Information we collect, including Google user data
Tedtech Limited, a company registered in Hong Kong under registration number 79756238, operates StarryKit. We collect account and authentication details such as your name, email address, profile image, linked provider, account identifiers, sessions, and security records; content you submit or create, including prompts, conversations, documents, uploaded files, images, references, edits, and exports; product, device, performance, security, billing, transaction, and support information. If you sign in with Google, we receive the basic profile information you authorize, such as your Google account identifier, name, email address, and profile image. Ordinary Google sign-in does not give StarryKit access to Google Drive. If you choose Export to Google Slides, StarryKit requests the limited drive.file permission so it can create and manage the presentation generated for you and files you explicitly create or open through StarryKit; it does not grant general access to your Drive.
How we use information and Google user data
We use information to create and authenticate accounts; provide workspaces, AI-assisted visual creation, direct editing, storage, rendering, exports, billing, and support; secure sessions; prevent fraud and abuse; diagnose failures; improve the user-facing service; communicate account, security, export, billing, support, and policy notices; and comply with law. Google user data is used only to sign you in, secure and link your account, perform the Google Slides export you request, and support that feature. StarryKit does not sell personal information or Google user data, use it for advertising or creditworthiness, or use account information, prompts, documents, assets, conversations, or Google user data to train or fine-tune generalized AI models.
Cookies and similar technologies
StarryKit uses a first-party consent cookie for 180 days to remember your choices; authentication sessions, security controls, and locale preferences are necessary or user-requested storage. PostHog analytics, DOM autocapture, Web Vitals, and privacy-reviewed Product App Session Replay stay off until you accept Analytics. The automatic Google One Tap prompt stays off until you accept Functional storage; a Google sign-in button you choose remains available as a requested action. The Contact form sends one functional Survey response with a one-time submission identifier and does not use a persistent PostHog browser identity. You can accept, reject, customize, or later withdraw optional consent from Cookie settings in the Marketing footer. Withdrawing Analytics stops further browser collection and clears PostHog browser persistence. PostHog is the analytics and Contact Survey provider; Google provides One Tap. Optional browser storage follows your 180-day consent choice, while providers retain accepted submissions and collected events according to their applicable service and retention settings.
Storage, service providers, and disclosure
We do not sell personal information. We disclose information only as needed to service providers that support authentication, hosting, databases, object storage, AI and image processing, document parsing, email, analytics, security, support, payments, and exports; when you direct an integration or export; to protect StarryKit, users, or others; in a business transaction subject to appropriate safeguards; or when required by law. Linked-account records and OAuth credentials are kept on StarryKit's server-side authentication boundary, and an export worker receives access only for the active export. Temporary images used for Google Slides are deleted when the job reaches a final state, with a 24-hour lifecycle as a fallback. Providers may process information outside Hong Kong under appropriate contractual, organizational, and technical safeguards. StarryKit's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
AI features and user content
When you use an AI feature, StarryKit sends the prompts, document context, references, images, and instructions needed to perform your request to the relevant model or processing provider. Providers process this information to return the requested result and operate the feature. StarryKit currently does not use your account information, prompts, documents, assets, conversations, or Google user data to train or fine-tune its own or other generalized AI models. If this changes, we will update this policy before using information for the new purpose and obtain consent where required. Do not submit sensitive personal information or third-party material unless you have the right and a genuine need to process it; AI outputs can be inaccurate and should be reviewed before use.
Retention and deletion
We retain information only as reasonably necessary to provide StarryKit, maintain security and recovery, resolve disputes, and meet legal, tax, accounting, and audit obligations. Account, workspace, document, and conversation data is generally retained while the account or relevant workspace remains active, unless you delete it or request deletion. Temporary drafts and exports may use shorter operational lifecycles; current export files and temporary Google Slides assets use a 24-hour lifecycle. When you confirm account deletion from the verified email link, your authentication identity, sessions, linked sign-in accounts, and passkeys are deleted immediately, and a durable background process then permanently deletes the workspaces you own together with their folders, documents, version history, document assets, AI conversation history, references, uploads, exports, and the private stored files behind them. That process is asynchronous and retries on failure, so removal is normally finished within hours rather than instantly; if it cannot finish, it stops and is completed manually. Access you were granted on other people's documents is revoked without deleting their content. We keep a limited set of records after deletion: the mapping between your account or workspace and our payment provider, kept to meet Hong Kong accounting and tax record-keeping obligations, which require business records to be retained for seven years; records of webhooks our payment provider sent us, kept for payment audit and duplicate protection, which contain the billing details that provider included; a transactional email log with the recipient address, message context, and delivery errors removed, kept for delivery integrity and anti-abuse; and content you published to the StarryKit Community under its licence, which stays available to other users. Community submissions you never published are deleted. Invoices and payment records themselves remain with our payment provider under its own retention policy. Encrypted backups are not edited to remove a single account, so a deleted account may persist in a backup until that backup is superseded. Contact us to request deletion of remaining personal information; unless retention is required or permitted by law, we will delete or de-identify it.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of personal information, receive a copy of it, withdraw consent where processing relies on consent, and complain to a privacy or data protection authority. You can update available account information, cancel a subscription through available billing controls, and revoke StarryKit's Google permissions in your Google Account. Revocation prevents future Google access but does not itself delete information already stored in StarryKit or undo a completed export. Contact us to exercise a privacy right, disconnect a provider, or request deletion; we may need to verify your identity.
Security
We use reasonable technical and organizational safeguards, including access controls, private storage, transport security, credential isolation, and monitoring, to protect personal information. No service can guarantee absolute security. Protect your credentials and contact us promptly if you suspect unauthorized access.
Children
StarryKit accounts are intended only for people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.
Changes to this policy
We may update this policy to reflect changes to StarryKit, our data practices, or legal requirements. We will publish the updated version and revise the effective date. If a change materially affects how information is used, we will provide additional notice before it takes effect or obtain consent where required.
Contact us
For privacy questions, requests, or complaints, contact Tedtech Limited at contact@starrykit.com. Company registration number: 79756238. Registered office: FLAT 2304, 23/F, HO KING COMM CENTRE, 2-16 FA YUEN STREET, MONG KOK, HONG KONG.
