01Data controller
The controller of your personal data is Andrzej Andelbrat, trading as AllesKlar Service, Lönsweg 30, 21680 Stade, Germany.
For any matter concerning your data, write to allesklarservice.de@gmail.com. It is the only contact address for privacy matters — we also answer account deletion requests from it.
We process data in accordance with the General Data Protection Regulation (GDPR). This policy covers the game Star Merchant (Gwiezdny Kupiec) available in the browser at gwiezdnykupiec.pl and the Star Merchant app for Android, downloaded from Google Play — the same game in different packaging.
02Playing without an account
Star Merchant can be played without creating an account, in solo mode. In that case we collect no personal data at all: the game state is saved only in your browser's or the app's storage (localStorage) and never reaches our server.
The only thing that reaches the server is ordinary requests for the game files — these are recorded in the logs described in section 07.
03Player account
An account is optional. You need one if you want to keep your solo-game saves on the server (to play from any device) or join online worlds with other players. When registering you provide:
- your e-mail address — used to activate the account, log in and reset your password;
- a trading house name — your in-game nickname; it need not have anything to do with your real name;
- a password — we store it only as a salted cryptographic hash. Nobody, ourselves included, can read it back from the database.
The account is activated via a link sent to the e-mail address you provided. Until you click the link, the account remains inactive.
What do other players see? In online worlds other participants see only your trading house name and game results — your ranking position, entries in the world chronicle, offers on the Guild exchange, transfers between houses. We never show your e-mail address to other players.
World channel. Every online world has a shared text channel. A message you send there is visible to every player of that world and to the administrator, together with your trading house name and the time it was sent. Writing is voluntary: the whole game works without you ever sending a single message. We store the text of messages on the server so that the channel works and so that we can deal with reports from other players; we use it for nothing else and pass it to no one outside the players of that world. Web addresses do not pass through the channel. Please do not post contact details there, or anything that is meant to stay private.
Private messages. A player can write directly to another player of the same world. Such a message is seen only by the sender and the recipient, together with their trading house names, the time it was sent and whether it has been read. We store the text on the server so that the conversation works. The administrator looks at a private message only when the recipient reports it as offensive. The same rules as on the channel apply: no web addresses, no contact details.
Data generated during play is also linked to the account: solo-game saves stored on the server, the state of your trading house in online worlds and your purchase history (section 05).
04Data on your device
In the browser's or app's storage (localStorage) the game keeps:
- a session token — so that you need not log in every time you start the game; it is deleted when you log out;
- your chosen theme (dark or light);
- solo-game saves, if you play without an account.
We use no tracking cookies, advertising, analytics tools or profiling. The game contains no third-party scripts watching what you do. The only external resource is the fonts loaded from Google Fonts on auxiliary pages such as this one.
05Payments
The game is free of charge and ad-free. Optional purchases (licences and Guild officers) require an account and go one of two ways, depending on where you launch the game from.
In the browser — Stripe
Payments are handled by Stripe Payments Europe Ltd. You enter your card or BLIK details on Stripe's page — we neither see nor store them. From Stripe we receive a payment confirmation, the payment session identifier and information about which product was bought. Stripe processes your data as an independent controller under its own privacy policy, available at stripe.com.
In the Google Play app — in-app purchases
Purchases are handled by Google Play (Google Ireland Ltd.). You pay through your Google account; we receive a purchase token and the product identifier. Our server verifies the token with Google and only then assigns the licence to your game account. Payment details stay with Google, under Google's privacy policy.
What we record about a purchase: what was bought, when, and for which account. We need this for tax accounting and for handling complaints — for instance when a licence fails to appear on the account.
06E-mail
The game server sends e-mails in only two situations: account activation and password reset. We use our own mail server for this — your address is not passed to external mailing services. We send no newsletters or offers.
After each new registration the game administrator receives a notification containing the e-mail address and the trading house name. This serves solely to supervise registrations (catching multi-accounts and abuse).
07Server logs
Like any web server, ours records basic information about requests: IP address, time, request path and errors. We use these solely for security — to rate-limit login attempts, detect abuse and diagnose outages. We do not link them to a player's profile for any purpose other than security.
Logs are kept for a short time — up to 30 days — and then deleted.
08Where the data is kept
The game server is located in Poland, in the data centre of cyber_Folks S.A. in Poznań. Account data, game saves, online worlds and logs do not leave the European Economic Area.
The only exception is payment processing by Stripe or Google, described in section 05 — these providers operate under their own rules and are themselves responsible for any transfer of data outside the EEA.
09Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running the account, solo play on the server, participation in online worlds | e-mail, trading house name, password hash, game saves, state in online worlds, session token | Art. 6(1)(b) — performance of a contract (provision of the game service) |
| Processing purchases and assigning licences to the account | product identifier, date, payment confirmation / purchase token | Art. 6(1)(b) — performance of a contract |
| Security: login rate limits, abuse detection, prevention of multi-accounts and fraud | IP address, server logs, registration notifications | Art. 6(1)(f) — legitimate interests of the controller |
| Tax and accounting records of purchases | purchase data: what, when, for which account | Art. 6(1)(c) — legal obligation |
We make no automated decisions about you that produce legal effects, and we do not profile players.
10How long we keep data
- Account data (e-mail, password hash, game saves, sessions) — until the account is deleted. Once it is deleted, we erase them immediately.
- Trading house in online worlds — after account deletion it remains in the world as an ownerless house: anonymous, taken over by the computer. It no longer contains any personal data; the house name stays because other players have a transaction history with it and entries in the chronicle.
- Purchase records — to the extent required by tax law, up to 10 years, also after account deletion.
- Private messages — the last 3,000 messages in a given world; older ones are deleted automatically, and all of them disappear together with the world. After you delete your account they stay with the recipient, but without any link to your account.
- World channel messages — the last 300 messages in a given world. Older ones are deleted automatically as new ones arrive, and all of them disappear together with the world. A message reported and hidden by the administrator is kept for the same period, until the report has been dealt with.
- Server logs — up to 30 days.
- Data on your device (localStorage) — until you clear it yourself or uninstall the app.
11Deleting your account
You can delete your account at any time, without giving a reason. There are two ways.
- In the game — takes effect immediatelyOpen the start screen, go to the "Online game" tab and log in. Next to your trading house name, by the "Log out" button, you will find the "Delete account" link. For security you must enter your password. Once confirmed, the account is erased immediately: e-mail, password, solo-game saves on the server, officer licences and sessions disappear with no possibility of recovery.
- By e-mail — within 14 daysWrite to allesklarservice.de@gmail.com from the address the account was registered with (that is how we confirm it is you). We will delete the account within 14 days and reply once it is done.
Your trading house in online worlds becomes an anonymous, ownerless house controlled by the computer — with no data that could point to you. Purchase records are kept only to the extent required by tax law.
Data without an account
If you play without an account, all your data sits on your device. You delete it by clearing the site data for gwiezdnykupiec.pl in your browser or the app data in Android settings (or by uninstalling the app). There is nothing for us to do on our side, because we hold nothing of yours.
12Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy of it;
- rectification of inaccurate data;
- erasure of data (the "right to be forgotten");
- restriction of processing;
- portability of the data you provided to us, in a machine-readable format;
- object to processing based on our legitimate interests.
To exercise these rights, write to allesklarservice.de@gmail.com from the address linked to your account. We respond within one month at the latest.
You also have the right to lodge a complaint with a supervisory authority. In Germany, where the controller is established, this is the competent state data protection commissioner (Landesbeauftragte für den Datenschutz) — for Lower Saxony: Die Landesbeauftragte für den Datenschutz Niedersachsen, Hanover. If you live in Poland, you may contact the President of the Personal Data Protection Office (UODO, uodo.gov.pl). You may also complain to the supervisory authority of the EU member state in which you habitually reside.
13Players' age
The game is not directed at children under 13 and we do not knowingly collect their data. If we learn that an account has been created by a person under that age, we will delete it. Parents and guardians can report such a case to the contact address above.
14Changes to this policy
When something changes — for example a new payment method is added — we will publish a new version of this policy at the same address, with a new date at the top of the page. Major changes affecting accounts will be announced in the game.
This version applies from 29 September 2026.