Starlit Whale Privacy Policy
Version 1 · October 28, 2026 · Previous versions
Common & Account
StarlitWhale (the "Operator") processes the personal information of people who use the Starlit Whale services below in accordance with the Personal Information Protection Act of Korea (개인정보 보호법), and publishes it as a single privacy policy as follows. The Operator processes only the minimum personal information necessary for the purposes of processing.
| Service | Address | Sections of this policy that apply |
|---|---|---|
| Starlit Whale Account | accounts.starlitwhale.com | Common & Account |
| Starlit Whale website | starlitwhale.com | Common & Account + Website |
| Starlit Song | ciel.starlitwhale.com | Common & Account + Starlit Song |
Which sections apply to whom?
- Starlit Whale members: all of "Common & Account", plus the sections for the services you use (Website, Starlit Song).
- Users who are not members (visiting or sending an inquiry on the website, guests playing the game without signing in): the sections for the services you use, and C4, C6, C7, C9 and C11 of "Common & Account". If you are not a member, we do not process "Starlit Whale Account" information (C1–C3, C5, C8).
Effective date: October 28, 2026
Common & Account · C1. Personal information processed by the account and why
Information processed for membership and to perform the service agreement (required — Personal Information Protection Act of Korea, Article 15(1)4)
| Category | Item | Purpose |
|---|---|---|
| Required | Member number (a random number created when you sign up) | Identifying members, signing in as the same member across Starlit Whale services |
| Required (username and password sign-up) | Username | Signing in, display on screen |
| Required (username and password sign-up) | Hash of the password verifier (the password itself is never sent to the server; see C7) | Verifying sign-in |
| Required | Record of confirming you are 14 or older (time of confirmation) | Preventing sign-ups by children under 14 |
| Required | Where you signed up (account screen, website or game) | Processing sign-up |
| Required | Services used and time of first and last use | Showing "Connected services" in My information, notifying each service when you delete your account |
| Required | Records of agreement to the terms of use and privacy policy (items agreed to and their versions, time of agreement, where you agreed) | Confirming which items of which document you agreed to |
| Required | Sign-in state (login cookie on the account screen and server session records) | Keeping you signed in |
| Required | Rate-limit records for sign-in, sign-up and email requests (IP address, username, time) | Blocking attacks that try passwords at random, and excessive requests |
| Required | Account activity records (time and type of sign-up, successful and failed sign-ins by type, linking and unlinking sign-in methods, email changes (masked value), changes to advertising consent, password changes and resets, account deletion) | Checking account security, investigating problems |
Information received from Google if you use Google sign-in (required for members who sign up with or link a Google account — Article 15(1)4 of the same Act)
| Category | Item | Purpose |
|---|---|---|
| Required | Google account unique identifier (sub) | Confirming it is the same Google account, signing in |
| Required | Masked email address (e.g. ka•••••@gmail.com) | Showing in My information which Google account is linked |
| Required | Name (Google profile name) | Display name for members without a username |
| If provided | Email address (only during sign-up) | Filling the email field with “Use Google address” |
We use the Google email address only while sign-up is pending (up to 10 minutes). The temporarily stored address is deleted immediately when sign-up completes, or by a scheduled task that runs every minute after the pending period expires. It is saved as your member email only if you use “Use Google address” during sign-up; otherwise it is not used as your member email, for contact or for advertising. Information received from Google is used only for the purposes stated in this policy, and is not given or sold to anyone else.
Information processed with consent (optional — Article 15(1)1 of the same Act)
| Category | Consent | Item | Purpose |
|---|---|---|---|
| Optional | Email collection and use consent (optional) | Email address, whether and when it was verified, records of verification and password reset email links | Password recovery, replies to inquiries, notices essential to using the services |
| Optional | Receive advertising information (optional) | Consent status, time of consent and withdrawal, version of the text agreed to, where consent was given or withdrawn | Sending Starlit Whale advertising information such as release news by email (contact for promotional purposes), confirming consent |
- Your email is stored only if you agree to "Email collection and use consent (optional)" and enter it. An email address entered on the game's sign-up screen and consent to receive advertising information given there are also stored in your Starlit Whale Account, not in the game.
- Advertising information is sent only if you have agreed to receive it and verified your email. Deleting your email also withdraws your consent to receive advertising information.
Common & Account · C2. Retention periods (account)
| Information | Retention period |
|---|---|
| Member number, username, hash of the password verifier, record of confirming age 14 or older, where you signed up, services used, records of agreement to the terms of use and privacy policy | Until you delete your account |
| Information received from Google | Until you unlink Google or delete your account |
| Email address and verification records | Until you delete your email or delete your account |
| Records of verification and password reset email links | Links cannot be used after use or expiry. Records are not deleted merely on use or expiry; they are deleted when you remove your email or delete your account. |
| Advertising consent status and history | Until you delete your account (even after you withdraw, the history is kept until you delete your account to confirm that consent was given and withdrawn) |
| Sign-in state (account screen) | 30 days from sign-in. Deleted when you sign out, change your password or delete your account |
| Rate-limit records | Only records from the last 10 minutes (sign-in) or the last hour (sign-up) are used. When older records are deleted: Records at least 60 minutes old are deleted by a scheduled task that runs every minute. |
| Account activity records | Until you delete your account; deleted when you do |
- When you delete your account, the information above is destroyed without delay. However, the member number, deletion status and time of deletion are kept to notify each service of the deletion; these values alone cannot identify who you are.
- If the services end, any remaining information is destroyed without delay.
Common & Account · C3. Destruction procedure and method (account)
- When you delete your account, your sign-in methods (username and password, Google link), email, advertising consent status and history, records of agreement to the terms of use and privacy policy, and sign-in state are deleted from the database immediately.
- Each service you used is notified of the deletion immediately (and notified again if this fails), and each service deletes its records as described in its own section (H2, G3).
- When you delete your email or unlink Google, that information is deleted immediately.
- All information is kept only as electronic files and is destroyed by deleting it from the database.
Common & Account · C4. Provision to third parties (all users)
The Operator does not provide personal information to third parties, except when required by law. Exchanging the member number and sign-in result (username or display name) between the Starlit Whale Account and the website or game is use within the same Operator, and your email address and consent to receive advertising information are not given to the website or game.
Common & Account · C5. Outsourcing and overseas transfer (account)
To run the account, the Operator entrusts processing as below, and in the process personal information is transferred outside Korea. The matters required by Article 28-8(2) of the Personal Information Protection Act of Korea are as follows.
| Category | Cloudflare |
|---|---|
| Recipient | Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107 USA / privacy contact dpo@cloudflare.com |
| Work entrusted | Running the account server, database storage, handling connections |
| Legal basis for transfer | Overseas outsourcing and storage necessary to perform the service agreement (Article 28-8(1)3 of the same Act) |
| Items transferred | All items in C1, and your IP address when you connect to the account |
| Destination country | Database: Cloudflare Asia-Pacific (APAC) region — Cloudflare does not disclose locations at the country level / Server execution and connection handling: the Cloudflare data center nearest to you among its data centers worldwide (in many countries, including the United States), list of Cloudflare data centers |
| Time and method of transfer | Sent over encrypted connections (HTTPS) each time you use the account |
| Recipient's purpose of use and retention period | Performing the work above. Kept for the periods in C2 of this policy |
| How to refuse and the effect | The account runs only on Cloudflare, so if you refuse you cannot create or use an account. If you do not want this, you can delete your account or request deletion at the contact in C9 |
Common & Account · C6. Your rights and how to exercise them (all users)
Users and their legal guardians may at any time access their personal information, request its correction, deletion or suspension of processing, or withdraw consent. For Starlit Whale Account information you can do this yourself in My information on the account screen; for the website and Starlit Song, see H4 and G5.
- Access: member number, sign-up date, sign-in methods, email and verification status, advertising consent status, connected services.
- Correction: changing your email, changing or creating a password.
- Deletion: deleting your email, unlinking Google (not possible if it is your only remaining sign-in method), "Delete account".
- Withdrawal of consent: You can withdraw consent to receive advertising information at any time in My information, and it takes effect immediately. Email collection and use consent is withdrawn by deleting your email.
- For requests you cannot make on screen, please contact the address in C9. You may also make requests through a representative. If a username-and-password member who has not entered an email forgets their password, there is no means of verifying their identity, so access or deletion requests for that account cannot be processed.
- If we refuse a request or carry it out only in part, we will tell you why, and you can object at the same contact.
- We do not accept sign-ups from children under 14. If we learn that a child's personal information has been processed, we delete it.
Common & Account · C7. Security measures (all users)
- All communication is encrypted with HTTPS.
- The password itself is never sent to the server. The Starlit Whale Account server hashes the verifier computed in the browser once more and stores that.
- The login cookie is set so that scripts in the browser cannot read it (HttpOnly) and it is sent only over HTTPS (Secure).
- Sign-in state records, email links and one-time sign-in codes are stored as hashes, not as the original values.
- Account activity records never contain passwords, verifiers, codes, tokens, cookies, full email addresses or Google tokens.
- Changing or resetting your password, unlinking Google or deleting your account also signs you out everywhere else (website and game).
- Sign-ins, sign-ups and email requests are limited to block random guessing and excessive requests.
- Signing in as a member does not grant access to the admin features of the website or game.
Common & Account · C8. Cookies on the account screen
| Name | What and why | Retention |
|---|---|---|
| Login cookie | Keeps you signed in on the account screen | 30 days |
| Google sign-in check cookie | Confirms that the browser that started Google sign-in is the same one that returned | 10 minutes |
| Pending sign-up cookie | Keeps your progress while you sign up with Google | 10 minutes |
| Language cookie | Remembers the language you selected | 365 days |
You can refuse or delete cookies at any time in your browser settings; if you refuse the login cookie, you cannot sign in.
Common & Account · C9. Privacy officer (all users)
These services are run by an individual, and the Operator personally serves as privacy officer for all Starlit Whale services, handling inquiries, complaints and remedies.
- Privacy officer: StarlitWhale
- Email: ryuhaneul@starlitwhale.com — inquiries to this mailbox are handled with the help of AI tools.
- Inquiries you do not want handled by AI: no-ai@starlitwhale.com — inquiries to this mailbox are not handled with AI tools, and replies may take longer.
Common & Account · C11. Changes to this policy (all users)
- If this policy changes, we will announce the changes and the effective date on this page, and publish previous versions of the policy and the period each applied at https://accounts.starlitwhale.com/privacy/versions?lang=en. Significant changes, such as changes to the items processed or the purposes, are announced separately with a table comparing the policy before and after.
- We do not ask for your consent again when this policy changes. We ask again for a consent only when what you consented to changes, such as the items or purposes processed with that consent.