Privacy Policy

Effective date: August 12, 2026

Starloom is published by Lanternary. Contact: hello@starloom.xyz.

Information we collect

When you create an account, we process your email address and authentication identifiers from Apple, Google, or passwordless email sign-in. Starloom may store the profile details you provide (including name, intention, and optional personality fields), daily reflection questions and answers, Blueprints, daily patterns, Thread access state, and service metadata needed for security and reliability.

The current version does not ask for or use birth date, birth time, birth location, or information derived from those details. An account created with an earlier test or app version may still contain dormant birth fields in its synchronized profile. The current version does not expose or send those fields for personalization. They remain dormant until the account is deleted.

Guests can explore the six-Thread preview without creating an account. AI generation, profile synchronization, and reflection synchronization require an email-verified account. Starloom does not request GPS/device location.

How we use information

We use information to authenticate you, synchronize progress across devices, generate and retrieve personalized AI content, provide support, prevent abuse, enforce generation limits, diagnose failures, and improve reliability. We do not sell personal information or use it for targeted advertising.

Service providers

• Cloudflare Workers, Workers AI, AI Gateway, KV, and email services host the API, process AI prompts, control spend/abuse, and deliver one-time sign-in codes.
• Neon Postgres stores accounts and synchronized Starloom data.
• Apple and Google provide social authentication when selected.
• Sentry receives error, performance, PII, and pseudonymous account/session context. Session Replay may be sampled, but all replay text, images, and vector graphics are masked. Authorization headers, cookies, request bodies, profiles, and reflection content are stripped from events.

AI processing

For verified users, profile details, current answers, and up to seven recent reflections needed for a requested daily pattern or Blueprint may be sent to Cloudflare Workers AI. Birth details and birth-derived context are not included. Generated results and deduplication records are retained so repeated requests can return the same result without another model call. AI output may be inaccurate and is offered for wellness reflection and entertainment, not professional advice.

Storage, retention, and deletion

Profiles, daily reflections, Blueprints, daily patterns, access state, and account records are retained on our servers while your account is active and as reasonably needed for security, legal obligations, and service integrity. Local copies may also remain on your device. Account deletion removes associated profile fields (including dormant legacy birth fields), reflections, daily patterns, entitlements, access, and generated-content records from the core database, subject to limited backups or records we must legally retain.

Signed-in users can permanently delete their account and associated active account data from Your Account in the app. Deletion is immediate and cannot be undone; signing in again later creates a new, empty account. You can also request deletion by emailing hello@starloom.xyz. Signing out, clearing local data, or uninstalling the app does not by itself delete a verified cloud account.

Security and international processing

We use HTTPS, verified sessions, access controls, rate limits, and generation deduplication. No system is perfectly secure. Our providers may process information in the United States and other locations where they operate.

Children

Starloom is for people 13 and older. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has created an account.

Your choices and rights

You may continue as a guest, edit local profile information, sign out, or request access, correction, or deletion as applicable in your jurisdiction. This version does not send notifications or request notification permission.

Changes

We may update this policy as the product or law changes. We will post the revised effective date and provide additional notice when required.