Privacy Policy

1. Who we are

Starfall: Armada ("the Game") is operated by CashXChain UG (haftungsbeschränkt), Munich, Germany ("we", "us"). For any privacy request, contact valentin.israel@cashxchain.com. We are the data controller under the EU General Data Protection Regulation (GDPR).

2. What we collect

Data	Why	Legal basis (GDPR Art. 6)
Email address & display name (on sign-up or Google sign-in)	Create and secure your account; cross-device progress	Contract (6(1)(b))
Game scores, waves, in-game progress & entitlements	Cloud leaderboard and saved progress	Contract (6(1)(b))
Purchase records & credit balance	Deliver purchases you make; fraud prevention; bookkeeping	Contract / legal obligation (6(1)(b),(c))
Technical logs (IP, user-agent, timestamps)	Security, abuse prevention, reliability	Legitimate interest (6(1)(f))

We do not collect payment card details — those go directly to Stripe. We do not run advertising, and we do not sell your data.

3. Service providers (processors)

We share data only with providers that process it on our behalf to run the Game:

• Cloudflare, Inc. — hosting, edge network and the database (Workers + D1).
• Stripe, Inc. — payment processing (handles your card data directly under its own policy).
• Google LLC — optional "Sign in with Google" (only if you use it).
• Resend (Plus Five Five, Inc.) — sending account/verification emails.

Some providers are based in the USA; transfers rely on Standard Contractual Clauses or equivalent safeguards.

4. Cookies & local storage

We use a single first-party session cookie to keep you signed in (no tracking or advertising cookies). The Game also stores your settings and a local high-score list in your browser's localStorage, which never leaves your device.

5. Retention

Account and progress data is kept while your account is active. Purchase/transaction records are kept as required by tax and commercial law (typically up to 10 years in Germany). You can delete your account at any time (see below); we then erase your personal data except records we must legally retain.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and you may object to processing. To exercise any right, email valentin.israel@cashxchain.com. You also have the right to lodge a complaint with a supervisory authority (in Bavaria: the BayLDA).

7. Children

The Game is not directed at children under 16. We do not knowingly collect their data; if you believe a child has provided us data, contact us and we will delete it.

8. Changes

We may update this policy; the "Last updated" date will change and material changes will be announced in the Game.