Privacy Policy

This Privacy Policy explains what information Star Shop collects, how we use it, and the choices you have. We collect the minimum needed to run the store, deliver your purchases, and keep the service secure.

Information you give us:

• your email address (required to purchase, even as a guest);
• a username and password if you create a full account;
• your Discord account details if you sign in with Discord (id, username, email);
• order details and support messages you send us.

Information collected automatically:

• your IP address and browser user-agent, used for security and rate limiting;
• a session cookie so you stay signed in (see our Cookie Policy);
• basic technical logs of requests to our servers.

We do not collect or store full payment card numbers. Card and PayPal payments are processed by PayPal; we receive only a transaction reference and status.

We use your information to:

• create and manage your account and deliver the keys you purchase;
• process payments, wallet balances, refunds, and referral earnings;
• send transactional email (order confirmations, password resets, key delivery);
• prevent fraud, abuse, and unauthorized access;
• provide support and respond to your requests;
• comply with legal obligations.

We do not sell your personal information.

We share information only with service providers who help us run the store, and only as needed:

• PayPal, to process payments;
• our email provider, to send transactional email;
• our hosting and database providers, to operate the service;
• Discord, if you choose to sign in with Discord.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, and property of Star Shop, our users, or others.

We keep your account, order, and transaction records for as long as your account is active and as needed to comply with legal, tax, and anti-fraud obligations. Password reset tokens are short-lived and stored only as hashes. You can request deletion of your account, subject to records we must retain by law.

We protect your data with measures including hashed passwords, hashed reset tokens, encrypted transport (HTTPS), server-side sessions you can revoke, and rate limiting on sensitive endpoints. No system is perfectly secure, but we work to keep your information safe and to limit what we store.

You can update your account details, sign out of all devices, and request account deletion. Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to certain processing. To exercise these, contact us through support.

Star Shop is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their information. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes take effect when posted with a new effective date. Questions or requests can be raised through our support channel.