Starlit Whale Privacy Policy

Common & Account

StarlitWhale (the "Operator") processes the personal information of people who use the Starlit Whale services below in accordance with the Personal Information Protection Act of Korea (개인정보 보호법), and publishes it as a single privacy policy as follows. The Operator processes only the minimum personal information necessary for the purposes of processing.

Which sections apply to whom?

• Starlit Whale members: all of "Common & Account", plus the sections for the services you use (Website, Starlit Song).
• Users who are not members (visiting or sending an inquiry on the website, guests playing the game without signing in): the sections for the services you use, and C4, C6, C7, C9 and C11 of "Common & Account". If you are not a member, we do not process "Starlit Whale Account" information (C1–C3, C5, C8).

Effective date: October 28, 2026

Common & Account · C1. Personal information processed by the account and why

Information processed for membership and to perform the service agreement (required — Personal Information Protection Act of Korea, Article 15(1)4)

Information received from Google if you use Google sign-in (required for members who sign up with or link a Google account — Article 15(1)4 of the same Act)

We use the Google email address only while sign-up is pending (up to 10 minutes). The temporarily stored address is deleted immediately when sign-up completes, or by a scheduled task that runs every minute after the pending period expires. It is saved as your member email only if you use “Use Google address” during sign-up; otherwise it is not used as your member email, for contact or for advertising. Information received from Google is used only for the purposes stated in this policy, and is not given or sold to anyone else.

Information processed with consent (optional — Article 15(1)1 of the same Act)

• Your email is stored only if you agree to "Email collection and use consent (optional)" and enter it. An email address entered on the game's sign-up screen and consent to receive advertising information given there are also stored in your Starlit Whale Account, not in the game.
• Advertising information is sent only if you have agreed to receive it and verified your email. Deleting your email also withdraws your consent to receive advertising information.

Common & Account · C2. Retention periods (account)

• When you delete your account, the information above is destroyed without delay. However, the member number, deletion status and time of deletion are kept to notify each service of the deletion; these values alone cannot identify who you are.
• If the services end, any remaining information is destroyed without delay.

Common & Account · C3. Destruction procedure and method (account)

• When you delete your account, your sign-in methods (username and password, Google link), email, advertising consent status and history, records of agreement to the terms of use and privacy policy, and sign-in state are deleted from the database immediately.
• Each service you used is notified of the deletion immediately (and notified again if this fails), and each service deletes its records as described in its own section (H2, G3).
• When you delete your email or unlink Google, that information is deleted immediately.
• All information is kept only as electronic files and is destroyed by deleting it from the database.

Common & Account · C4. Provision to third parties (all users)

The Operator does not provide personal information to third parties, except when required by law. Exchanging the member number and sign-in result (username or display name) between the Starlit Whale Account and the website or game is use within the same Operator, and your email address and consent to receive advertising information are not given to the website or game.

Common & Account · C5. Outsourcing and overseas transfer (account)

To run the account, the Operator entrusts processing as below, and in the process personal information is transferred outside Korea. The matters required by Article 28-8(2) of the Personal Information Protection Act of Korea are as follows.

Common & Account · C6. Your rights and how to exercise them (all users)

Users and their legal guardians may at any time access their personal information, request its correction, deletion or suspension of processing, or withdraw consent. For Starlit Whale Account information you can do this yourself in My information on the account screen; for the website and Starlit Song, see H4 and G5.

• Access: member number, sign-up date, sign-in methods, email and verification status, advertising consent status, connected services.
• Correction: changing your email, changing or creating a password.
• Deletion: deleting your email, unlinking Google (not possible if it is your only remaining sign-in method), "Delete account".
• Withdrawal of consent: You can withdraw consent to receive advertising information at any time in My information, and it takes effect immediately. Email collection and use consent is withdrawn by deleting your email.
• For requests you cannot make on screen, please contact the address in C9. You may also make requests through a representative. If a username-and-password member who has not entered an email forgets their password, there is no means of verifying their identity, so access or deletion requests for that account cannot be processed.
• If we refuse a request or carry it out only in part, we will tell you why, and you can object at the same contact.
• We do not accept sign-ups from children under 14. If we learn that a child's personal information has been processed, we delete it.

Common & Account · C7. Security measures (all users)

• All communication is encrypted with HTTPS.
• The password itself is never sent to the server. The Starlit Whale Account server hashes the verifier computed in the browser once more and stores that.
• The login cookie is set so that scripts in the browser cannot read it (HttpOnly) and it is sent only over HTTPS (Secure).
• Sign-in state records, email links and one-time sign-in codes are stored as hashes, not as the original values.
• Account activity records never contain passwords, verifiers, codes, tokens, cookies, full email addresses or Google tokens.
• Changing or resetting your password, unlinking Google or deleting your account also signs you out everywhere else (website and game).
• Sign-ins, sign-ups and email requests are limited to block random guessing and excessive requests.
• Signing in as a member does not grant access to the admin features of the website or game.

Common & Account · C8. Cookies on the account screen

You can refuse or delete cookies at any time in your browser settings; if you refuse the login cookie, you cannot sign in.

Common & Account · C9. Privacy officer (all users)

These services are run by an individual, and the Operator personally serves as privacy officer for all Starlit Whale services, handling inquiries, complaints and remedies.

• Privacy officer: StarlitWhale
• Email: ryuhaneul@starlitwhale.com — inquiries to this mailbox are handled with the help of AI tools.
• Inquiries you do not want handled by AI: no-ai@starlitwhale.com — inquiries to this mailbox are not handled with AI tools, and replies may take longer.

Common & Account · C11. Changes to this policy (all users)

• If this policy changes, we will announce the changes and the effective date on this page, and publish previous versions of the policy and the period each applied at https://accounts.starlitwhale.com/privacy/versions?lang=en. Significant changes, such as changes to the items processed or the purposes, are announced separately with a table comparing the policy before and after.
• We do not ask for your consent again when this policy changes. We ask again for a consent only when what you consented to changes, such as the items or purposes processed with that consent.

Website (starlitwhale.com)

Website · H1. Personal information processed and purposes

Website · H2. Retention and destruction

• Inquiry information (including inquiry email replies) is destroyed without delay when five years have passed since the response was completed or deletion is requested, whichever occurs first, or when the website ceases operation.
• Member sign-in information is deleted 30 days after sign-in, when you sign out, or when you delete your Starlit Whale Account. If you change your password or unlink Google in your Starlit Whale Account, it is deleted when the website next checks your account status (every 5 minutes).
• Sign-in processing records are deleted after 10 minutes or when sign-in is completed.
• Electronic files are deleted using methods that prevent recovery.

Website · H3. Outsourcing and overseas transfer

For server operation and responding to inquiries, the Operator entrusts the processing described below, and personal information is transferred outside Korea as a result. These transfers are based on Article 28-8(1)3 of the Personal Information Protection Act of Korea (overseas outsourcing and storage).

The inquiry content sent to Anthropic is configured not to be used for training AI models.

You may refuse overseas transfer. If you refuse, you cannot use the inquiry form; please contact us directly at the email address in C9.

Website · H4. How to exercise your rights

Requests to exercise the rights in C6 sent to the email address in C9 will be handled without delay after identity verification. Member sign-in on the website can be ended by signing out, and Starlit Whale Account information can be managed directly on the account screen as described in C6.

Website · H5. Security measures

The website uses authentication for access to the admin screen, access permission restrictions, and encryption in transit (HTTPS). Member sign-in state records are stored as hashes, not as the original values.

Website · H6. Cookies

You may refuse or delete cookies in your browser settings, and you can still use the website if you refuse them (if you refuse the login cookie, only member sign-in is unavailable).

• Language cookie: remembers the selected language (retained for one year)
• Login cookie: keeps members signed in (30 days, HttpOnly and Secure)
• Sign-in check cookie: confirms that the browser that started sign-in is the same one that returned (10 minutes)

Starlit Song (ciel.starlitwhale.com)

This section applies to information specific to the game Starlit Song (the "Game"). Membership sign-up, sign-in methods, email and consent to receive advertising information follow the Common & Account section (C1).

Starlit Song · G1. Personal information processed and why

Information processed to perform the service agreement (required — Personal Information Protection Act of Korea, Article 15(1)4)

Information processed with consent (optional — Article 15(1)1 of the same Act)

• If you do not agree to statistics collection, saves and settings are not stored, and this consent is required to sign up as a member.
• When guest statistics are sent, the IP address is used only in server memory to limit the number of requests and is not stored.

Starlit Song · G2. Processing and retention periods

If the Game service ends, any remaining information is destroyed without delay.

Starlit Song · G3. Destruction procedure and method

• When you choose "Delete this game's records", the Game's member record, saves, settings, sessions, and inquiries and replies are deleted from the database immediately (your Starlit Whale Account remains). If you delete your Starlit Whale Account, the same information is deleted as soon as the Game receives the notification from the account service, or, if the notification is delayed, when the Game next checks your account status.
• When you withdraw statistics collection consent, your stored saves and settings are deleted immediately (for members, only the member record and agreement records remain).
• When you delete an inquiry yourself, that inquiry and its replies are deleted immediately.
• All information is kept only as electronic files and is destroyed by deleting it from the database.

Starlit Song · G4. Outsourcing and overseas transfer

To run the Game, the Operator entrusts processing as below, and in the process personal information is transferred outside Korea. The matters required by Article 28-8(2) of the Personal Information Protection Act of Korea are as follows.

Replies made with the AI tool are saved only as drafts and are sent after the Operator reviews them. Replies sent without changes by the Operator are labeled "AI-written reply".

Information passed on when fonts are loaded

Some fonts on the game screen are loaded by your browser directly from the external font services below, so the information below is passed to those companies. The Operator does not send any other personal information to them.

Starlit Song · G5. How to exercise your rights

You exercise the rights in C6 inside the Game as follows.

• Access: Under Settings → "Manage agreements" → "View my information" you can see the information the Game has stored on the server and in this browser, and save it as a file with "Download file".
• Deletion: Choosing "Delete this game's records" in "Manage agreements" deletes the Game's member record, saves, settings, sessions and inquiries (your Starlit Whale Account remains). You delete your account in My information of your Starlit Whale Account, which you open with "Manage account" in the "Account" area of Settings. Choosing "Withdraw statistics consent" deletes your stored saves and settings; for guests, the saves and guest records in this browser and their inquiries are deleted as well. You can delete inquiries you sent yourself on the inquiry screen.
• Suspension of processing: Choosing "Withdraw statistics consent" in "Manage agreements" stops the processing of information processed under statistics collection consent, and the stored information is deleted. You can agree again in the same place.
• Correction: Information that can be corrected (settings such as display and voice language, volume and key settings) can be changed directly in the in-game settings.
• Withdrawal of consent: You can withdraw your consent to AI processing of inquiries at any time under "Inquiry AI processing consent" in Settings → "Manage agreements". Once withdrawn, no AI drafts are made even for inquiries already sent, and AI drafts already made are not sent. Inquiries that have not yet received a reply receive a reply explaining how to contact us by email without AI processing (no-ai@starlitwhale.com), and are marked as completed.
• For requests you cannot make in the Game, please contact the address in C9. Starlit Whale Account information follows C6.

Starlit Song · G6. Security measures

• The password itself is never sent to the server. The game server does not store the verifier computed in the browser and only passes it on to the Starlit Whale Account.
• Sign-in state records and connection check values are stored as hashes, not as the original values.
• Operator features can be used only with a secret key held by the Operator. The Operator's admin screen is behind a sign-in on the Operator's server, and the secret key never goes to users' browsers.
• Failed sign-ins and the number of inquiries and sign-ups are limited to block random guessing and excessive requests.

Starlit Song · G7. Automatic collection tools (cookies and browser storage)

If you block the login cookie you cannot sign in, but you can still play as a guest. You can clear browser storage at any time in your browser settings; doing so also removes guest saves and inquiry keys. Information in browser storage exists only in your browser (guest information for which statistics collection was agreed is also kept on the server, as described in G1).