Privacy Policy

Last updated: 16 July 2026

This Privacy Policy explains how the mobile application "Static" (the "App") handles your personal data.

Controller: Ceresemil, a sole proprietorship registered in the Netherlands (KvK: 77146123).

Contact: info@ceresemil.com

1. Scope

This policy applies to the App and its backend service. It does not cover third parties whose services you reach from the App (for example the Apple App Store or Google Play), which have their own policies.

2. What we collect

• Account identifiers. When you first open the App, a random guest identifier is generated on your device. If you create an account, we store your email address. We do not use passwords: you sign in with a one-time code we email to you.
• Game progress and social features. Your in-game state (currencies, collected characters, settings, public profile, friends, global chat messages and in-game messages) is saved on your device and/or our server. When you are signed in, it is synced to our server so you can keep it across reinstalls and devices.
• Content you submit to AI features. The messages you type to characters and the prompts used to generate images are sent to our AI providers so they can produce a response.
• Technical and security data. On our server we process your IP address, a user agent string, timestamps of authentication events, and request counts. We use this for security, rate limiting and abuse prevention.
• First-party product and session analytics. We record your user identifier, app build and platform, session timing and duration, and specific gameplay interactions such as viewing or using a banner, completing a pull, changing affinity, upgrading a facility, completing a story, or sweeping a battle. We use this data to understand and improve Static.
• Purchase records. Purchase and subscription identifiers, products and entitlement status are processed by the app store, RevenueCat and our server to validate purchases and provide entitlements. We do not receive or store your card details.

We do not sell your personal data or use third-party advertising or analytics trackers, cross-app tracking, or targeted advertising.

3. Why we use it and our legal bases

• To provide, save and sync the game. Legal basis: performance of a contract.
• To provide the AI chat and image features. Legal basis: performance of a contract. Your input is sent to our AI sub-processors to generate the response.
• To keep the service secure, prevent abuse, apply rate limits and keep an audit trail. Legal basis: legitimate interest.
• To measure use of and improve Static through first-party product and session analytics. Legal basis: legitimate interest.
• To validate purchases and provide purchased entitlements. Legal basis: performance of a contract and compliance with our legal obligations.
• To send local reminders. Legal basis: your device permission, which you can withdraw in your device settings.

4. Who we share it with

We use the following processors who act on our behalf:

• Anthropic, for AI chat responses.
• OpenAI, for image generation.
• RevenueCat, for purchase and subscription management and receipt validation.
• Our hosting and database provider, for running the backend.

The content you submit to AI features is processed by the relevant AI provider to generate a response. Please do not submit sensitive personal data in chats. We do not sell your personal data.

5. International transfers

Some providers may process data outside the European Economic Area. Where that happens, appropriate safeguards (such as the European Commission standard contractual clauses) are applied.

6. Retention

• Account, progress, social and AI-feature data are kept until you delete your account or ask us to delete it, except where the law requires longer retention.
• First-party product and session analytics are deleted after at most 180 days.
• Security and audit events are deleted after at most 365 days.
• IP addresses and user-agent data on revoked or expired sessions are anonymized within 30 days after the session ends. The revoked or expired session record is deleted within 90 days after it ends.
• RevenueCat and the app store retain purchase records under their own legal and contractual retention obligations.

7. Your rights

Under the GDPR (AVG) you can request access, rectification, erasure, restriction, portability, and you can object to processing or withdraw consent. To exercise a right, contact info@ceresemil.com. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Children

The App is intended for users aged 16 and over and is not directed at children under 16. If we learn that we have collected personal data from a child under 16 without an appropriate legal basis, we will delete it.

9. Security

We protect your data with passwordless one-time email codes, tokens stored in the device keychain, encrypted transport (HTTPS in production), access controls and rate limiting. No method of transmission or storage is fully secure, but we take reasonable measures to protect your data.

10. Changes

We may update this policy. We will change the "Last updated" date above and, where appropriate, notify you in the App.

11. Contact

Questions about this policy or your data: info@ceresemil.com