Privacy Policy

Last updated: May 27, 2026

← Back to sign in

This Privacy Policy describes how Star Auth ("we", "us") collects, uses, and shares information when you use our authentication service at auth.starhk.uk ("Service").

1. Information We Collect

Depending on how you sign in, we may collect:

• Account identifiers: email address, display name, avatar URL, and internal user ID;
• Identity provider data: when you use Google sign-in, we receive information made available by Google (such as your Google subject identifier, email, and profile details) according to your Google account settings;
• Verification data: one-time codes sent to your email and related delivery metadata;
• Technical data: IP address, user agent, timestamps, and security logs associated with authentication events;
• Site context: the site identifier and redirect URL provided when you start login, so we can return you to the correct application after authentication.

2. How We Use Information

We use collected information to:

• authenticate you and issue session tokens or authorization codes;
• operate, secure, and improve the Service;
• detect fraud, abuse, and unauthorized access;
• comply with legal obligations; and
• support Site operators in managing their integrated applications.

3. Legal Bases (EEA/UK Users)

Where applicable, we process personal data based on: performance of a contract (providing authentication at your request), legitimate interests (security and service operation), and consent where required (for example, optional marketing by a Site, not by Star Auth itself).

4. Sharing of Information

We may share information with:

• Participating Sites: when you complete login, we share necessary account information and tokens with the Site identified in your login request, as configured by that Site's operator;
• Service providers: such as email delivery (e.g., Resend), cloud hosting (Cloudflare), and identity providers (Google), under appropriate agreements;
• Legal and safety: when required by law or to protect rights, safety, and security of users and the Service.

We do not sell your personal information.

5. Data Retention

We retain account and authentication records for as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. Verification codes and short-lived tokens are deleted or expire automatically after brief periods.

6. Security

We implement technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure; you should also protect your email and devices.

7. International Transfers

Data may be processed in jurisdictions where our infrastructure and service providers operate. Where required, we rely on appropriate safeguards for cross-border transfers.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, and to object to certain processing or withdraw consent. To exercise rights regarding data held for a specific Site, contact that Site's operator. We will assist Site operators as needed to fulfill requests relating to Star Auth processing.

9. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have done so, contact us so we can delete the information.

10. Cookies and Similar Technologies

The login experience may use session storage or cookies necessary for authentication flows. Third-party sign-in providers may set their own cookies when you use their buttons.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated "Last updated" date. Material changes may be communicated through the Service or participating Sites where appropriate.

12. Contact

For privacy inquiries related to Star Auth, contact the administrator of the Site you use or reach out through channels published by StarHK for auth.starhk.uk operations.