This policy explains what RRDL LIMITED ("we", "us") collects when you use Startr: the web app at app.startr.si, the Startr apps for iPhone and Android when they are available, and this website at startr.si (together, "Startr"). It covers why we collect it, who processes it for us, how long we keep it and what you can do about it.
- No sign-up. Startr gives you an anonymous account the first time you open it. We don't ask for your name, email or a password.
- We store what you type into Startr (your thing, your steps, your plan) and a log of your starts, so the app works.
- To write your 2-minute step, the text of your thing and step goes to an AI model. Your name, email and account ID never do.
- No ads, no ad trackers and no selling of data. This website sets no cookies and runs no analytics.
- Delete everything any time: Settings → Delete account, or startr.si/delete-account.
1. Who we are
Startr is operated by RRDL LIMITED, a company registered in England and Wales (company number 15531938), 108 Stratoshere Tower, Great Eastern Road, London E15 1DS, United Kingdom. We are the controller of the personal data described here under the UK GDPR and the EU GDPR. Contact: support@rrdl.io or the support form.
2. What we collect
An anonymous account
The first time you open Startr, Firebase Authentication creates an anonymous user ID for your device or browser. It isn't tied to your name or email. We also give each account an 8-character device code, shown in Settings, which you can use to link devices or delete the account.
What you type into Startr
- The thing you're putting off, how long you've waited, the hours a day you think it costs, where you usually get stuck and your note about Future You.
- The name you write on the pledge, if you write one. The signature you draw stays on your device; we only record that, and when, you signed.
- Your current and next steps, your planned time and place, your night-check answers (whether you started, what got in the way) and your weekly reset.
What Startr records as you use it
- For each day: whether and when you started, your start delay, how long you kept going, "I waited today" logs and taps on "I'm avoiding it".
- When the account was created and last used.
If you choose to give it
- Google or Apple: if you link your account, the email address (Apple may give a private relay address) and the user ID that Google or Apple share with us.
- Device linking: the email address you give with a link request, and the two accounts involved.
- Support: your email address, the topic, your message and, if you add it, your device code.
Payments
On the web, payments are handled by Stripe: we receive a customer ID, the plan, the subscription status and renewal dates, and Stripe collects your email and card details on its own checkout page. In the iPhone and Android apps, Apple or Google take the payment and RevenueCat tells us whether your subscription is active. We never see your card number.
Technical data
Our servers log requests, including IP addresses, for security and to fix problems; those logs are short-lived. If product analytics are switched on, the app sends usage events (for example "start done") with your anonymous ID, device type, operating system and app version to Mixpanel.
What we don't collect
No contacts, photos, location, health data or advertising identifiers. Reminders in the iPhone and Android apps are scheduled on your device; we don't collect a push token. The web app has no reminders unless you add its calendar file to your own calendar.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Run Startr: keep your plan, steps, history and day count | Account, what you type, usage records | Contract |
| Write and shrink your 2-minute steps | Your thing, current step, stuck point, blocker | Contract |
| Keep your account on a new device | Google or Apple link, device codes, link requests | Contract |
| Take payment and unlock the subscription | Payment records from Stripe, Apple, Google or RevenueCat | Contract |
| Answer support messages | Your email and message | Legitimate interests |
| Understand use and improve Startr | Usage events with your anonymous ID | Legitimate interests (consent where the law requires it) |
| Keep Startr secure and prevent abuse | Server logs, IP addresses, rate limits | Legitimate interests |
| Meet tax, accounting and legal duties | Payment records | Legal obligation |
We don't use what you write for advertising, and we don't make decisions with legal or similarly significant effects about you by automated means.
4. Who processes it for us
These providers work for us under contracts that limit what they may do with your data.
| Provider | What they get | Why |
|---|---|---|
| Google (Firebase Authentication) | Anonymous ID; Google or Apple link details; IP address at sign-in | Anonymous sign-in and account linking |
| MongoDB Atlas (data stored in Paris, France) | Your account, what you type, usage records, support messages | Database |
| Fly.io (servers in Paris, France) | Everything our servers handle, including request logs | Hosting the API, the web app and this website |
| OpenRouter, and the model provider it routes to (currently Google Gemini) | Your thing, current step, stuck point and blocker, with no ID, name or email | Writing your 2-minute steps |
| Stripe | Customer and subscription records; the email and card details you enter at checkout | Web payments, invoices, the billing portal |
| Apple, Google Play and RevenueCat | Anonymous ID and purchase receipts | In-app subscriptions (iPhone and Android apps) |
| Mixpanel | Usage events with your anonymous ID | Product analytics, when switched on |
| Resend | Your email address and our reply | Sending email when we write to you |
We may also share information when the law requires it, to protect people's rights and safety, or as part of a sale or merger of our business, in which case this policy keeps applying. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
5. International transfers
Our database and servers are in the EU (France). Some providers, such as Google, Stripe, OpenRouter, RevenueCat, Mixpanel and Resend, may process data in the United States or elsewhere. Where the law requires it, those transfers rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision such as the EU-US Data Privacy Framework.
6. How long we keep it
- Your account and what you type: until you delete the account. A free anonymous account that hasn't been opened for 12 months is deleted automatically.
- Day-by-day records: deleted automatically after about 13 months; the app only uses the last year.
- Support messages: up to 24 months, or until you delete your account if they're linked to it.
- Deleted accounts: a marker with the account ID for 2 hours, so a device still holding an old sign-in can't recreate it.
- Payment records: kept by Stripe, Apple or Google for as long as tax and accounting law requires.
- Server logs and analytics: short-lived logs; analytics under the provider's retention settings.
When you delete your account it is removed from our database at once. We keep no backup copies of your Startr data.
7. Your rights
Depending on where you live, you can ask to access your data and get a copy, correct it, delete it, move it to another service, object to or restrict how we use it, and withdraw consent you have given. You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority where you live.
Delete everything yourself in Settings → Delete account, or at startr.si/delete-account. For anything else, use the support form or write to support@rrdl.io. Because your account is anonymous, we will ask for your device code so we can find it. We reply within one month.
California residents: we don't sell or share personal information as those terms are defined in California law, and you won't be treated differently for using your rights.
8. Children
Startr isn't meant for children under 13, or under the minimum age for consenting to data processing in your country if that's higher. If you think a child has used Startr, tell us and we'll delete the account.
9. Security
Everything travels over HTTPS. Access to production data is limited to the people who run Startr. Device codes, deletion and support are rate-limited. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.
10. This website
startr.si is a static website. It sets no cookies, runs no analytics and loads nothing from other companies: fonts and images come from our own server. The support and delete forms send what you type in them to our API.
11. Changes
If we change this policy, we'll update the date at the top. If a change matters, we'll also say so in the app before it takes effect. The current version is always at startr.si/privacy.