Privacy Policy

Last updated: 3 October 2026 · Deutsche Fassung

This is a translation of our German privacy policy. If the two versions differ, the German version applies.

1. Controller

Oliver Strebel-Mark, Emmericher Weg 76a, 47574 Goch, Germany, email: hallo@starpair.app.

2. Principle

Starpair sends two people one short impulse each every morning. The impulses are stored in the app on your device and are selected there. Our server knows neither the text of your impulses nor that of your partner's. It stores only what is necessary so that you can connect, react to each other and receive notifications.

3. What we process

• Sign in with Apple: an identifier issued by Apple that is unique to Starpair and, if you share it, your first name. We do not ask for an email address.
• Profile: your first name and the language of the app, so that your partner sees your name and notifications arrive in your language.
• Duo: who is connected with whom, your anchor date and its occasion, invitation codes (valid for seven days), and your choice regarding the “Spicy” category.
• Reactions: the emoji and the day, not the impulse you reacted to.
• Pronouns, wishes and preferences (your answers to the questionnaire at the start): end-to-end encrypted only. Your device encrypts them for your partner's device; we store only the encrypted result and public keys and cannot read them.
• Notifications: your device's push token, so that we can send you notifications (for example when your partner reacts).
• Subscription: which subscription you have and until when it runs (see section 5).

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). You only receive notifications if you allow them on your iPhone.

4. Service providers

• Supabase (Supabase Inc., USA) operates our database on servers in Frankfurt am Main, Germany. A data processing agreement with EU Standard Contractual Clauses is in place with Supabase.
• Apple (Apple Distribution International Ltd., Ireland) for sign-in, delivery of notifications (Apple Push Notification service) and processing of purchases in the App Store. Apple's privacy policy also applies.
• RevenueCat (RevenueCat Inc., USA) manages subscriptions. RevenueCat receives a random identifier of your Starpair account, information about purchases and technical device data. The transfer to the USA is based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
• Cloudflare (Cloudflare Inc., USA) provides this website and the invitation links. Cloudflare processes technically necessary connection data such as the IP address (Art. 6(1)(f) GDPR, legitimate interest in secure operation). The website uses no cookies and no tracking.

5. Subscription and payment

You buy subscriptions through the App Store; payment is handled solely by Apple. Through RevenueCat we learn whether you have a subscription, which one and when it ends, but not your payment details. Because one subscription covers your whole duo, your partner's app can see whether you have an active subscription.

6. Retention

When you end a duo, we delete the duo, your reactions and your history for both of you. We keep your profile for as long as you use your account. You can delete your account at any time in the app (Settings → Account); we then delete your profile, your duos with reactions and history, your device tokens and your subscription status, and revoke your Sign in with Apple. Statutory retention obligations remain unaffected.

7. Contact by email

If you write to us, we use your details only to answer you (Art. 6(1)(f) GDPR) and delete them once your request has been dealt with. Emails to our starpair.app addresses are forwarded by Cloudflare (Cloudflare Inc., USA, see section 4) to our mailbox at Apple iCloud (Apple Distribution International Ltd., Ireland).

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). To exercise them, contact hallo@starpair.app. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.