Privacy Policy

Last updated: July 18, 2026

1. Overview

Starcaller ("we," "our," or "us") is committed to privacy. This policy explains what data we collect, how we use it, and your rights. The Starcaller platform is designed as a local-first, sovereign intelligence system — your personal data stays on your device by default.

2. Data We Collect

2.1 CRA Compliance Kit (pip package)

The cra-compliance-kit Python package runs entirely on your machine. It does not phone home, collect telemetry, or transmit data to our servers. SBOM generation and CVE matching happen locally.

2.2 CRA Watch API (cra-watch.starcaller-teq.workers.dev)

When you use the free SBOM monitoring API:

• SBOM data — The CycloneDX SBOM you submit is processed to match components against the CISA KEV catalog. SBOMs are processed in-memory and not stored persistently.
• Request metadata — Cloudflare (our infrastructure provider) logs standard HTTP metadata (IP address, timestamp, user agent) for security and abuse prevention. These logs are retained per Cloudflare's standard policies.
• No user accounts — The free tier does not require registration. We do not collect names, emails, or payment information at this tier.

2.3 Discord Bot

Our Discord bot ("Starcaller") processes:

• Messages — The bot reads messages in the #introduce-yourself channel to provide a welcome reply. Messages are processed in real-time and not stored by us.
• Slash commands — The /cra-countdown command does not collect or store any user data. It simply returns a countdown embed.
• Discord-provided data — We have access to standard Discord information (usernames, user IDs, server roles) as provided by Discord's API. This is used solely for bot functionality (welcome replies, role management) and is not exported, sold, or shared.

2.4 Website (starcaller.uk)

Our website is hosted on Cloudflare Pages. Cloudflare logs standard HTTP request metadata for security and analytics. We do not use cookies, tracking scripts, or analytics beyond what Cloudflare provides at the infrastructure level. No personal data is collected through website forms.

3. Data Sharing

We do not sell, rent, or share personal data with third parties. Data may be disclosed if required by law or to protect our rights, safety, or property.

4. Data Retention

• CRA Compliance Kit: No data retained — runs locally.
• CRA Watch API: SBOM data processed in-memory, not persisted. Request logs retained per Cloudflare's default (typically hours to days for free-tier Workers).
• Discord Bot: No message storage. Discord itself retains messages per their policies.
• Website: Cloudflare logs per their standard retention.

5. Your Rights

Under UK GDPR and applicable data protection laws, you have the right to access, correct, delete, or port your personal data. Since we collect minimal data by design, most rights can be exercised directly on your device or via Discord's own privacy controls. For inquiries: support@starcaller.uk.

6. Security

The Starcaller platform is built with a 10-gate security architecture, HMAC-signed provenance, and local-first design. We take reasonable measures to protect data processed through our services, but no system is impenetrable.

7. Children's Privacy

Our Services are not directed at individuals under 16. We do not knowingly collect data from children.

8. Changes to This Policy

We may update this policy. Material changes will be announced in the Discord server and on the website.

9. Contact

Data protection inquiries: support@starcaller.uk