StarlyLab Privacy Policy

1. Data Controller

The data controller is Starlyware di Gianluca Grasso, Chieti (CH), Italy. For any privacy question or to exercise your rights write to info@starlyware.com.

2. In Short

• You can use StarlyLab without an account: in that case we do not ask for your name or email.
• Your lab notebook stays on your phone: experiments, measurements, recordings and photos are never uploaded to our servers.
• The camera and the microphone are used only to measure: images and sounds are analysed in memory and discarded immediately, without saving any photo or audio.
• The heart rate measured with the camera stays on your phone and is not sent to anyone.
• If you create an account, our server stores only your name, profile photo, a few counters (for example how many experiments you completed), points and badges.
• The app is free and shows ads through Google AdMob. Personalised ads are shown only if you give your consent.
• We do not sell your data.
• You can delete your account and all the related data at any time, from the app or by email (instructions).

3. Data We Process

3.1 Use without an account

The instruments, the notebook, the guided experiments and the backup work without an account. The catalogue of guided experiments is downloaded from our server and saved on the phone, without any personal data. Advertising and the statistics described in sections 3.10 and 3.11 still apply.

3.2 Account

The account is optional and is used for points, badges and the AI tutor. If you create one we process:

• your email address and password (the password is handled by Google Firebase Authentication and we never see it), or the data received from Google if you sign in with Google (name, email, profile photo);
• the name you choose and, if you add one, your profile photo, resized on the phone before it is uploaded;
• a unique account identifier (UID).

Your name and photo are visible only to you and to the StarlyLab team: there are no public profiles or leaderboards with your name.

3.3 The lab notebook

Experiment pages, measurement tables, instrument recordings (numbers only, for example acceleration or pressure over time), attached photos and PDF reports are saved only in the memory of your phone. We do not receive them and cannot read them. If you uninstall the app they are deleted, unless you have made a backup.

3.4 Backup

• Google Drive: if you turn on the Drive backup, the app saves a copy of the notebook in a hidden folder of your Google Drive reserved to the app ("drive.appdata" permission), using the storage of your Google account. The copy goes directly from your phone to Google: it does not pass through our servers and we cannot access it. StarlyLab cannot see the other files of your Drive. You can revoke the access from the settings of your Google account.
• File: you can export the notebook to a .zip file and save it wherever you want. In this case you decide where the file goes.

3.5 Progress, points and badges

With an account, the app sends to the server only counters computed on the phone: number of completed experiments (in total and per discipline), refuted hypotheses, saved recordings, different instruments used, consecutive days of activity, codes of the completed guided experiments and the "secrets" of the lab you found. The content of your experiments is never sent. The server computes your points, level and badges.

3.6 Camera, microphone and sensors

• Camera (colorimeter, heart rate): the frames are analysed in memory to get the average colour and discarded immediately. No photo is taken or saved, except the ones you choose to attach to your notebook.
• Heart rate: the measurement is computed on the phone and saved only if you record it in your notebook. We do not receive it. It is an educational experiment, not a medical device.
• Microphone (sound level meter, spectrum analyser, tuner, acoustic stopwatch): the sound is analysed in memory to get its level and frequencies. No audio is recorded or sent.
• Other sensors (accelerometer, gyroscope, magnetometer, light, pressure): the values are used only on the phone.

3.7 Location

• Your location is used only on the phone for: sunrise, sunset and the noon shadow, the distance from the Space Station, your dot on the earthquake map, the magnetic declination of the geological compass and the chance of aurora at your latitude. It is not sent to our servers.
• Weather: for the barometer and the dew point the app sends rounded coordinates (about 1 km) to the Norwegian Meteorological Institute, MET Norway (api.met.no), without any data of your account.

Location is optional: you can deny or revoke the permission at any time in the Android settings, and the instruments keep working with standard values.

3.8 AI tutor

When you ask the tutor for help, the app sends to our servers the text of the page of the chosen experiment (question, hypothesis, procedure, results, conclusion, the measurement table and a numeric summary of the attached recordings) together with your question. The server has it analysed by Google's Gemini artificial intelligence model (Google Cloud Vertex AI) and returns the answer to you. Photos and files of the notebook are never sent. The text is used only to answer your request and is not stored by us; Google processes it on our behalf as a cloud service provider. We store only the number of questions per day, to apply the usage limit. We recommend not writing personal data in the pages you send to the tutor.

Every answer of the tutor has a Report button. If you use it, we receive and store your question, the answer of the tutor, the reason you chose, your optional note, the language of the app and your user ID (not the notebook page), so that we can review the answer and improve the tutor.

3.9 "Support the developer" purchase

Payment is handled entirely by Google Play: we never receive the data of your card or payment method. To verify the purchase and award the badge we receive from Google Play the order ID, the date, the product and a purchase token, which we store in encrypted form (hash). We periodically check with Google Play whether a purchase has been refunded.

3.10 Advertising

The app shows ads through Google AdMob, including optional rewarded videos (for example for one more question to the tutor). AdMob collects the advertising ID of the device, the IP address (from which it derives an approximate location), interactions with the ads and diagnostic data, to show and measure the ads and to prevent fraud. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent through Google's form (UMP): without consent only non-personalised ads are shown. You can change your choice at any time in Profile → Ad preferences, and you can reset or delete the advertising ID in the Android settings. More information: how Google uses information from partner apps.

3.11 Statistics and technical data

• Google Analytics for Firebase: aggregated statistics on the use of the app (screens opened, session length, device model, Android version, country or approximate area derived from the IP address), through an installation identifier.
• Server technical logs: IP address, date and time of the requests and any errors, kept for security and troubleshooting.
• Language: with some requests we send the language of the phone, to answer you in your language.

3.12 External scientific data

Some instruments download public data directly from external services: earthquakes from USGS (United States) and INGV (Italy), space weather from NOAA SWPC (United States), the position of the Space Station from wheretheiss.at, weather from MET Norway. The requests contain no data of your account, but these services receive the IP address of your device according to their own policies. Likewise, external links (for example Google Play for the other Starlyware apps) open in the browser or in the store.

4. Purposes and Legal Basis

• Performance of the service you request (Art. 6(1)(b)): account, points and badges, AI tutor, purchase verification, replies to your requests.
• Consent (Art. 6(1)(a)): location, camera and microphone permissions of the device, access to the app folder on Google Drive, personalised ads. You can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f)): security of the services and prevention of abuse, aggregated statistics to improve the app, non-personalised ads that allow us to offer the app for free. You can object by writing to info@starlyware.com.
• Legal obligations (Art. 6(1)(c)): tax obligations and requests from the authorities.

5. Recipients and Providers

We do not sell or transfer your data. For the purposes above, it may be processed by:

• Google (Google Ireland Ltd and Google LLC): Firebase (authentication, database, storage of profile photos, server functions, Analytics), Google Cloud Vertex AI (tutor), Google Play (payments and distribution). Google acts as a processor on our behalf. The Google Drive backup is a service you use with your own Google account, under Google's terms.
• Google AdMob, for advertising. For personalised ads Google acts as an independent controller.
• MET Norway, only for the approximate coordinates needed for the weather.
• Aruba S.p.A., which hosts the website and the management panel used by the controller to administer the app.
• Public authorities, only when required by law.

6. Where the Data Are Stored

The StarlyLab database and server functions are located in the European Union (region europe-west1, Belgium). Only your profile photo, if you set one, is stored in Google Cloud Storage in the United States (region us-east1, South Carolina); your notebook, including its photos, stays on your phone. Some Google services (for example Analytics, AdMob and the artificial intelligence model) may also process data outside the European Union, in particular in the United States. In these cases the transfer is based on the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses approved by the European Commission.

7. Retention

• Notebook: only on your phone (and in the backups you make), until you delete it or uninstall the app.
• Account and progress: as long as the account exists. When you delete your account we immediately delete your profile, photo, counters, points, badges, secrets found, tutor counter and purchase data.
• Purchase fingerprint: an encrypted code (hash) of the purchase token is kept even after deletion, only to prevent the same purchase from being used twice. It cannot be traced back to you.
• Texts sent to the tutor: not stored.
• Reported tutor answers: for as long as needed to review them and to prevent abuse. If you delete your account, the reports you sent are no longer linked to you.
• Accounts suspended for violations: email, name, date and reason of the suspension may be kept even after deletion, to prevent further abuse.
• Log of administrative operations: up to 24 months, for security and to verify the operations performed.
• Internal moderation notes: kept as long as needed to protect the community and to handle disputes, and deleted when no longer needed.
• Server technical logs: normally 30 days.
• Analytics statistics: according to the retention period set in Google Analytics, at most 14 months.
• Google Play orders: kept by Google according to its own legal obligations.

8. Account Deletion and Your Choices

• Delete your account in the app from Profile → Delete account, or follow the instructions to delete your account.
• The notebook is on your phone: you can delete single pages, photos and recordings in the app, or everything by uninstalling the app.
• You can delete the Google Drive backup from the Google Drive settings ("Manage apps") and revoke StarlyLab's access from your Google account.
• You can revoke the location, camera and microphone permissions in the Android settings.
• You can change your consent to ads in Profile → Ad preferences.

9. Your Rights

Under Articles 15-22 of the GDPR you have the right to:

• access your data and receive a copy;
• ask for its rectification or erasure;
• ask for the restriction of processing or object to it;
• receive the data you provided to us in a structured format (portability);
• withdraw your consent at any time, without affecting the processing already carried out;
• lodge a complaint with a supervisory authority, in particular in the EU country where you live; in Italy it is the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

To exercise your rights write to info@starlyware.com from the email address of your account. We reply within one month.

10. Children

StarlyLab is an educational app also suitable for students. The instruments and the notebook can be used without an account. An account can be created by users aged 14 or over; children under 14 may create one only with the consent of a parent or guardian (or at the age of digital consent required in their country, if different). We recommend that young people carry out experiments under adult supervision. If you believe a child has given us data without consent, write to us and we will delete it.

11. Security

All communications between the app and the servers are encrypted (HTTPS/TLS). Access to the data is protected by rules that allow each user to read only their own data, and sensitive operations (points, badges, purchases, tutor) are performed and verified only by the server. The notebook on the phone is protected by Android security, which makes it inaccessible to other apps.

12. Changes

We may update this policy for new features of the app or changes in the law. The date of the last update is shown at the top. In case of important changes we will let you know in the app.