Starlit Whale Privacy Policy
Version 1 · October 28, 2026 · Previous versions
Common & Account
StarlitWhale (the "Operator") processes the personal information of people who use the Starlit Whale services below in accordance with the Personal Information Protection Act of Korea (개인정보 보호법), and publishes it as a single privacy policy as follows. The Operator processes only the minimum personal information necessary for the purposes of processing.
| Service | Address | Sections of this policy that apply |
|---|---|---|
| Starlit Whale Account | accounts.starlitwhale.com | Common & Account |
| Starlit Whale website | starlitwhale.com | Common & Account + Website |
| Starlit Song | ciel.starlitwhale.com | Common & Account + Starlit Song |
Which sections apply to whom?
- Starlit Whale members: all of "Common & Account", plus the sections for the services you use (Website, Starlit Song).
- Users who are not members (visiting or sending an inquiry on the website, guests playing the game without signing in): the sections for the services you use, and C4, C6, C7, C9 and C11 of "Common & Account". If you are not a member, we do not process "Starlit Whale Account" information (C1–C3, C5, C8).
Effective date: October 28, 2026
Common & Account · C1. Personal information processed by the account and why
Information processed for membership and to perform the service agreement (required — Personal Information Protection Act of Korea, Article 15(1)4)
| Category | Item | Purpose |
|---|---|---|
| Required | Member number (a random number created when you sign up) | Identifying members, signing in as the same member across Starlit Whale services |
| Required (username and password sign-up) | Username | Signing in, display on screen |
| Required (username and password sign-up) | Hash of the password verifier (the password itself is never sent to the server; see C7) | Verifying sign-in |
| Required | Record of confirming you are 14 or older (time of confirmation) | Preventing sign-ups by children under 14 |
| Required | Where you signed up (account screen, website or game) | Processing sign-up |
| Required | Services used and time of first and last use | Showing "Connected services" in My information, notifying each service when you delete your account |
| Required | Records of agreement to the terms of use and privacy policy (items agreed to and their versions, time of agreement, where you agreed) | Confirming which items of which document you agreed to |
| Required | Sign-in state (login cookie on the account screen and server session records) | Keeping you signed in |
| Required | Rate-limit records for sign-in, sign-up and email requests (IP address, username, time) | Blocking attacks that try passwords at random, and excessive requests |
| Required | Account activity records (time and type of sign-up, successful and failed sign-ins by type, linking and unlinking sign-in methods, email changes (masked value), changes to advertising consent, password changes and resets, account deletion) | Checking account security, investigating problems |
Information received from Google if you use Google sign-in (required for members who sign up with or link a Google account — Article 15(1)4 of the same Act)
| Category | Item | Purpose |
|---|---|---|
| Required | Google account unique identifier (sub) | Confirming it is the same Google account, signing in |
| Required | Masked email address (e.g. ka•••••@gmail.com) | Showing in My information which Google account is linked |
| Required | Name (Google profile name) | Display name for members without a username |
| If provided | Email address (only during sign-up) | Filling the email field with “Use Google address” |
We use the Google email address only while sign-up is pending (up to 10 minutes). The temporarily stored address is deleted immediately when sign-up completes, or by a scheduled task that runs every minute after the pending period expires. It is saved as your member email only if you use “Use Google address” during sign-up; otherwise it is not used as your member email, for contact or for advertising. Information received from Google is used only for the purposes stated in this policy, and is not given or sold to anyone else.
Information processed with consent (optional — Article 15(1)1 of the same Act)
| Category | Consent | Item | Purpose |
|---|---|---|---|
| Optional | Email collection and use consent (optional) | Email address, whether and when it was verified, records of verification and password reset email links | Password recovery, replies to inquiries, notices essential to using the services |
| Optional | Receive advertising information (optional) | Consent status, time of consent and withdrawal, version of the text agreed to, where consent was given or withdrawn | Sending Starlit Whale advertising information such as release news by email (contact for promotional purposes), confirming consent |
- Your email is stored only if you agree to "Email collection and use consent (optional)" and enter it. An email address entered on the game's sign-up screen and consent to receive advertising information given there are also stored in your Starlit Whale Account, not in the game.
- Advertising information is sent only if you have agreed to receive it and verified your email. Deleting your email also withdraws your consent to receive advertising information.
Common & Account · C2. Retention periods (account)
| Information | Retention period |
|---|---|
| Member number, username, hash of the password verifier, record of confirming age 14 or older, where you signed up, services used, records of agreement to the terms of use and privacy policy | Until you delete your account |
| Information received from Google | Until you unlink Google or delete your account |
| Email address and verification records | Until you delete your email or delete your account |
| Records of verification and password reset email links | Links cannot be used after use or expiry. Records are not deleted merely on use or expiry; they are deleted when you remove your email or delete your account. |
| Advertising consent status and history | Until you delete your account (even after you withdraw, the history is kept until you delete your account to confirm that consent was given and withdrawn) |
| Sign-in state (account screen) | 30 days from sign-in. Deleted when you sign out, change your password or delete your account |
| Rate-limit records | Only records from the last 10 minutes (sign-in) or the last hour (sign-up) are used. When older records are deleted: Records at least 60 minutes old are deleted by a scheduled task that runs every minute. |
| Account activity records | Until you delete your account; deleted when you do |
- When you delete your account, the information above is destroyed without delay. However, the member number, deletion status and time of deletion are kept to notify each service of the deletion; these values alone cannot identify who you are.
- If the services end, any remaining information is destroyed without delay.
Common & Account · C3. Destruction procedure and method (account)
- When you delete your account, your sign-in methods (username and password, Google link), email, advertising consent status and history, records of agreement to the terms of use and privacy policy, and sign-in state are deleted from the database immediately.
- Each service you used is notified of the deletion immediately (and notified again if this fails), and each service deletes its records as described in its own section (H2, G3).
- When you delete your email or unlink Google, that information is deleted immediately.
- All information is kept only as electronic files and is destroyed by deleting it from the database.
Common & Account · C4. Provision to third parties (all users)
The Operator does not provide personal information to third parties, except when required by law. Exchanging the member number and sign-in result (username or display name) between the Starlit Whale Account and the website or game is use within the same Operator, and your email address and consent to receive advertising information are not given to the website or game.
Common & Account · C5. Outsourcing and overseas transfer (account)
To run the account, the Operator entrusts processing as below, and in the process personal information is transferred outside Korea. The matters required by Article 28-8(2) of the Personal Information Protection Act of Korea are as follows.
| Category | Cloudflare |
|---|---|
| Recipient | Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107 USA / privacy contact dpo@cloudflare.com |
| Work entrusted | Running the account server, database storage, handling connections |
| Legal basis for transfer | Overseas outsourcing and storage necessary to perform the service agreement (Article 28-8(1)3 of the same Act) |
| Items transferred | All items in C1, and your IP address when you connect to the account |
| Destination country | Database: Cloudflare Asia-Pacific (APAC) region — Cloudflare does not disclose locations at the country level / Server execution and connection handling: the Cloudflare data center nearest to you among its data centers worldwide (in many countries, including the United States), list of Cloudflare data centers |
| Time and method of transfer | Sent over encrypted connections (HTTPS) each time you use the account |
| Recipient's purpose of use and retention period | Performing the work above. Kept for the periods in C2 of this policy |
| How to refuse and the effect | The account runs only on Cloudflare, so if you refuse you cannot create or use an account. If you do not want this, you can delete your account or request deletion at the contact in C9 |
Common & Account · C6. Your rights and how to exercise them (all users)
Users and their legal guardians may at any time access their personal information, request its correction, deletion or suspension of processing, or withdraw consent. For Starlit Whale Account information you can do this yourself in My information on the account screen; for the website and Starlit Song, see H4 and G5.
- Access: member number, sign-up date, sign-in methods, email and verification status, advertising consent status, connected services.
- Correction: changing your email, changing or creating a password.
- Deletion: deleting your email, unlinking Google (not possible if it is your only remaining sign-in method), "Delete account".
- Withdrawal of consent: You can withdraw consent to receive advertising information at any time in My information, and it takes effect immediately. Email collection and use consent is withdrawn by deleting your email.
- For requests you cannot make on screen, please contact the address in C9. You may also make requests through a representative. If a username-and-password member who has not entered an email forgets their password, there is no means of verifying their identity, so access or deletion requests for that account cannot be processed.
- If we refuse a request or carry it out only in part, we will tell you why, and you can object at the same contact.
- We do not accept sign-ups from children under 14. If we learn that a child's personal information has been processed, we delete it.
Common & Account · C7. Security measures (all users)
- All communication is encrypted with HTTPS.
- The password itself is never sent to the server. The Starlit Whale Account server hashes the verifier computed in the browser once more and stores that.
- The login cookie is set so that scripts in the browser cannot read it (HttpOnly) and it is sent only over HTTPS (Secure).
- Sign-in state records, email links and one-time sign-in codes are stored as hashes, not as the original values.
- Account activity records never contain passwords, verifiers, codes, tokens, cookies, full email addresses or Google tokens.
- Changing or resetting your password, unlinking Google or deleting your account also signs you out everywhere else (website and game).
- Sign-ins, sign-ups and email requests are limited to block random guessing and excessive requests.
- Signing in as a member does not grant access to the admin features of the website or game.
Common & Account · C8. Cookies on the account screen
| Name | What and why | Retention |
|---|---|---|
| Login cookie | Keeps you signed in on the account screen | 30 days |
| Google sign-in check cookie | Confirms that the browser that started Google sign-in is the same one that returned | 10 minutes |
| Pending sign-up cookie | Keeps your progress while you sign up with Google | 10 minutes |
| Language cookie | Remembers the language you selected | 365 days |
You can refuse or delete cookies at any time in your browser settings; if you refuse the login cookie, you cannot sign in.
Common & Account · C9. Privacy officer (all users)
These services are run by an individual, and the Operator personally serves as privacy officer for all Starlit Whale services, handling inquiries, complaints and remedies.
- Privacy officer: StarlitWhale
- Email: ryuhaneul@starlitwhale.com — inquiries to this mailbox are handled with the help of AI tools.
- Inquiries you do not want handled by AI: no-ai@starlitwhale.com — inquiries to this mailbox are not handled with AI tools, and replies may take longer.
Common & Account · C11. Changes to this policy (all users)
- If this policy changes, we will announce the changes and the effective date on this page, and publish previous versions of the policy and the period each applied at https://accounts.starlitwhale.com/privacy/versions?lang=en. Significant changes, such as changes to the items processed or the purposes, are announced separately with a table comparing the policy before and after.
- We do not ask for your consent again when this policy changes. We ask again for a consent only when what you consented to changes, such as the items or purposes processed with that consent.
Website (starlitwhale.com)
Website · H1. Personal information processed and purposes
| Category | Information | Purpose |
|---|---|---|
| Inquiries (the [Required] consent to collection and use of personal information on the inquiry form — only when you send an inquiry) | Name, email address, inquiry type, inquiry content, site language, receipt time | Reviewing and answering inquiries |
| Inquiry email replies (if you reply) | Body of the email sent in reply to our answer, sender address, receipt time | Continuing the same inquiry |
| Automated submission prevention (required when sending an inquiry) | Browser information, IP address | Blocking automated inquiry submissions |
| Language selection (automatic) | Selected language (cookie) | Showing the same language on the next visit |
| Member sign-in (required when a member signs in) | Starlit Whale member number, username or display name (a copy received from the Starlit Whale Account), sign-in state (login cookie and server session records) | Keeping members signed in on the website, showing the signed-in member in the header |
| Sign-in processing (required when a member signs in) | Value identifying the browser that started sign-in, website address to return to after sign-in | Processing sign-in through the Starlit Whale Account |
Website · H2. Retention and destruction
- Inquiry information (including inquiry email replies) is destroyed without delay when five years have passed since the response was completed or deletion is requested, whichever occurs first, or when the website ceases operation.
- Member sign-in information is deleted 30 days after sign-in, when you sign out, or when you delete your Starlit Whale Account. If you change your password or unlink Google in your Starlit Whale Account, it is deleted when the website next checks your account status (every 5 minutes).
- Sign-in processing records are deleted after 10 minutes or when sign-in is completed.
- Electronic files are deleted using methods that prevent recovery.
Website · H3. Outsourcing and overseas transfer
For server operation and responding to inquiries, the Operator entrusts the processing described below, and personal information is transferred outside Korea as a result. These transfers are based on Article 28-8(1)3 of the Personal Information Protection Act of Korea (overseas outsourcing and storage).
| Recipient (contact) | Work entrusted | Destination country | Items transferred | Time and method of transfer | Retention period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (dpo@cloudflare.com) | Server operation, data storage, automated submission prevention, email reception | United States and other countries where Cloudflare data centers are located | Items in the table in H1 | Network transmission when using the website or submitting an inquiry | Retention period in H2 |
| Anthropic, PBC (privacy@anthropic.com) | Preparing draft replies to inquiries (AI) | United States | Inquiry type, inquiry content, site language, inquiry email reply content (excluding sender addresses) | Network transmission when preparing a reply | After draft-generation processing, subject to Anthropic's retention period |
The inquiry content sent to Anthropic is configured not to be used for training AI models.
You may refuse overseas transfer. If you refuse, you cannot use the inquiry form; please contact us directly at the email address in C9.
Website · H4. How to exercise your rights
Requests to exercise the rights in C6 sent to the email address in C9 will be handled without delay after identity verification. Member sign-in on the website can be ended by signing out, and Starlit Whale Account information can be managed directly on the account screen as described in C6.
Website · H5. Security measures
The website uses authentication for access to the admin screen, access permission restrictions, and encryption in transit (HTTPS). Member sign-in state records are stored as hashes, not as the original values.
Website · H6. Cookies
You may refuse or delete cookies in your browser settings, and you can still use the website if you refuse them (if you refuse the login cookie, only member sign-in is unavailable).
- Language cookie: remembers the selected language (retained for one year)
- Login cookie: keeps members signed in (30 days, HttpOnly and Secure)
- Sign-in check cookie: confirms that the browser that started sign-in is the same one that returned (10 minutes)