Starlit

Privacy policy

What Starlit collects, why, with whom it is shared, and your GDPR rights.

Last updated: 1 November 2026

1. Who operates Starlit?

Starlit is a project operated under the RRMTools name. For personal-data questions, contact support.starlit@rrmtools.uk. RRMTools is used here as a project/brand name, not a claim of registered company status. The operator's formal legal identity and postal address still require confirmation for full public-service disclosures; see our legal information.

2. Information we process

  • Google sign-in: Google verifies your identity and may supply a unique Google account identifier, verified email address, name, and profile image. We do not receive your Google password or request access to Gmail, Drive, or contacts.
  • Account approval: verified applicant email, provider identifier, request time, review status and a time-limited private review link. With email/password signup, the proposed password is temporarily encrypted while the request is pending.
  • Approved account: internal user ID, email, linked sign-in identifiers, sessions and account administration records required for authentication.
  • Optional synchronization: profiles, library, saved collections, watch history, playback position, settings, addon/plugin configuration, and where a sync feature explicitly supports them, connected-provider credentials or tokens. Device metadata can include a client identifier, platform, app version or device name.
  • Technical/security records: connection and request metadata, such as IP addresses, can be processed by infrastructure and security providers. The signup rate-limiter stores keyed IP fingerprints instead of plaintext IPs.
  • Local-only items: downloaded media, caches and certain settings are stored on your device. Removing the cloud account does not automatically remove files from other devices.

3. Purposes and legal grounds

  • GDPR Article 6(1)(b): processing necessary to review an access request, establish an approved account, authenticate you, and supply the optional synchronization service you request.
  • GDPR Article 6(1)(f): proportionate anti-abuse rate limiting, account protection, and security investigations, subject to balancing your rights against those legitimate interests.
  • GDPR Article 6(1)(c): any processing needed to meet an applicable legal obligation.

Google sign-in is optional if an alternative is offered. An approved account needs essential identity and session data to function. Approval is a human decision, not a decision based solely on automated profiling.

4. Who receives data and international transfers?

Google handles your Google authentication; Cloudflare and hosting providers help deliver and secure services; email infrastructure sends approval notices to the designated administrator. The administrator sees application email addresses and approval status. We do not sell personal data or use Google identity information for advertising.

External addons, metadata services, media sources and linked providers are independent. They may receive media queries, service identifiers and connection information under their own policies. If you use peer-to-peer transfers (including BitTorrent), other peers may see your IP address. Some providers may process information outside the EEA; specific safeguards depend on provider contracts and destinations. Request details through our contact email.

5. How long do we retain information?

Pending sign-up requests expire after seven days and are removed by the service's next cleanup operation; denied or completed pending requests are removed from that store. Google OAuth request states expire after around ten minutes, and admin-session cookies after around four hours. Rate-limit records are periodically pruned.

Active account and sync data remain as long as required to provide the account service or until a valid deletion request is implemented, subject to mandatory legal/security retention. Backup and operational-log retention schedules must be verified against deployed infrastructure before being described as fixed periods; these may temporarily retain copies after an account deletion.

6. Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, data portability or object to processing based on legitimate interests. Contact support.starlit@rrmtools.uk and include the email associated with your Starlit account, but not a password or token. We may require proportionate identity verification. We aim to respond within one month, subject to legally permitted extensions.

You may complain to the Portuguese data protection authority CNPD or another competent supervisory authority. See account deletion.

7. Security, changes, and minors

Starlit uses transport encryption, administrative access controls, application-level authorization and anti-abuse measures. No system can guarantee absolute security. We may update this policy when practices change; the effective date is shown above. Starlit is not intentionally marketed to children; if you are a parent or guardian concerned about a child's data, please contact us.