Privacy Policy
1. Who We Are
This policy applies to the StarHunter mobile game and its official website.
- Data Controller: GCDM Limited (Chinese name 金俊數位行銷有限公司)
- Taiwan business registration number: 42885050
- Registered address: 11 F.-1, No. 631, Sec. 1, Chongde Rd., Dingcuo Vil., North Dist., Taichung City 404511, Taiwan (ROC)
- Telephone: +886-4-2238-2060
- Privacy contact email: service@skyhunter.cfd
- We have not appointed a dedicated Data Protection Officer; all privacy matters go to that address
2. Scope
This policy explains how we collect, use, share, and retain your personal data when you use the game and the official website.
We are established in Taiwan (ROC), so Taiwan's Personal Data Protection Act applies. For users in the European Economic Area, the EU General Data Protection Regulation (GDPR) also applies; for California residents, the California Consumer Privacy Act (CCPA) also applies.
Our launch markets are Taiwan and Western markets. Laws applicable in any further market will be added to this section before we launch there.
3. Data We Collect
| Category | Content |
|---|---|
| Account identifiers | Account id, nickname, home region, locale, timezone |
| Sign-in and contact data | Your email address, where you register, verify, or reset a password by email; and the user identifier supplied by Apple or Google when you sign in with them |
| Connection and security logs | IP address, browser or device identifier string (user agent), and sign-in times — used to keep you signed in, and for account security and fraud prevention |
| Device data | Device identifier, push token |
| Gameplay data | Battle records, equipment and inventory, progression |
| Payment data | Purchase history, order records |
| Sensor data (compass / gyroscope) | The azimuth and elevation of a scan. Coordinates are never uploaded — see the note below |
| Identity & fulfilment data | Legal name, national ID, phone, shipping address, tax forms — collected only when physical fulfilment is triggered |
About the location permission: the game asks for your device location permission because iOS only provides true-north compass heading while location services are running; we use it to work out which way your phone is pointing. Your coordinates are never sent to our servers and are never stored. You can turn the permission off in system settings, after which heading falls back to less accurate magnetic north.
4. How We Use Data
- Operating and maintaining the service (accounts, progression, combat, leaderboards)
- Anti-cheat and account security
- Customer support and troubleshooting
- Payment and order processing
- Physical fulfilment and tax reporting (only when fulfilment is triggered)
- Product messages and marketing push (offer recommendations, win-back and similar). You can turn these off at any time in the in-game settings or your device settings, and for users in the European Economic Area marketing push is off by default and sent only after you switch it on. We do not give your personal data to third parties for their own marketing
5. Legal Bases for Processing
For users in the European Economic Area, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account, providing the game, handling payments | Performance of a contract (GDPR Article 6(1)(b)) |
| Anti-cheat, account security, preventing fraud and abuse | Legitimate interests (Article 6(1)(f)) — keeping the game fair and protecting other players |
| Keeping financial and audit records, responding to authorities | Compliance with a legal obligation (Article 6(1)(c)) |
| Marketing push | Your consent (Article 6(1)(a)) — withdrawable at any time, without affecting earlier processing |
| Identity and tax data for physical fulfilment | Contract performance and legal obligation |
For users in Taiwan, the processing above falls within the specific purposes permitted by Article 19 of the Personal Data Protection Act.
6. What Happens If You Do Not Provide Data
You may choose not to provide data, but it affects what you can use:
- Account and sign-in data: without it you cannot create an account or sign in, and progress cannot be saved
- Email address: without it you cannot register, verify, or reset a password by email; you can still use Apple or Google sign-in
- Push token: without it you receive no notifications; nothing else is affected
- Location permission: without it heading falls back to less accurate magnetic north, and the game still works
- Identity and fulfilment data: without it physical fulfilment cannot complete; the rest of the game is unaffected
7. How Long We Keep Data
| Data type | Retention |
|---|---|
| Account identity records | Retained while active; account closure is an immediate hard delete with no grace period |
| Connection and security logs (IP, user agent) | For the life of the sign-in session; cleared when it expires or you sign out |
| Battle records (detail) | 90 days |
| Battle session records | 1 year |
| Anti-cheat logs | 1 year |
| Audit logs | Survive account closure, with the actor field nulled |
| Financial / order records | Order vouchers for at least 5 years after the annual closing; accounting books and financial statements for at least 10 years |
| Permanent-ban list (de-identified) | 3 years, with the need for it reviewed annually |
Once a retention period ends we delete the data, or de-identify it so it can no longer be linked back to you.
8. Account Closure and Deletion
You can close your account yourself. Closure is not the same as deleting everything — data that directly identifies you is erased, while your game progress is retained in anonymised form. Specifically:
| Data | Treatment |
|---|---|
| Account identity records | Immediate hard delete — no grace period, no cooling-off window |
| Direct personal data (shipping address, identity data, national ID, tax forms, device identifier) | Cleared immediately |
| Game profile, equipment, inventory, battle records | Retained, attached to an anonymised profile (nickname anonymised; records not deleted) |
| Financial / order records | Retained for the applicable statutory period, with direct personal data such as addresses redacted |
| Audit logs | Retained, with the actor field nulled |
Where the contract ends because the service closes — rather than because you closed your account — Taiwan's mandatory contract rules for online game services require us to keep your account and its associated records for no less than 30 days after termination, during which you may reactivate. If you have not reactivated by the end of that period, we may delete the account and its data. Your personal game history is likewise kept for at least 30 days so you can review it.
If your account is suspended, we keep the account and the related records for the length of the suspension and for as long as handling an appeal requires, so that you can appeal and so the decision can be audited. Reactivation as described above does not apply in that case.
9. Who We Share With
| Processor | Purpose |
|---|---|
| Cloudflare, Inc. (USA) | Application hosting, edge compute, connection pooling, caching |
| Neon, Inc. (database located in Singapore) | Primary database |
| Resend (USA) | Transactional email (registration verification, password reset) |
| Apple Inc. (USA) | Sign in with Apple, App Store payments, iOS push notifications |
| Google LLC (USA) | Google sign-in, Google Play payments, Android push notifications |
| RevenueCat, Inc. (USA) | In-app purchase and subscription state management |
| Logistics providers | Physical fulfilment delivery, once that feature is available |
Beyond those processors we share your data only where a court or competent authority lawfully requires it; where it is necessary to protect the rights, property, or safety of us or others; and on a merger or transfer of assets, where the recipient takes on the same obligations under this policy. We do not sell your personal data.
10. International Transfers
Our primary database is located in Singapore. Your data may be transferred to and processed in countries other than your own.
We rely on Standard Contractual Clauses as the legal basis for international transfers, and require each processor to give equivalent data-protection commitments.
11. Cookies and Similar Technologies
The official website uses no tracking or advertising cookies and embeds no third-party analytics. It serves static content and does not require you to sign in.
The game itself uses no browser cookies; what keeps you signed in is an authentication credential stored on your device, which stops working when you sign out or close your account.
12. Automated Decisions and Anti-Cheat
We use automated rules to detect cheating and anomalous behaviour — for example implausible tap rates or impossible changes in game values. Those rules can lead to feature restrictions or account suspension.
Where a decision could significantly affect you, you can ask for human review: write to service@skyhunter.cfd to appeal, and a person will re-examine it and reply within 30 days. In the European Economic Area this right arises under GDPR Article 22.
13. Your Rights
- Access and portability: we provide a full data export within 30 days
- Erasure: exercise it through in-game account closure, or by writing to ask us to delete; effect as described in section 8
- Rectification: you can change your nickname in the in-game Profile screen; for anything else, write to us
- Objection or restriction: within the scope of the GDPR you may object to or ask us to restrict specific processing — write to us to exercise this
- Withdrawal of consent: consent to marketing push can be withdrawn at any time, without affecting processing carried out beforehand
- Human review of an automated decision: see section 12
- Complaint to a supervisory authority: the competent authority for this service is Taiwan's Ministry of Digital Affairs; users in the European Economic Area may also complain to their national data protection authority
To exercise these rights, write to service@skyhunter.cfd or call +886-4-2238-2060. We will not treat you differently for exercising them.
14. Additional Rights for California Residents
If you are a California resident, in addition to the rights above you may ask us to disclose the categories of personal data we collected in the past 12 months, their sources, the purposes we used them for, and who we shared them with.
We do not sell personal data, and we do not share it for cross-context behavioural advertising, so there is no sale or sharing for you to opt out of. We will not discriminate against you for exercising your CCPA rights.
15. How We Protect Your Data
- Personal data is encrypted at field level
- Encryption keys rotate automatically every 90 days
- Access to personal data is permission-controlled and audit-logged
- All traffic uses HTTPS
16. Data Security Incidents
If personal data is breached in a way that could harm you, we will notify you as soon as we have established the facts, using the contact details you registered, describing what happened, what we have done, and what you can do — and we will notify the authorities as the law requires.
17. Children and Minors
This service is not directed to children under 13, and we do not knowingly collect their personal data. Anyone under 18 needs their legal guardian's consent to use the service.
We do not collect age data at registration. If we learn that an account belongs to a child under 13, we will disable it and delete the personal data. If you are a parent or guardian and believe your child gave us personal data without your consent, write to service@skyhunter.cfd and we will delete it promptly.
18. Changes to This Policy
We may update this policy. We will announce material changes in the game 30 days before they take effect, and update the last-updated date on this page at the same time.
19. Contact Us
GCDM Limited (金俊數位行銷有限公司) | Taiwan business registration number 42885050
11 F.-1, No. 631, Sec. 1, Chongde Rd., Dingcuo Vil., North Dist., Taichung City 404511, Taiwan (ROC)
Tel +886-4-2238-2060 · Email service@skyhunter.cfd