1. Who is responsible for your data
NEXGKET CONSUMERTECH PRIVATE LIMITED (CIN U47912HR2024PTC123515), registered at 2nd Floor, ALTF MPD Tower MR1, Sector 43, Golf Course Road, DLF City Phase 5, Gurugram, Haryana 122002, India, is the data fiduciary (the controller) for the personal data collected through the Starly website and the Starly Android app (app.starly.android). For anything about your data, write to hello@bestarly.com.
This policy covers both the website and the app. Where something is true of only one of them, we say so.
2. What we collect
2.1 What you give us when you create an account
- Name: so we can address you, and show a first name on the invite page when you refer someone.
- Mobile number: your Starly account and how you sign in, on the website and in the app. We verify it with a one-time code sent by SMS.
- Email address (optional): so we can reach you by email when you’d like us to. We store it and keep it unique to one account when you give one. We do not verify it, and it is not an identifier we treat as proof of who you are.
- City: to plan our city-by-city rollout and to work out your rank among members in your city.
2.2 What the app collects on your phone
The app asks for three Android permissions. Android asks you before granting each one, and you can withdraw any of them in your phone’s settings at any time.
- Contacts (READ_CONTACTS): so you can pick which contact hears which hello tune. Your contacts are read on your device and matched to your tunes on your device. We do not upload, transmit, copy or store your contacts, their names or their numbers on our servers, and we never share them with anyone. They stay on your handset, and uninstalling the app removes what the app held.
- Phone and call state: so the app can tell that a call is starting and play the right tune. The app uses the fact and timing of a call to do its job. It does not record your calls, and it does not send your call history to us.
- Microphone: used only while you are actively recording a hello tune, and only after you tap to record. The app does not listen in the background and does not record during calls.
2.3 Hello tunes you record
A tune you record is uploaded to our servers and stored there, because it has to be played back to people who call you. It is audio of your voice, so we treat it as your personal data. We use it only to play your tune to the contacts you have chosen. We do not use it to train models, we do not analyse its content, we do not use it to advertise Starly, and we do not share it with anyone beyond the hosting provider that stores it for us. Delete a recording, or your account, and we delete it.
Tunes you pick from the Starly catalogue instead are ours, not yours, so nothing is uploaded when you choose one.
2.4 What we collect automatically
- Verification and sign-in records: when your number was verified and when you last signed in.
- A hashed form of your IP address, and your browser’s user-agent string: kept to detect automated and duplicate signups. The IP address is hashed before it is stored; we do not keep it in the clear.
- One-time code records: one row for each code we send. The code itself is stored only as a one-way hash and is irreversible, is unusable after ten minutes or after one successful use, and cannot be read back by us or by anyone else. The record that a code was sent, with its time and a hashed IP, is kept after that, because counting recent sends is how we stop our SMS system being used to flood a stranger’s phone. See clause 8 for how long.
- Referral context: the invite code that brought you to the site, if any, so the member who referred you gets credit.
2.5 What we do not do
- We do not use advertising cookies or cross-site tracking on the website.
- The app carries no advertising SDKs, does not use your Android advertising ID, and does not build a profile of you.
- We do not collect your location, your photos, your files, or anything else not listed above.
- We do not sell or rent your personal data. To anyone, ever.
2.6 Cookies on the website
We use a small number of strictly necessary cookies, and no others.
- starly_member: a signed, HTTP-only cookie that keeps you signed in to your dashboard. 180 days.
- starly_intent: a signed, HTTP-only cookie holding the details you entered while your one-time code is in flight, so they survive the second step. 10 minutes.
- starly_ref: remembers the invite code you arrived with, so the right member gets credit. 30 days.
3. Why we use it, and on what basis
- To create your account and verify your mobile number, hold your place in the queue, and tell you when early access opens, on the consent you give when you create the account.
- To run the app: playing the tune you chose to the contact you chose, and storing the recordings you make, because it is necessary to provide the service you asked for.
- To run the referral programme, count referrals and work out your city rank, necessary to provide the service you asked for.
- To keep the waitlist honest and our SMS system safe covers bot detection, duplicate detection, rate limiting and abuse prevention, which are legitimate uses under the DPDP Act.
- To plan the rollout, using aggregate counts by city that do not identify anyone.
We will text you the codes you ask for, and one message when early access opens. If you gave us an email address we may use it to reach you too. We will not use your number or your address for any other marketing.
4. Who we share it with
We share personal data only with providers who process it on our instructions, under contract, and for no purpose of their own:
- Supabase: the hosted database where accounts are stored.
- MSG91: delivers your one-time code by SMS. Your mobile number is shared for that purpose. See MSG91’s privacy policy.
- Cloudflare: runs the Turnstile check that tells people from bots when you submit the form. It receives the challenge response and your IP address for that check. See Cloudflare’s privacy policy.
- Our hosting and storage providers: to run the website, the app’s backend, and to store your recordings.
- Google Play: distributes the app and tells us nothing about you beyond aggregate install statistics.
We may also disclose data where the law requires it, or to establish or defend a legal claim. If we are ever part of a merger or acquisition, your data may transfer with the business, and this policy will continue to apply to it until you are told otherwise.
5. Where your data is stored
We keep account data and recordings in India where our providers offer it. Some of the providers listed above process data outside India; where they do, we rely on their contractual data-protection commitments and on transfers permitted under the DPDP Act. We do not transfer personal data to any country the Central Government has restricted.
6. Security
The website and the app talk to our servers over HTTPS. Session cookies are signed and HTTP-only. One-time codes are stored only as one-way hashes and compared in constant time, so a copy of our database does not hand anyone a working code. Your IP address is hashed before storage. Access to the database is restricted to a small number of authorised people and to server-side code holding a credential that is never exposed to your browser or shipped in the app.
No system is perfectly secure, but we take technical and organisational measures proportionate to the data we hold. If a breach affects your data, we will notify you and the Data Protection Board of India as the DPDP Act requires.
7. Children
Starly is available from age 13. Under the DPDP Act, everyone below 18 is a child, and we may process a child’s personal data only with the verifiable consent of their parent or legal guardian. If you are under 18, your parent or guardian must agree to our terms of use and to this policy on your behalf before you create an account.
For every account belonging to a child, and in fact for every account we hold:
- we do not track or behaviourally monitor anyone, and there is no advertising, ad targeting or profiling anywhere in Starly;
- we collect nothing from a child beyond what clause 2 lists for everybody, and nothing at all that is not needed to run the service.
Parents and guardians: write to hello@bestarly.com to see what we hold about your child, correct it, withdraw your consent, or have the account and everything in it deleted. We will verify that you are the guardian before we act, and then we will act. If you tell us we are holding a child’s data without your consent, we will delete it.
8. How long we keep it
- Your account and your recordings: for as long as your account is open. Ask us to delete it and we remove your account and your recordings, other than copies in routine backups, which age out within 30 days.
- Dormant accounts: if you never use Starly and never respond to us, we delete the account 24 months after you created it.
- Abuse-prevention signals: hashed IP address and user-agent, up to 12 months.
- One-time code records: the hashed code is unusable after ten minutes; the record that a code was sent is kept up to 30 days, so that send limits hold across a restart.
We may keep the minimum needed for longer where the law requires it, or to establish or defend a legal claim.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, you can ask us to:
- confirm what personal data of yours we hold, and get a copy of it;
- correct anything inaccurate, and complete anything incomplete;
- erase it: closing your account, deleting your recordings and removing you from the waitlist;
- withdraw your consent, which is as easy to do as it was to give, and which stops any further processing that depends on it;
- nominate someone to exercise these rights for you if you die or become unable to.
Write to hello@bestarly.com and we will respond within the time the law allows. There is no charge. If our answer does not satisfy you, take it to our Grievance Officer in clause 10, and after that you may complain to the Data Protection Board of India.
Deleting your account also ends the referral credit attached to it, for you and for whoever referred you. We cannot undo a deletion.
10. Grievance Officer
Complaints about your data, or about anything else in Starly, go to our Grievance Officer, who will acknowledge within 24 hours and resolve within 15 days.
Rohan Arora
Grievance Officer, NEXGKET CONSUMERTECH PRIVATE LIMITED
2nd Floor, ALTF MPD Tower MR1, Sector 43, Golf Course Road, DLF City Phase 5, Gurugram, Haryana 122002, India
hello@bestarly.com
11. Changes to this policy
We will update this page as the product develops, and change the effective date above when we do. If a change materially affects how we use your data, we will tell you by email before it takes effect.