Privacy policy

SixStars (sixstars.app) is an independent fan site operated by the SixStars team, which is the controller of the personal data described here. Questions about privacy: hello@sixstars.app.

Account data. If you create an account: your email address, username and display name, and the profile details you choose to add (such as bio, platform, language and avatar style). If you sign up with email, your password is stored only as a salted hash. If you use Google Sign-In, see Google Sign-In below.

Things you save. Favorites, mission and collectible progress and preferences, synced to your account.

Community content. Posts, comments, likes, follows, blocks, reports and the images you upload (see the sections below).

Stars and tasks. Records of the Stars you earn and the task submissions you make.

Without an account, your favorites and progress are stored only on your device (see Storage on your device). We don't receive them.

Technical data. Like every website, our hosting provider processes your IP address, browser user agent and the pages requested in order to deliver the site and protect it against abuse. These server logs are kept for a short period (typically up to 30 days) and are not used to build profiles.

Messages you send us (email, corrections, appeals, takedown requests) are kept as long as needed to handle them.

If you choose Continue with Google, we ask Google only for the openid, email and profile scopes. With them we receive:

• your Google account ID (a unique identifier);
• your email address (and whether Google has verified it);
• your name;
• your profile picture (its URL).

Why: to create your SixStars account or sign you in to it, and to set up your profile: we suggest a username and display name from your name, and may show your name and profile picture as your avatar. We don't request access to your Gmail, contacts, Drive, calendar or any other Google data, and we never receive your Google password. If you choose to show your Google profile picture, it is loaded from Google's servers when people view it, so Google may receive their IP address.

Where it's stored: with our authentication and database provider, Supabase, linked to your SixStars account.

Sharing: we don't sell Google user data, we don't use it for advertising, and we don't share it with anyone except the service providers we need to run SixStars (see Service providers and sharing) or when the law requires it. People don't read it, except when needed for security, to comply with the law, or with your permission (for example, when you ask us for help).

Limited Use: SixStars' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking and deleting: you can remove SixStars' access at any time on your Google Account permissions page. This stops future sign-ins with Google but doesn't delete your SixStars account. To delete your account, including the Google data we received, use Delete account in your account settings or email hello@sixstars.app.

Public by default. Your username, display name, avatar, bio, join date, post count, follower and following counts, and the posts, comments and likes you publish can be seen by anyone, including people without an account and search engines. Your Stars balance is shown on your profile only if you allow it. Don't post anything you want to keep private.

Private profile. If you make your profile private, people who don't follow you see only your name, avatar and a note that the account is private, and new followers need your approval.

Follows and blocks. We store who you follow, who follows you and pending follow requests. If you block someone, we store the block so that each of you is hidden from the other (profile, posts, comments and search), and any follows between you are removed.

Deleting. When you delete a post or comment, or your account, it is removed from public view right away (see How long we keep it). Copies other people have already made, such as screenshots, are outside our control.

Images you attach to posts or task submissions are stored with our storage provider, Supabase. Your device resizes large images before upload, and we accept only JPEG, PNG and WebP files.

• Post images are public, like the post they belong to: anyone with the link can view them.
• Task proof images are private: only you and our moderators and admins can see them.

Photos can contain personal details, in the picture itself or in hidden metadata such as location, so please check before uploading. Images are deleted together with the post, submission or account they belong to (see How long we keep it).

Stars are a free points feature on SixStars. To run it, we keep a ledger of every change to your Stars (daily check-ins and streaks, daily spins, approved tasks, admin adjustments and reversals) with the date and amount, plus your current balance and streak.

Tasks. When you submit proof for a task, we store what you send (text, a link or an image), its status and the review: who reviewed it, when, and any note.

We use these records to award Stars, apply the rules (such as one check-in per day) and prevent abuse. Stars have no monetary value; see our terms of use.

Reports. When you report a post, comment or profile, we store who reported what, the reason and any details you add. We don't tell the reported person who reported them.

Moderation records. When moderators act (hiding, restoring or removing content, handling reports, suspending accounts), we record what was done, by whom and when.

Admin audit log. Every action in our admin panel is logged with the staff account, the time and what changed (before and after), so that staff actions can be checked.

Security and rate limiting. To stop spam, abuse and attacks, we limit things like sign-in attempts, posts and uploads. For this, your IP address and request details are processed transiently and kept only in short-lived server logs (see What we collect).

We send only transactional emails that you need to use your account, such as confirming your email address, resetting your password and important notices about your account or these policies. They are delivered by our email provider, Resend, which receives your email address and the content of the message. We don't send marketing emails or newsletters.

• To provide SixStars: your account, sign-in (including with Google), syncing, your profile, posts, comments, follows, Stars and tasks. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To keep the community safe and the service secure: moderation, reports, blocks, rate limiting, abuse prevention, audit logs and fixing bugs. Legal basis: our legitimate interests (Art. 6(1)(f)).
• To meet legal obligations, such as answering valid requests from authorities (Art. 6(1)(c)).
• To answer you when you contact us: legitimate interests.
• For optional features you switch on, such as future launch-day notifications: consent (Art. 6(1)(a)), which you can withdraw at any time.

We don't use your data for advertising, we don't sell it, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Content may be hidden automatically after several reports, but a human moderator reviews it.

We use only strictly necessary cookies:

• sb-…-auth-token — keeps you signed in (set by our sign-in provider, Supabase, only when you sign in; removed when you sign out). During Google sign-in a short-lived sb-…-code-verifier cookie protects the login.
• ss_locale — remembers the language you picked (1 year).

Analytics without cookies. We measure page views with Vercel Web Analytics, which sets no cookies, stores nothing on your device and doesn't track you across sites. It counts visits in aggregate (page, referrer, country, device type) and doesn't build profiles.

Because we use no advertising, tracking or consent-requiring cookies, there's no cookie banner. If that ever changes, we'll update this policy first and ask for your consent where the law requires it.

To work fast, SixStars stores some data in your browser. It never leaves your device unless you sign in and sync:

• Local storage — guest favorites and progress (ss:user:v1) and whether you dismissed the install suggestion (ss:pwa:install).
• Cache storage — recently visited pages, images and app files, so pages load quickly and can still open if your connection drops.

You can clear all of it in your browser settings (Site settings → Clear data).

Trailers are embedded with YouTube's privacy-enhanced mode (youtube-nocookie.com). When you press play, YouTube (Google) may process data under its own privacy policy. Links to other websites are governed by those sites' policies.

We share personal data only with the service providers we need to run SixStars, under contracts that limit them to processing it on our behalf:

• Supabase: database, authentication and file storage;
• Vercel: hosting, content delivery and cookieless analytics;
• Resend: transactional email delivery;
• Google: sign-in, if you choose Continue with Google;
• Sentry (only if we turn on error reporting): crash and error reports used to fix bugs, with emails, IP addresses and cookies removed before they are sent.

Content you make public (your profile, posts and comments) can be seen by everyone, as described above. We disclose data to authorities only when legally required. We never sell or rent personal data.

Our providers may process data in countries other than yours. Where data leaves the EEA, UK or Switzerland, we rely on adequacy decisions or Standard Contractual Clauses.

• Account data, profile, favorites, progress, follows, blocks, Stars records and task submissions: until you delete your account.
• Posts, comments, likes and images: until you delete them or your account.
• Content removed by moderators: kept hidden for up to 12 months (to handle appeals and repeated abuse), then deleted.
• Reports: up to 12 months after they are handled.
• Moderation records and the admin audit log: up to 12 months.
• Server and security logs: typically up to 30 days.
• Emails you send us: as long as needed to handle them.

Deleted data is removed from our active systems promptly, and from backups as they roll off, within about 30 days. Reports, moderation records and audit log entries may be kept for the periods above even after an account is deleted. If the law requires us to keep something longer, or we need it to establish or defend legal claims, we keep only what is necessary, for only as long as necessary.

Wherever you live, you can:

• Export your data: download a copy of your account and profile data, favorites, progress, posts, comments, likes, follows, blocks, the reports you've made, Stars records and task submissions (as a JSON file) from your account page. For a copy of the image files you uploaded, email us.
• Correct your profile at any time in your account settings, or ask us to correct other data.
• Delete your account and data from your account page, or by emailing hello@sixstars.app.
• Access your data, restrict or object to processing (including processing based on our legitimate interests), and withdraw consent at any time: email hello@sixstars.app.

If you're in the EEA, UK or Switzerland, you can also complain to your local data protection authority. We answer requests within 30 days, and we may need to confirm that a request comes from the account owner.

We collect the categories of data described above (identifiers, account data and internet activity limited to this site) for the purposes described above. We do not sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information. You have the right to know, delete and correct your data and to be free from discrimination for exercising those rights. We honor Global Privacy Control signals.

SixStars is not directed to children under 13. You must be at least 13 to create an account, or older if the law in your country requires it (for example, the age of digital consent in your EU country, which can be up to 16). We don't knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we'll delete it.

SixStars is served only over HTTPS with strict security headers. Passwords are never stored in plain text, and access to production data is limited to the people who need it.

If we change how we handle your data, we'll update this page and the date above. For significant changes affecting account holders, we'll also notify you by email or in the app before they take effect.

This version is effective from October 6, 2026.