Privacy Policy

Who we are

Starling is operated by Gidion ("we", "us"), New York, United States. For questions about this policy or your personal information, contact hellogidion@gmail.com.

This policy covers the Starling website, the Starling Chrome extension and the hosted service behind them. Starling is an independent product and is not affiliated with or endorsed by X Corp. X's own privacy policy governs what X does with your data.

Information we collect

Account information

Your email address, a salted hash of your password, whether your email is verified, your plan, and the browsers you connect (the name you approved, extension version and when each was last used).

Content you send for drafting

With your consent in the extension, when you ask for a draft or an answer, the extension sends: the post you ask about, the text in X's composer, attached images as small copies, your messages in the Starling panel, the writing samples you add (including posts of your own that you add from your X profile), preferences you confirm and the outcomes of drafts (whether you used, edited or discarded them).

With each request the extension also sends the web address of that post, of the post it replies to and of the X page you are on, so the draft fits the conversation. The extension runs only on x.com and twitter.com and reads no other browsing.

With your consent on the website's writing page (the page for phones, at /write), when you ask for a draft we receive what you paste or type there: the post you are answering, with its author and its link if you give them, what a new post should be about, and the writing samples you add. If you give a link to a post on X, our server asks X's public embed service for that post's words and author; X receives the link and our server's address, not your account details. A post shared to the installed app from another app arrives the same way, and nothing is sent until you press a button.

Optional learning data

Only if you turn on the optional learning choice, the extension sends your own X profile details and post statistics while you browse X.

Billing information

If you subscribe, Stripe collects your payment details directly. We receive and keep your Stripe customer reference, subscription status, invoice records and the last details Stripe shares with us, but never your full card number.

Usage and technical information

When requests happened, whether they succeeded, how much of your allowance they used, the AI processing cost, your time zone, a shortened form of your IP address and your browser's user agent for sessions and security. Usage records do not contain the text of your messages or drafts, and service logs never contain messages, drafts, passwords or tokens.

Messages to us

If you contact support, we keep the messages and details you give us.

How we use information

• To provide Starling: generating drafts and answers, matching your voice and showing your usage.
• To run your account and subscription, apply plan allowances, rate limits and fair-use limits.
• To keep the service secure and prevent abuse, including limiting free allowances to one per person.
• To send service emails such as email verification, password resets and important billing or policy notices.
• To meet legal, tax and accounting obligations.

We do not sell your personal information and do not use it for advertising.

Starling's use of information received from the Starling Chrome extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Legal bases

Where the law requires a legal basis, we rely on: performing our contract with you (providing the service and billing), your consent (sending content for drafting and the optional learning data, which you can withdraw at any time), our legitimate interests (security, abuse prevention and improving the service in ways you would expect) and legal obligations (tax and accounting records). Jurisdiction-specific terms: the State of New York, United States.

AI processing

Content you send for drafting is processed by our AI provider, Anthropic, to generate drafts and answers. AI output can be inaccurate. You decide what, if anything, to post.

To check facts, Starling may read the public web pages that the post you ask about links to.

To suggest what to post about, Starling works out the subjects you write about from your own posts and writing samples, and looks for what is new in them in public news feeds. The pages it used are shown with each idea.

Searches never contain the text of your messages, your drafts, your writing samples or posts from protected accounts.

How we share information

We share personal information only with service providers that help us run Starling, under agreements that limit their use of it, and when the law requires it:

• hosting of our servers and databases: Fly.io
• account and service email delivery: Google (Gmail)
• payments: Stripe
• AI processing: Anthropic

The current list, with what each provider processes, is on the Subprocessors page. If Gidion is involved in a merger, acquisition or sale of assets, personal information may transfer as part of that transaction, subject to this policy.

International transfers

Our providers may process information outside the country where you live. Where required, we use appropriate safeguards for these transfers. Details for your region: the State of New York, United States.

How long we keep information

• A finished draft is kept for 15 minutes so the extension or the writing page can recover it after a dropped connection.
• Writing samples, preferences, draft outcomes and optional stats are kept until you remove them or delete your account.
• Encrypted backups of the service are taken every night and kept for up to about three months. Information you delete, and a deleted account, leave the live service at once and leave the backups as those backups age out. A backup is only ever used to restore the service after a failure.
• Other retention periods: Your account details (email address and settings) are kept until you delete your account.

Cookies

The website uses only cookies it needs to work, and no analytics, advertising or third-party cookies:

• a sign-in cookie, which keeps you signed in; it ends when you sign out, or after 14 days without use and 30 days at most;
• a security cookie, set before you sign in, which protects the sign-in and sign-up forms against forged requests;
• a short-lived message cookie, which carries a one-line notice (such as "You are signed out") to the next page and is then removed;
• a cookie set when you sign up, for up to 24 hours, which holds the address you typed and a random value, so the "check your email" page can show that address and so the code or link we email you signs in this browser and no other;

The browser extension uses no cookies. It keeps its sign-in and your settings in the browser's extension storage.

The writing page keeps two things in your own browser and never sends them to us: whether you last chose Reply, Quote or New post, and, if you add the page to your home screen, a copy of the "You're offline" page to show when you have no connection.

Your rights and choices

• Access and export: download a copy of your data from Your data.
• Deletion: delete your account and data from Your data. Some billing records must be kept for legal reasons, and encrypted backups age out as described above.
• Correction: change your email address from Security.
• Consent: withdraw drafting consent or turn off the optional learning choice in the extension at any time, and withdraw consent for the writing page on that page.
• Devices: disconnect any browser from Devices.

Depending on where you live, you may have further rights, such as objecting to processing or complaining to a data protection authority. To use them, contact hellogidion@gmail.com.

Security

Passwords are stored as salted hashes. Traffic is encrypted with HTTPS. Each account's drafting data is kept in its own isolated storage area. Browser connections use device tokens that you can revoke, and resetting your password revokes all of them. No system is perfectly secure, and we will notify you of a breach affecting your information as the law requires.

Children

Starling is not intended for children, and we do not knowingly collect personal information from anyone under the minimum age in our Terms of Service.

Changes to this policy

We will post changes on this page and update the effective date. If a change is significant, we will tell you by email or in the extension before it takes effect.

Contact

Gidion, New York, United States. Privacy contact: hellogidion@gmail.com.