← Back to home

Privacy Policy

Version 2026-09-28 · Effective 28 September 2026 · Website disclosures clarified 16 October 2026

1. Controller and scope

Starline Studios is the controller for personal data processed through the Creature mobile game, this website and our support channels. More information is available in our Imprint. Contact: info@creature-ai.org. This policy applies worldwide; additional local rights are described below.

2. Data we process

3. Why we use data and our legal bases

For people in the EEA, UK and Switzerland, we process data to provide the Service and verify purchases (Art. 6(1)(b) GDPR); meet legal duties, including tax/record-keeping duties (Art. 6(1)(c)); protect the Service, users, rights, and defend legal claims (Art. 6(1)(f)); and, where required, on consent (Art. 6(1)(a)), such as personalised advertising choices. We do not use special-category data intentionally. Where you voluntarily enter such data in a message, please do not include sensitive information unless necessary.

4. Age assurance and children

Creature is for people aged 13 or older. Where supported, we request an app-store age signal to determine safe feature access; for United States users, a store may require age or parent/guardian verification before sharing that signal. We use the signal only for age-appropriate access and legal compliance, never for advertising, profiling or behavioural targeting. Without an appropriate signal, we may offer only the controlled 13+ core experience and disable purchases, rewarded ads, optional public profiles, friend discovery and community/chat functions. The completed Season Book is a public game ranking as described above.

We do not knowingly permit children under 13 to create or use an account. If you believe such data was provided, contact us so that we can investigate and delete it as required. A parent or guardian may exercise rights on behalf of a child where applicable.

5. AI-generated content

Creature uses an external AI-image provider to create game images from predefined, safety-controlled game parameters. Generation may be processed by OpenAI and its service providers under the provider’s business terms. We use the output to deliver the game, detect misuse, moderate public content and improve or market Creature in accordance with the Terms. AI output can be unexpected or imperfect; it is not professional advice and should not be treated as factual. If we add a material new AI purpose, provider or model that changes this processing, we will update this policy and request consent where required.

6. Recipients, processors and international transfers

We share data only where needed to operate the Service, comply with law, protect users, or with your direction. Recipients may include:

Providers may process data in the United States and other countries. For restricted transfers from the EEA, UK or Switzerland, we rely on an adequacy decision where available or suitable safeguards such as the EU Standard Contractual Clauses, together with supplementary measures where appropriate. Their current privacy materials are available from Firebase, Google, OpenAI and, for iOS, Apple.

7. Advertising and your choices

Rewarded ads are optional, are not shown to accounts without adult access, and are requested only after the required consent flow has allowed advertising. Google’s User Messaging Platform provides a privacy-options route where applicable. You can decline consent where the law gives that choice; this can mean that rewarded ads are unavailable. We do not sell personal data for money. Depending on local law and Google’s ad delivery, an advertising identifier or device data may constitute a “share” for cross-context behavioural advertising; eligible users can exercise choices in the consent/privacy-options flow and by contacting us. We do not knowingly sell or share personal information of people under 16.

Website analytics

Google Analytics loads only after you choose “Allow analytics”. It measures page visits and interactions with our website links so we can understand how people find and use the site. Google may receive browser and device information, page URLs and interaction events. Our pageview configuration uses the page's canonical URL without query strings or fragments, limits the referrer to its origin, and sends only the button label in our custom click event. We do not send your Creature account ID through this website integration. You can decline analytics and still use the site. Your choice is saved in your browser's local storage and can be changed using “Privacy settings”; withdrawing consent stops future analytics collection on this browser.

8. Support, moderation and automated assistance

We may review public content, reports and support requests using authorised humans, contractors and safety/automation tools. If we introduce generative-AI assistance to answer support requests or to assist moderation, it will be used under human oversight appropriate to the risk, with access limited to what is needed, and this notice will be updated when the change is material. Do not send passwords, payment data, health data or other sensitive information in a support request.

9. Retention

We retain data only as long as needed for the stated purposes. Account and active game data are retained while the account remains active. On verified account deletion, we delete or de-identify associated data unless we need it for fraud/security, a dispute or a legal duty. Current operational periods are: ordinary community messages up to 180 days; closed support tickets up to 24 months; reports and moderation evidence up to 12 months after resolution; age/Terms acceptance records up to 3 years after account deletion; and purchase/tax records for the statutory retention period (normally up to 10 years under German record-keeping law). Security logs are retained for a limited period appropriate to security and incident response. Backups expire on their normal cycle and may retain a copy until that cycle completes.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, and appeal a rights decision. EEA/UK/Swiss users may also complain to their local data-protection authority; our lead local supervisory authority is the Lower Saxony Data Protection Authority. California and other U.S. state residents may request to know, access, correct, delete, or opt out of sale/sharing where applicable, without unlawful discrimination. Submit a request to info@creature-ai.org. We may need to verify the request and will respond within the period required by law. An authorised agent may act where local law permits and adequate authority is provided.

11. Security, changes and contact

We use measures appropriate to the risk, including encryption in transit, access controls, service-provider controls, app-integrity checks and server-side verification. No system is perfectly secure. We may update this policy for legal, security, operational or product changes. For material changes, we will provide notice and obtain new consent where required. For questions or privacy requests, contact info@creature-ai.org.