your Google account, as Your choices and contact says.
Once you use the online features, your device also keeps your player id, with a secret code our server made for this device, which goes with the id each time the game sends it. It keeps Rift runs it couldn't send yet, and from version 1.0.2 a made-up wizard name, until it can send them, and the names you've reported on the Rift ladder, to keep them hidden there. The game never sends its other notes for them, except in the support info you choose to email us (Emails to support): runs our server won't take, until you tap OK under them in the Rift tab; when this device last backed up, and under which player id; whether you asked for cloud save there and no backup has gone through since, or it's off there (Your cloud data); that version 1.0.2 or later has opened there, so it sends a made-up name your save holds only once; and if our server says it doesn't know your player id, since when, and the old id and its code, which the game then puts aside. In the apps, your device's own backups can keep a copy of these too.
Purchases
Purchases are optional. In the apps they go through the App Store or Google Play, and RevenueCat checks the receipts so we know which items you own. RevenueCat assigns an anonymous customer id and receives your purchase history, but not your name or payment details. On the web, purchases go through Stripe. We receive a checkout reference so we can issue your licence key, and never see your card details.
Optional ads
Ads appear only if you choose to watch one for a bonus, and never inside a Rift Trial. They are served by Google (AdMob in the apps, AdSense on the web). In the apps, right after the age question, which comes as they open, we ask for consent where the law requires it (for example in the EEA and UK), and on iOS Apple asks whether apps may track you. If the age question or the store's age range puts you under 18, you're asked neither, and your ads are never personalised (see Children). You can change your ad choices later from Ad privacy choices in the Tome, hide ad offers there, or skip ads entirely with the Archmage's Seal.
In the apps, Google's ad software collects your IP address, which gives a rough location, and device identifiers, including your advertising identifier (on iOS, only if you allow tracking). It also collects the ads you see, how you use the app and the ads (such as app launches, taps and video views), and performance and diagnostic data (such as launch time, hangs, battery use and crash logs). Within your consent choices, Google uses this data to show ads and measure them, for analytics, and to prevent fraud. Google's consent tool uses the rough location, and some performance and interaction data, to show the consent form that applies where you are. Once you've answered the age question, or when the store's age range says you're under 13, the apps can start Google's ad software, unless you have the Archmage's Seal, but no ad loads until you pick one. If you're 18 or over, they first ask Google's consent tool whether your consent is needed where you are, and if it is, they start the ad software only once you've answered its form. On iOS, they also wait for Apple's question about tracking, unless your settings turn such questions off. The form and Apple's question come straight after the age question, as the app opens. In version 1.0.1, if you chose Not now at the age question, they come at the first ad you pick, or the next time the app opens after you've answered the age question. From then on, the apps start the ad software each time they open. If the age question or the store's age range puts you under 18, they start it only when you pick an ad, never as they open. Earlier versions of the apps asked the age question, the form and Apple's question the first time you picked an ad (the age question also when you named your wizard), and started the ad software as they opened once they knew your age, under 18 too. Players under 13 get ads without the advertising identifier, and players 13 to 17 get ads that aren't personalised: see Children below.
If you're 18 or over and outside the EEA and the UK, the ads you choose can be personalised: Google can pick them from what you do in other apps and sites. Some US state laws call that targeted advertising, and may count it as selling or sharing your personal information. Where your local law lets you opt out, the Tome's settings show Ad privacy choices: tap it, then Opt out on Google's form. Google's consent tool works out from your rough location whether that law applies, once you've answered the age question. Your choice stays on that device, so make it on each phone or tablet you play on, and again if you reinstall the game. Where the law gives you no such choice, your device's own settings can still keep your advertising identifier from Google. Your privacy choices has the steps.
In the apps, once your device has a player id (from the online features below), the game may also ask our server for a one-time code just before an ad loads, and give it to Google with the ad. When you've earned the ad's bonus, Google's servers send the code back to our server, which notes that Google confirmed it. This lets us check the bonuses players get against the ads Google actually showed. Only the code goes to Google, never your player id. Our server keeps each code with your player id, which bonus it was for, when it was made and when Google confirmed it, for two days. Your bonus doesn't depend on it: the game pays it as soon as the ad ends, as before. A device without a player id isn't asked for anything new, and players under 13 never get a code.
Online features
If you back up to the cloud, link a device, or finish a weekly Rift run, the game sends data to our server (hosted by Cloudflare): a random player id, your save (for cloud backups), and for the Rift ladder your wizard name (only once you've named your wizard), your score, when you started the run, and the inputs of that run (used to check the score), and in a version of the game with battle tags, whether they're open on your device (see Children). No email or account is needed.
From the Rift week that starts on Monday 5 October 2026, our server counts your Rift tries, three a week. For each run it takes, it keeps a record of that try with your player id: the week, when you started the run (by your device's clock), a fingerprint of the run's inputs, and when the run reached it. The fingerprint is a SHA-256 hash. It tells one run from another, so a run the game sends twice counts once. It isn't the inputs themselves: our server checks the inputs and doesn't keep them.
You can report names on the ladder. A report sends our server the ladder row you reported and, once this device has a player id, that id too. Without one, the server turns the report away and the name is hidden only on your device. A report counts once the player who made it first used cloud save or the Rift at least 3 days before, or has a Rift run on the ladder that scored above 0, started after that first use and reached us at least 15 minutes after it. Our server reads when that run started from the record of its try. Three counted reports hide a name until a person on our team reviews it. When a person reviews one of your names, our server keeps that review: the name, the decision (it breaks a rule, it's fine, or it was restored on appeal), the rule it breaks, whether it counted as a strike, until when renames are locked, and when it was decided. While reports or a review hide your wizard name, lock your renames or ask for a name the game makes up, the Rift tab tells you why. The Fair Play rules say what each decision means.
A name you type shows on the Rift ladder from your next run, and your runs from earlier weeks keep the name they were sent with. From version 1.0.2, a made-up name, two words from the game's own lists like those New name picks, goes on your earlier runs too. When you save one, the game renames your runs still waiting on the device to be sent, and once this device has a player id, it sends our server the name with your player id: no age, and not why the name changed. The first time version 1.0.2 or later opens on a device, it does the same once for a made-up name that device's save already holds, so one saved in version 1.0.0 or 1.0.1 goes on your earlier runs too. Our server puts it on all your Rift runs, every week's, except runs it already has as "A Wizard". While a review has locked your renames, it puts "A Wizard" on them instead, and neither the lock ending nor an upheld appeal brings a name back to them. Your own ladder shows the change at once, and everyone else's within a minute, unless reports or a review are hiding your names. If the game can't reach our server, it keeps the name on the device and sends it later, as it does a Rift run.
The Fair Play rules also let us keep a player off the Rift ladder, for a week or for good: a ladder block. A person on our team decides each one. If we keep you off, our server keeps a record of it with your player id: when the block ends, or that it's for good, and when we set it. A new block replaces the one before. Our server turns away every Rift run you start before the block ends, on any device linked to yours, whenever the run reaches it, and the game tells you why, until when and how to appeal. The run still counts on your device. The record stays after the block ends, as How long we keep it says.
If the game hits a programming error, it tells our server which one so we can fix it: a short code the game makes from the error, the game's version, and whether it runs on iOS, Android or the web. The error's text, your player id and your save are not sent, and the server keeps only a count for each error.
Each time you open the game, it asks our server for its current settings, like maintenance times, news, whether an update is needed and which new features are on, sending the game's version but no player id. The answer also says whether you're in the EEA, the UK or elsewhere, for play counts. When you open the Rift tab, it loads this week's ladder from our server, sending the game's version and, once this device has a player id (from the features above), that id too, so the ladder can mark your row, keep names you reported hidden and tell you about your own name.
Our server uses your IP address for two things. It stops any one address sending too many requests. And for play counts, it looks up the country Cloudflare gives for the address, to work out whether you're in the EEA, the UK or elsewhere. It works this out afresh each time the game checks for settings or sends a count, and doesn't save the address, the country or the result.
Cloudflare keeps our server's log for 7 days so we can fix problems, then deletes it. Most of the game's requests leave nothing in it. Our server writes a line only when something goes wrong, when a cloud save is much larger than usual, or when Google tells us about an ad, and its scheduled jobs, like the nightly clean-up, write one when they run. A line says what happened, with our server's version: for example, the part of our server that failed and the error's message, or how many old records were cleared. What our server writes never includes your IP address, player id, wizard name or save. Cloudflare adds the time and which request a line came from, and that can include your IP address, a rough location worked out from it and your device type.
Trying new features early
Some new features are already in the game but switched off, and the settings the game downloads can switch one on for some players before everyone: for a share of devices (by the random number above), on devices where you turned on Try new things (Labs), or for testers. Your device works out which features are on for it, and doesn't tell our server.
Labs is open to everyone. To be a tester for a feature, email us and ask. Before we add you, we ask you to read this section and reply yes, and we ask the year you were born: we don't add players under 13 as testers. Your answers stay in that email conversation (see Emails to support).
If you ask to try a feature early and we add you as a tester, we make a one-way code from the player id in your support info and that feature's name, and add it to those settings. The code can't be turned back into your player id: only someone who already has your id could tell it's yours. Each feature gets a different code for you, so the lists can't show that one player tests two features. Every copy of the game gets the list of codes with its settings and keeps it until the next check, and your game makes the same code from your own player id to see whether it's on the list. Your player id isn't sent for this, and every device linked to yours gets the feature too. Apart from your emails to us (see Emails to support), we keep nothing else about you as a tester.
We take your code out when you ask, or when you ask us to delete your data. Delete my cloud data in the game doesn't reach this list, so if you were a tester, email us as well. Once it's out, each game gets the new list the next time it checks for settings. Earlier versions of the settings stay in our code's history, which isn't public, and in Cloudflare's copies of our server's past versions. We don't rewrite that history. If we ever put back a past version of our server, we take your code out of it again.
Play counts
The apps count a few things anonymously, so we can see how many people keep playing and how the optional ads, the Rift and the Shop are used. They count opening the game for the first time, playing on a given day, being offered an optional ad (once a day for each bonus), watching one, opening the Shop (once a day), and tapping a buy button. From version 1.0.2, they also count beginning a Rift run, and its end, but only once that version's update has reached you: where the law has a parent approve it, the game doesn't count your Rift runs until they have (below). The two ad counts say which bonus it was, a buy tap says which item, and a run's end says whether it was played to the end or ended early.
Each count goes to our server with the week you started playing (its Monday, not the day), the game's version, whether it's iOS or Android, and, if you said yes to counts, that you did. No player id, device id, advertising identifier, name or save goes with it. Our server keeps each count, with its bonus, item or end, the week, version and platform, and when it arrived. It keeps them in Cloudflare's Workers Analytics Engine for three months, without your IP address, your country or your answer. A stored count can't be tied to another count or to you, so we can't find yours to copy or delete. Like every request, a count is in Cloudflare's 7-day log above. The web game sends no counts.
Apart from the Rift's counts, which wait for a parent's approval where the law asks for one (above), players of every age are counted the same way. The age question plays no part, except that on an iPhone or iPad it can change when version 1.0.2's update reaches you, which the Rift's counts wait for. Where you are decides the rest:
- The EEA (the EU, Iceland, Liechtenstein and Norway): nothing is counted, and nothing is saved on your device for counting, until you say yes. From version 1.0.2, if a Rift run starts or ends in the first moments after the game opens (a run can end while the game is closed), the game may hold a note of it in memory, for counting, without saving it, until it learns which country you're in (usually a few seconds). Without your yes, it then forgets the note, unsent. The game asks (Share play counts?) a few seconds after it opens, until you answer. From version 1.0.2, it never asks before the age question. If Cloudflare can't tell which country you're in, you're asked too.
- The UK: the game counts unless you turn counts off, but never sends the two ad counts.
- Everywhere else: the game counts unless you turn counts off.
Until our server has said where you are, the game counts only if you've said yes. You can say yes or no at any time with Share anonymous play counts in the Tome.
While counts are on, your device keeps when counting began, the week it sends, and which counts it has already sent (the first-time count, and today's once-a-day counts). It also keeps your answer, if you gave one. After 390 days (just under 13 months) the game stops using all of this except your answer, and starts over as if newly installed, from that week. Turning counts off forgets it all at once, except your answer.
Your cloud data
In the apps, the Tome's Cloud save section has two buttons. Copy my cloud data gives you a copy of what our server keeps for you: your player id and any battle tag, cloud save, Rift runs, with whether each said battle tags were open, and Rift tries, when you and each linked device joined, how many name reports you made and got, the reviews of your names, any ladder block, and your ad codes of the last two days. Delete my cloud data deletes all of it from our server straight away, for every device linked to yours, your battle tag, Rift tries, name reports, reviews, ladder blocks and ad codes included. Your progress on the device and your purchases stay. Your other linked devices keep the old player id until you tap Delete my cloud data on each of them too. For a while, they still send it to our server with their cloud save requests, including the backups they make by themselves every few minutes while the game is open, and with their Rift runs, ladder loads, name reports and ad code requests, and from version 1.0.2, the made-up wizard names they save. Our server tells them it doesn't know that id. Once a day has passed since it first told a device so, the next time it does, the device stops sending the id: the game turns cloud save off there and says so. It keeps the old id aside on the device, where the game doesn't send it, until you tap the button there. The button stops it all at once. Some test versions of the apps from before their release in October 2026 don't stop by themselves.
In the apps, Delete my cloud data also has RevenueCat delete its record of your purchases. When it does, the game's confirmation says so first, and its message after says it's done. For that, the apps send your RevenueCat id with the deletion. We use it only for that and don't keep it. The app then gets a new RevenueCat id, and what it sends RevenueCat later goes under that one. Your purchases stay with your App Store or Google Play account: Restore purchases brings them back, and sends them to RevenueCat under the new id. A backup of your device from before the deletion still holds the old id, though. Restoring your device from it, or on Android reinstalling the game before your phone next backs the game up, brings the old id back, and what the app sends RevenueCat after that goes under it again. One of the earlier versions of the apps, an Android test build from September 2026, says RevenueCat's record went only in its message after, not in its confirmation, and keeps the old id: what it sends RevenueCat later starts a new record under it. If the game says to email us about your purchase history at RevenueCat instead, as it does when our server had already deleted your cloud data, we'll have it deleted.
You can also email us to copy or delete your data, and we do it within a month. A copy by email also has any run we took off the Rift ladder, and any run of yours on a list from a ladder we cleared, that we still keep. When you email us to delete your data, we have RevenueCat delete its record of your purchases too, under the RevenueCat id in the support info you send, unless you ask us to keep it. A phone or tablet usually has its own RevenueCat id, so send the support info from each one you play on. The device keeps that id, so if you play on, what the app sends RevenueCat later starts a new record under it, and Restore purchases brings your purchases back into the game.
How long we keep it
Apart from play counts, link codes, ad codes and players who stop playing, nothing on our server expires by itself. If 24 months pass with no cloud backup and no Rift run from any of your devices, we delete your player id and everything our server holds for it, as Delete my cloud data does, and your progress on your devices stays. Your cloud save stays until a newer backup replaces it or you delete it. Rift runs, Rift tries, your battle tag and the reviews of your names stay until you delete your data, except for a run we take off the ladder, or a week's runs if we clear its whole ladder, with its tries too while the week is still open (see below). A name report stays until you or the other player deletes their data, even after a person has reviewed the name: it no longer counts against the name, but it's kept so the player who made it still doesn't see the wizard they reported. A ladder block stays after it ends, as our record that it happened, since the Fair Play rules weigh how often something happens: until we lift it, as we do when an appeal succeeds, or until you delete your data. A link code works once, within 10 minutes. We keep only your newest three, so making a fourth deletes the oldest. A used code is deleted at once, and an unused one within a day of expiring. An ad code is kept for two days, whether Google confirmed it or not, then deleted as new codes are made; if we stop using codes, we delete the last ones ourselves. Error counts hold nothing about you. Play counts hold no player id or IP address, and Cloudflare deletes them after three months.
Deleting takes your data off our server at once. Copies stay in our backups (a nightly copy of the database, and Cloudflare's 30-day history of it) until they expire, about 30 days later, and in any copy we made to fix a problem, until that copy goes as below. We use the backups only to repair the database, and if we ever restore one, we delete your data from it again. To make sure a restore can't bring your data back, we keep a scrambled form of your player id for 32 days after you delete, and use it only for that.
Each Rift week, we check its top 25 runs for any played by a tool rather than by hand, which the Fair Play rules don't allow. Our daily checks read those runs from our server on GitHub: for each one, its wizard name, week, score, place and ladder id, when it reached our server, when its player first used cloud save or the Rift, and that player's scores in earlier weeks, but not the player id. GitHub keeps them for a day, encrypted so that only our own computer can open them, which is where we check them.
If we take one of your runs off the Rift ladder under the Fair Play rules, we keep a copy on our own computer in case you appeal. It holds your player id, the run's week, name, score and ladder id, when it reached our server and when we took it off, and our notes on why: its place that week, how its score compares with a steady run of that week and with your earlier weeks, and when you first used cloud save or the Rift. We delete the copy within a week of it turning 30 days old, or once we've answered your appeal, if that's later. If you delete your data before then, we delete the copy within a week.
When something goes wrong with our server or the Rift ladder, we may make copies of players' data while we put it right:
- Before we repair the database, we save a copy of all of it on our computer, as it is at that moment. While we repair it, we may save parts of it there too, or load one of its nightly copies into a separate database at Cloudflare to take rows from. If it can't be repaired, we may move the game to a new database restored from a nightly copy, and the old database is then one of these copies. We delete these copies when we close the incident, and never keep one more than 30 days: the old database counts from the day we move the game off it. A deletion made meanwhile doesn't reach them, but they go then too. Once a month we also check that a nightly copy restores: we load it on our computer and into a scratch database at Cloudflare, and delete both when the check is done.
- If we ever have to clear a week's Rift ladder, because its scores were counted wrong or cheating spoiled it, we first save a list of that week's runs: for each, the player id, the week, the wizard name, the score, the ladder id and when it reached our server. We keep it to answer players' questions about that week, and in case we decide to give its players something for the trouble. We delete the list within 30 days of clearing the ladder. If you email us to delete your data before then, we take your run out of it when we delete the rest. Delete my cloud data in the game doesn't reach it straight away, but we take your run out before we use the list for anything, and it goes within those 30 days anyway.
The copies on our computer, and the removed runs above, stay in one folder there. It isn't synced anywhere, and it's left out of the computer's backups, so no backup keeps them longer than we say here. The folder can also hold a copy of your data or your cloud save that we're about to email you, which we delete once it's sent, and, while we're deleting your data at your request, a note of your player id, until the deletion is done.
When you ask us to copy or delete your data, we keep a record of the request in Notion for 24 months, to show we answered it: the day it came, what you asked for and how, when we first replied and when it was done, how it ended, and for an email, the number of its support thread. The record holds no name, email address or id. We keep the same record when we delete the emails of someone who told us they're under 13 (Children). Copies and deletions made with the game's buttons are only counted, a number for each day.
Cloudflare also keeps, for 31 days, the text of the commands our database runs, with how often and how fast they ran, so we can find slow ones. It keeps a command's text but not the values sent alongside it, and our server always sends what it knows about you alongside, so the commands the game's own requests make, Delete my cloud data's included, never name you. Commands we type by hand can name you. When one of us looks you up, changes something or deletes your data, for example to answer your email, review a reported name or keep the Rift ladder fair, the command can name your player id, the ladder id of one of your runs, a code you made to link a device, your wizard name or your battle tag, and can hold what we changed, such as a run we put back on the ladder. So after we delete your data at your request, Cloudflare's record of the commands that did it can still hold your player id for up to 31 days.
Emails to support
When you email support@starfallspire.com, Cloudflare passes it on to Zoho Desk without keeping the message itself, though it keeps a record of the sender, recipient and subject line for 31 days. Zoho Desk, from Zoho Corporation, is the help desk where we read and answer support email, and it keeps the conversation for us as our service provider: your name and email address, what you write, any attachments such as screenshots or receipts, and our replies, including a copy of your data if you asked for one. Zoho Desk emails us a notice only when one of us mentions another in a comment on your conversation. The notice has Zoho Desk's number for the conversation, its subject, which is usually your email's subject line, and our comment, but never the emails themselves. It sits in our own mailbox, with our email provider, until we delete it with the conversation.
If you add your support info from the game, your email also has your player id (and any old one your device set aside, with the day it did so), your RevenueCat id, the game's version and how it takes purchases, your device and its screen size, the purchases and any gifts from us on your save, when it last backed up to the cloud, and when you copied it. The support info never includes your save. The game doesn't email us by itself: we only get what you choose to send.
An AI agent helps us turn bug reports into tickets. Once your email is in Zoho Desk, a script on our computer takes out your email address and the name Zoho Desk has for you, any other email address, any phone number of nine digits or more (such as one with its area or country code), and any player id, RevenueCat id or Google Play order number. It can miss a shorter phone number, like a local one written without its area or country code, or an address or number written in an unusual way, so it's best to leave phone numbers out: we never need yours. A different name you sign with, or anyone else's name, stays in. Then our agent, Linnet, reads the subject, what you wrote in your first five emails and your support info, but not attachments or our replies. Linnet runs on Claude, from Anthropic, which processes what it reads.
Linnet may file a ticket from your email on our ticket board in Notion, where our AI agents, which also run on Claude, work on it. The ticket can quote your subject, your support info and up to 1,200 characters of what you wrote. It points to your conversation only by Zoho Desk's numbers for it.
You never need to tell us about your health, but some players do, for example when something in the game gets in their way. If you do, we use it only to answer you and fix what got in your way, never for ads or anything else, and we never sell it. Only the services this section names handle it, for us, and Apple too if you write it in TestFlight feedback. When your email's subject says Accessibility, as the link in our site's accessibility section sets it, Linnet's ticket quotes neither what you wrote nor the rest of the subject: Linnet describes the problem and the setting you had on in its own words, and leaves out your health. It stays with your emails, as below. Our consumer health data privacy policy says more.
We keep a conversation for 12 months after it's closed, in case you write again about the same thing, and then delete it. If you'd like your emails deleted sooner, ask us. If you tell us you're under 13, we delete them within one business day of our answer, as Children says. Either way, we take its quotes out of our tickets at the same time. A ticket then keeps only our own notes on the bug, with when you wrote, the game's version, your device and its screen size. Copies can stay a little longer in Notion's page history, and in the records our agents keep at Anthropic and on our computer, until those expire.
TestFlight feedback
Before a version of the iPhone and iPad app comes out, people we invite can test it with Apple's TestFlight app. If you do, you can send us feedback from the test build: a screenshot with a comment, or a comment after the app crashes, with its crash report. TestFlight adds details about you and your device, and Apple shows us all of it in App Store Connect, its site for developers, where we read it: your name and email address if we invited you by email (from a public link, only an address you choose to add), the build, how long the app had been open, and your device's model, system, screen size, language and region, battery level, mobile carrier, time zone, processor, connection and free space, with any Apple Watch paired to it. Your feedback goes to Apple first, and Apple keeps its own copy, not just the one it shows us. Apple's TestFlight & Privacy page says it keeps feedback for a year, may keep crash reports and usage data until their bugs are resolved, and uses some of it for its own purposes, such as improving TestFlight and preventing fraud. Apple's privacy policy says more about what Apple itself does with it.
Our agent Linnet (see Emails to support) reads new feedback through Apple's API, with a script on our computer: your comment, the first lines of any crash report, when you sent it, the build, your device's model, system and screen size, its language and region, its connection and battery level, and how long the app had been open. Linnet may also look at your screenshots, which the script saves on our computer for it. It never reads your name or email address: the script turns your address into a short code, so we can tell your reports apart without it. Before Linnet reads a crash report, the script takes out its times, which can show your time zone, and the codes Apple puts in it for the report and your device.
Linnet may file a ticket from your feedback on our ticket board in Notion, where our AI agents work on it. The ticket never quotes your comment: Linnet sums up what you reported in its own words, and leaves out your health. It can quote up to 1,500 characters of the crash report, which can name your device's model and system, without its times or codes. It also has when you sent it, the build, your device, its screen size, your short code and App Store Connect's number for your feedback. A ticket filed before we changed this in November 2026 can quote up to 1,200 characters of your comment, any health detail included, until we delete that feedback. You never need to tell us about your health: what you were doing, what went wrong and any setting you had on are enough.
We keep your feedback for 12 months after you send it, since a bug can outlast the test build you found it in, and you or another tester may report it again. Then we delete our copy from App Store Connect, and take Linnet's summary of it, and any quote, out of our tickets at the same time. If you'd like it deleted sooner, email us from the address you test with. A ticket then keeps only our own notes on the bug, with the build, your device and its screen size. We delete the screenshots Linnet saved on our computer once a month. Copies can stay a little longer in Notion's page history and our agents' records, as Emails to support says. The copy Apple keeps for itself is up to Apple, as above.
Ratings
At most once per app version, the apps may ask the App Store or Google Play to show its own rating sheet, and Rate Starfall Spire in the Tome opens the store's review page. Anything you rate or write there goes to Apple or Google under their terms, and a written review is public on the store. The game isn't told whether you rated. If you write a review, we see it as the store shows it, with the name you post under, and Google Play also shows us your device model, language, and Android and app versions.
What we don't do
No analytics of our own beyond the anonymous play counts above, no tracking by us, and no third-party requests except the purchase and ad services above, the store's rating sheet, and the store's age range. The game's fonts and art ship with the game.
We don't sell your data: nobody pays us for it. Google pays us for the ads you choose to watch, and if a US state's law counts what its ad software collects then as selling or sharing your personal information, opting out covers that too. We don't collect, use or sell your data to train AI language models.
Children
Starfall Spire is for all ages. From version 1.0.2, the game asks what year you were born as it opens, in the apps and in a browser, unless the store's age range says you're under 13. It asks with the Archmage's Seal too, and it asks a player who updated from version 1.0.1 or 1.0.0 without answering. There's no way to skip it: until you answer, the game asks each time it opens. In version 1.0.1, in a browser, the game asks only when you name your wizard; the apps ask as they first open, unless you have the Seal or the store's age range says you're under 13, and if you choose Not now there, or have the Seal, they ask the first time you choose to watch an ad or name your wizard. Earlier versions of the apps asked only then. The game keeps only whether you are under 13, 13 to 17, or older; version 1.0.1 also keeps a note that the apps asked as they opened, with no answer in it, which version 1.0.2 deletes. It keeps them only on your device, so they're also in your device's own backups if they include the game (on Android, your phone's backup to your Google account, as Your choices and contact says). For players under 13, ads are requested as directed at children: no personalised ads, no advertising identifier, and neither Google's consent form nor a request to track. For players 13 to 17, every ad is requested as not personalised: Google picks it from the game and your rough location, not from what you do in other apps and sites. They see neither Google's consent form nor a request to track, so on iOS Google gets the advertising identifier only if you were asked about tracking before the game knew you were under 18, and allowed it. The game can't take that back, but you can, in Settings, under Privacy & Security, then Tracking. Google may still get the rest of the ad data above. For every player under 18, the apps start Google's ad software only when they pick an ad, never as the app opens; earlier versions started it as the app opened once they knew the player's age. Once the game knows you're under 18, from your answer or the store's age range, it doesn't suggest the Seal or the Vault to you. From version 1.0.2, it doesn't show you the Star Chart either, or the sky its stars earn, whatever a parent says. An under-13's wizard name is picked from a list of generated names instead of typed. If your wizard already has a name you typed when the game learns you're under 13, from your answer or the store's age range, the game replaces it with a generated one and says so. As Play counts says, play counts work the same for every age, apart from the Rift's counts, which wait for a parent's approval where the law asks for one. Every player's game, under-13s included, sends our server its IP address when it checks for settings, loads the Rift ladder, reports a name on the ladder, reports an error or sends a play count. Until the device has a player id (from a cloud backup, a linked device or a Rift run it sent), that address is the only personal information those requests carry; after that, loading the ladder and reporting a name also send the player id, as Online features says. We use the address only for these things: to answer the request, to stop any one address sending too many requests, to fix problems with the help of Cloudflare's 7-day log, and to look up its country, which decides whether the EEA's or the UK's rules on play counts apply. The address is never saved in our database, and neither is its country. We never use the address to identify, contact, profile or advertise to anyone, or combine it with other data. We don't knowingly collect personal information from children under 13; if you think a child has sent us some, email us and we'll delete it.
If you tell us in an email that you're under 13, we answer you once, without asking you anything. Within one business day of that answer, we delete your emails and our replies, with your name and email address, from our help desk, and take any quote of them out of our tickets. If you wrote from a parent's or family email address that has also written to us about something else, we keep that address for those other emails, and still delete yours. We keep only a record that we did, with no name, email address or id (How long we keep it). Cloudflare's record of the sender and subject line expires by itself after 31 days, and so do the other copies Emails to support names. If you need more from us, a parent or guardian can email us.
Our server can't tell who is under 13, so it keeps a child's data as it keeps everyone's, only for the features Online features describes: the player id, cloud save and Rift runs stay so you can get your progress back and play the ladder. It deletes every player who goes 24 months without a cloud backup or a Rift run, with everything it holds for them, and How long we keep it says how long the rest stays. Delete my cloud data in the Tome deletes it all sooner. A run's battle-tags yes doesn't tell our server who is under 13 either: a run without one could be anyone's.
When the game replaces a name you typed, from version 1.0.2 the new name goes on your earlier Rift runs too, as any made-up name does, so the name you typed leaves your runs on our server. Only the new name is sent, with your player id: never your age, or that the game replaced a name. It's the same request as for a name picked with New name, and tells our server nothing your next run wouldn't. Versions before 1.0.2 show the new name only from your next run, so if one of them replaced your name, your runs from before still have the one you typed until one of these happens: a device with your player id and a made-up name in its save has its first launch of version 1.0.2 or later, you save a made-up name in version 1.0.2 or later (in the Rift tab, tap New name, then Save), or you delete your data. At that launch, the game sends the made-up name the device's save holds, once, the same way. It can be the device where your name was replaced, or any other device linked to yours whose save holds a made-up name, such as one that got the same save back from the cloud. Each device does it only at its own first launch, so restoring a save onto a device, or linking one, after that device has opened version 1.0.2 or later doesn't send it. Once our server has the new name, the one you typed can still be in these places for a while:
- A person's review of it, if players reported it and we reviewed it: our server keeps that review until you delete your data, as Online features says.
- If players reported it, our list of names waiting for a review. Our daily checks run on GitHub: they read the list from our server, and GitHub keeps it for a day, encrypted so that only our own computer can open it. We keep the list in a ticket in Notion, where each day's list replaces the one before, though Notion's page history can keep earlier ones. Once no names are waiting, the ticket closes with its last list in it.
- If a run of yours was among a week's top 25, the list of them for our check of the Rift ladder, which GitHub keeps for a day, encrypted so that only our own computer can open it.
- Your cloud save, until a newer backup replaces it. With cloud save on, the game backs up every few minutes while it's open.
- A device linked to yours, which keeps its own save and wizard name. A Rift run it sends puts that name back on that week's run, until that device replaces the name too, once it learns you're under 13.
- Our backups, for about 30 days, and any copy we make while we put a problem right (How long we keep it).
- Cloudflare's record of any command we typed that named it, for 31 days (How long we keep it).
- A run we took off the ladder, in the copy we keep in case you appeal (How long we keep it): if we put the run back, it comes back with that name.
- The list we save before clearing a week's ladder, for up to 30 days (How long we keep it).
- The top of each week's ladder, which our server keeps in memory for up to a minute.
In some places, such as Texas, the law has the App Store and Google Play tell apps an age range for each player. When the game gets one, it uses it only to protect younger players, and only on your device. If the range says you're under 13, the game treats you as under 13, as above, without asking your age and whatever you answered before. So Google is asked for ads directed at children, but isn't sent the range. A wizard name you typed is replaced with a generated one: the game says so, and from version 1.0.2 the new name goes on your earlier Rift runs too, as above (versions before 1.0.2 show it from your next run). If it says you're under 18, the game doesn't suggest the Seal or the Vault to you or, from version 1.0.2, show you the Star Chart, and unless the range or your own answer puts you under 13, your ads are as for players 13 to 17 above: not personalised, with neither Google's consent form nor a request to track. Google isn't sent the range then either. Apart from that new name and the battle-tags yes below, the game never saves the range or what it decided from it, never sends the range to us or anyone else, and never uses it for anything else, such as prices. It plays no part in play counts either, except that on an iPhone or iPad it can change when version 1.0.2's update reaches you, which the Rift's counts wait for (see Play counts). The same law has a parent approve some updates, such as one that adds something to buy, a new way to play or a new play count, before they reach a player under 18, and until the parent does, the game keeps that part of the update from you. On Google Play, Play asks your parent and tells the game their answer each time it starts. On the App Store, the game asks for your parent's approval when you first reach that part, and for the Shop's new looks and finishes, and the Rift's play counts that came with them, also each time the game starts, unless it knows you're under 18: if the law asks for it, the App Store shows you a request to send to them. The game keeps your parent's answer, and that it asked and when, on your device, since the App Store gives the answer only once, and never sends any of them to us or anyone else. The App Store asks only when the law needs your parent's approval, so that note shows it counted you as under 18. While the game keeps that note, or your parent's answer, it keeps the Star Chart from you, as it does from every player it knows is under 18: a parent's approval never brings it. So the game keeps each part only while it needs it: when it asked, until your parent answers or a day passes; that it asked, until it keeps your parent's answer instead; and your parent's answer until we describe that part in new words, which asks again. It keeps none of them once that part of the update no longer needs a parent's approval in the version of the game you have, or once the App Store says you're 18 or over. Version 1.0.0 holds back no part of an update, so it never asks.
Why we're allowed to use it
In the EEA and the UK, the law lets us use your personal data only on grounds it sets out, which it calls lawful bases, and asks us to say which one each use rests on. We use four: a contract, when we need the data to give you something you asked for; your consent; our legitimate interests, which we name each time; and a legal obligation, when the law requires something of us. What the game keeps on your device and never sends us isn't listed here, since it never reaches us.
- Purchases: a contract. We need the receipt check to give you what you bought, and to bring it back when you restore your purchases.
- Optional ads: in the EEA and the UK, personalised ads, and Google's use of your device's identifiers for ads, rest on your consent. Google's form asks for it after the age question, as the app opens or at your first ad, and you can change your answer at any time in Ad privacy choices in the Tome. On iOS, Apple also asks whether apps may track you. Without that consent, and for every player under 13, the ad you choose isn't personalised, and it rests on our legitimate interest in offering optional ads, which help pay for the game. Outside the EEA and the UK, you can opt out of personalised ads where the law lets you.
- Cloud backups, linking devices and the Rift ladder (Online features): a contract. You choose to use them, and they can't work without the data they send: your player id, your save, and your runs, name and score on the ladder, with a made-up name you save.
- A fair Rift ladder: checking each run's score with its inputs, our check of each week's top runs, counting your Rift tries, name reports and reviews, taking a run off the ladder and keeping its copy in case you appeal, keeping a player off the ladder with a ladder block and our record of it, and the list we save before clearing a week's ladder. These rest on our legitimate interests in a ladder that's fair to every player, with names that keep the Fair Play rules, and in answering questions about a week we cleared, and perhaps making it up to its players.
- Battle tags (Online features), and each Rift run's battle-tags yes: our legitimate interest in letting players with the same wizard name tell each other apart on the ladder. The ladder works without them, so you can object: email us, and we take your battle tag away for good.
- Keeping the game working and safe: the settings check each time the game opens, error counts, the limit on requests from one address, our server's log, Cloudflare's record of our database's commands, ad codes, our backups, and the copies we make while we put a problem right (How long we keep it). These rest on our legitimate interests in a game that works, a server no one can flood, bonuses that match the ads Google actually showed, and data we can repair.
- Play counts: in the EEA, your consent: nothing is counted until you say yes, and you can take it back in the Tome at any time. In the UK, our legitimate interest in seeing how many people keep playing and how the Rift and the Shop are used, and you can turn counts off in the Tome there too. Working out from your address whether you're in the EEA or the UK, so the right rule applies, rests on our legitimate interest in following each place's rules.
- Trying new features early: a contract, since you asked us for it and said yes. We take you out when you ask. Asking the year you were born first rests on our legitimate interest in protecting children.
- Copies, corrections and deletions of your data (Your cloud data, Your rights), with the game's buttons or by email, RevenueCat's record of your purchases included, appeals, and our record of each request: a legal obligation. The law gives you these rights, and asks us to be able to show we kept them.
- Emails to support, TestFlight feedback, and the store reviews we read (Ratings): our legitimate interest in answering you and fixing what you tell us about, which is also why Linnet turns bug reports into tickets. An email asking for a copy or a deletion rests on a legal obligation too, as above.
- The age question, and the age range a store may give the game (Children): our legitimate interest in protecting children who play. They're how players under 13 get ads that aren't personalised and names they don't type, with a name typed before the game knew replaced, and how a device that knows you're under 18 keeps your runs from showing a battle tag. We never receive your answer or the range, only a Rift run's battle-tags yes.
Your rights
Wherever you live, you can:
- find out whether we hold data about you, and get a copy of it, as text you can keep or take elsewhere;
- have it corrected, though the game writes almost all of it, so you can change most of it there, like your wizard name in the Rift tab;
- have it deleted;
- opt out of personalised ads, and of any selling or sharing of your data, in the game, as Optional ads says.
For a copy or a deletion, the Tome's Copy my cloud data and Delete my cloud data buttons work straight away (Your cloud data). Or email support@starfallspire.com, with your support info from the game so we can tell which data is yours. It's free. We reply within 2 business days, and do what you asked within a month. If we can't tell which data is yours, we say so, and what would let us. A parent or guardian can ask for their child.
If we turn your request down, we tell you why. To appeal, reply and ask us to look again: a person reviews it and answers in writing within 45 days, with our reasons. If we still say no, we tell you how to complain to Connecticut's Attorney General or Washington's.
We don't use your data for automated decisions about things like loans, housing, insurance, school, jobs or health care.
Your choices and contact
Deleting the app, or clearing the site's data in your browser, erases everything the game stored on your device, but not your device's own backups. On Android, reinstalling the game brings back your progress and the game's settings, your player id and your RevenueCat id from your device's last backup to your Google account, if the device had backed the game up. That copy goes if you turn off backup on your phone or delete its backup in your Google account, and so does the rest of that backup. Your ad consent choice isn't in that backup, so where the law requires consent (for example in the EEA and UK), the game asks for it again as it first opens. What's on our server stays until you delete it, as above. You can turn play counts on or off in the Tome at any time. For questions or requests, email support@starfallspire.com.