Privacy policy
Updated
This page describes what starfeed.com does with information about visitors, as the site works today. There are no accounts or logins, and most of the site can be read without giving us anything. Personal data reaches us when you subscribe to the email digest, turn on notifications, send a contribution or buy a paid access key, and through the server, analytics and advertising described below.
1Who we are
starfeed.com is operated independently and is not affiliated with any company.
starfeed.com decides what data this site collects and why, and is responsible for it. Questions and requests about your data: [email protected].
2What we process
Only what is listed here. The “Every visit” groups apply to everyone; the others only if you use that feature.
Every visit: server log
- Like most web servers, ours logs each request: IP address, time, the full address requested (including anything after “?”), status, referring page, browser identifier (user agent) and response time.
- So the log can hold, next to your IP address, search terms you type, the star IDs your browser sends to build your feed, and the token in links from our emails.
Every visit: anonymous page counts
- Our own counter records the page path (without anything after “?”), the referring site (domain only, for search engines, social networks and other sites), device type, site language and section, and your country as reported by Cloudflare. These are kept only as hourly and daily totals.
- To count unique visitors per day, it keeps a hash of your IP address and user agent mixed with the date and a server secret. A new hash is made each day, so visits on different days cannot be linked through it.
- The counter sets no cookie and stores nothing in your browser. It ignores known bots and automated browsers.
Every visit: Google Analytics and AdSense
- Google Analytics and Google AdSense run on every page and set cookies. See “Cookies and browser storage”, “Advertising” and “Service providers”.
If you subscribe to the email digest
- Your email address, the language, categories and stars you choose (up to 20 stars), and your delivery hour.
- Status and dates: sign-up, confirmation, unsubscribe and last send.
- A random token used in your confirm, settings and unsubscribe links. The confirm link works for 24 hours; the settings and unsubscribe links do not expire.
- Where you signed up (for example the footer or a star page) and the country of your connection, a two-letter code from Cloudflare.
- A shortened hash of your IP address combined with the date, used to allow at most 10 sign-ups per hour from one IP address. The address itself is not stored, but we treat the hash as personal data.
- A log of each email we send you: date, type (confirmation, digest or notice), number of items, the sending service's message ID and the delivery result.
If you turn on notifications
- When you turn on notifications (from the notification prompt or by following a star), your browser gives us a push address (a link at your browser maker's push service) and two encryption keys.
- We store them with the stars you follow (up to 200), your language, your time zone, your notification settings and delivery counters, plus a log of what we sent and when, tied to a shortened hash of the push address. No IP address or browser details are stored with them.
If you send a contribution
- Translations, schedule tips, alternative names, correction suggestions, star requests, “translation looks wrong” flags and reports, with the star or story they concern, your language and the time.
- The random device ID kept in your browser (sf_device) and an IP hash made the same way as for sign-ups. Both are used to allow at most 30 contributions per hour and to count requests and reports from different devices.
- Translations, schedule tips and alternative names are shown publicly, without any identifier. Correction suggestions go to the operator queue; applied corrections are listed with the corrected value and any source link in the star's revision history. Star requests appear in the public list of recent requests with the star's name, Wikidata ID and number of requests, and nothing about who sent them.
If you buy a paid access key (API, MCP or crawler)
- Creem (creem.io) processes the payment as merchant of record and sends us your email address and, if you enter one, a company name. We use them only to deliver your key and answer support requests.
- We keep usage counts per key and a hash of the key, never the key itself. We never receive card or bank details.
- Plans and terms: Licensing and API access.
What we never collect
- No accounts, passwords, names, phone numbers, postal addresses or payment details.
- No precise location. Our own records hold only the country of your connection, and your time zone if you turn on notifications. Google Analytics estimates a rough location, such as a city, from your IP address.
- No raw IP addresses in our database. They appear only in the short-lived server log.
- Nothing about you is sent to AI models. AI is used only on public news text, headlines and star names.
- We do not sell or rent subscriber data.
4Advertising
starfeed.com shows ads served by Google AdSense. Google and its partners use cookies and similar identifiers to show ads, including ads based on your earlier visits to this and other websites, to limit repeats and to measure results.
With each ad request Google receives the page address, your IP address, browser details and its cookies. Google explains how it uses this in How Google uses information from sites or apps that use its services.
You can turn off personalised ads in Google's Ads Settings. Blocking or deleting cookies in your browser also limits them. We never give advertisers your email address.
5Service providers
These companies handle data for the site. Each keeps it under its own policies, which our code does not control, and some process it outside your country, including in the United States.
- Cloudflare: every request passes through Cloudflare, which protects and speeds up the site. It sees your IP address, browser details, cookies, the full page address and anything you submit, such as your email address when you subscribe. It tells our server your country, may set the bot-check cookies above, and may ask your browser to report network errors to it.
- Resend: sends our emails. It receives your email address and the full content of each email, including your personal links.
- Google: Google Analytics measures visits and receives the full page address, referring page, screen size, browser details and your IP address. AdSense is described under “Advertising”. You can block Analytics with Google's opt-out browser add-on.
- Hostinger: hosts the server that holds our database, logs and caches.
- Creem: processes payments for paid access keys as merchant of record. It receives what you enter at checkout and keeps it under its own policy.
- AI models: used only on public news text, headlines and star names, to write briefings and translations. No information about you is sent to an AI provider.
Services your browser contacts directly
- Push services: if you turn on notifications, your browser's push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge) delivers them. Messages are encrypted for your browser; the service sees the push address, timing and size.
- Wikidata: the star search on the request page sends your search term to wikidata.org (Wikimedia Foundation) straight from your browser, along with your IP address and browser details.
- Other image hosts: most images come through our server, but some load directly from the site that hosts them, which then sees your IP address and browser details.
6How long we keep data
This is what the system does today. Where nothing deletes data automatically, we say so.
- Email subscriber records are not deleted automatically, whatever their status. After you unsubscribe, the record (address, choices, token, IP hash, country and sign-up source) is kept, marked unsubscribed, and no more digests are sent. Unconfirmed sign-ups are kept too. We delete a record when you ask, and its email log goes with it.
- Email log: kept as long as the subscriber record.
- Push subscriptions are deleted when your browser's push service reports that they no longer exist, or after repeated failed deliveries. Unfollowing a star removes only that star. Otherwise they are kept, and so is the notification delivery log.
- Fan contributions and reports are not deleted automatically. Public ones stay visible (schedule tips until their date has passed) unless they are hidden after reports or we remove them. Fan translations are also stored with the story's other translations until they are hidden or removed.
- Paid access keys: the buyer's email address and company name are erased 400 days after the customer's last key ends. Summaries of the payment notifications Creem sends us (webhook events) and daily usage counts per key are deleted after 400 days. Payment records without the email address are kept for tax purposes.
- Daily visitor hashes are deleted by an hourly job shortly after midnight UTC two days after the day they belong to, so each one is kept for one to two days, longer if the job does not run.
- Hourly and daily page-count totals are kept. They hold numbers, not individual visits.
- Server log: overwritten as it grows. Only about the latest 30 MB is kept, which at current traffic covers a few hours.
- Server cache: copies of responses are kept for up to 2 hours to keep the site fast. This can include the subscription settings response, which shows your email address.
- Application and job logs are rotated by size. Where our code writes an email address to them, it masks it to the first letter and the domain.
- We do not run our own scheduled database backups. Our hosting provider may keep its own backup copies of the server for a limited time under its policies.
- Cookies and browser storage stay on your device for the times listed above, or until you clear them.
- Cloudflare, Resend, Google, Creem and the push services keep data under their own policies.
7Your choices and rights
- Unsubscribe in one click with the link at the bottom of every digest, or with the unsubscribe button your email app shows. Until you confirm a sign-up, nothing is sent except the confirmation email.
- Change your stars, categories, delivery time or language, or unsubscribe, on the settings page linked from every digest. That link works like a password: anyone who has it can see your address and change your subscription, so do not forward it.
- Stop notifications by blocking notifications for starfeed.com in your browser. This stops all of them, and your push subscription is deleted once your browser's push service reports it as gone, normally at our next delivery attempt. Unfollowing a star stops only that star's alerts.
- Clear this site's data in your browser to remove its cookies and the storage listed above. A new device ID is created the next time you contribute.
- Limit ads and analytics with Google's Ads Settings, Google's Analytics opt-out add-on or your browser's cookie settings.
- Ask for a copy of the data we hold about you, a correction or deletion via [email protected]. Tell us the email address or the contribution concerned. You can also object to how we use your data and complain to your data protection authority.
8Children
The email digest is not intended for children under 14, and we do not knowingly collect their email addresses. If you think a child under 14 has subscribed, tell us via [email protected] and we will delete the record.
9Changes to this policy
When we change how starfeed.com handles data, we update this page and the date at the top.