1. Scope and Contact Details
This Policy applies to the StellarBox Android client, account service, and related administration services, collectively referred to as “StellarBox” or the “App.”
- developer
- zouchangsheng
- Email
- zcs2004@126.com
- Developer website
- https://per.dhuzcs.com/
- Privacy Policy
- https://privacypolicy.dhuzcs.com/en.html
StellarBox is an independent third-party mod manager for Stardew Valley. It is not affiliated with or officially endorsed by ConcernedApe, Stardew Valley, SMAPI, Pathoschild, or their respective rights holders.
2. Information We Process
2.1 Account, registration, and order information
To create accounts, verify eligibility, fulfill orders, and provide support, we may process:
- The phone number used as your account, an email address you optionally provide, your order number, and account status;
- Membership type, trial eligibility, and whether the daily trial allowance has been exhausted;
- Passwords transmitted temporarily during sign-in;
- Non-reversible password hashes stored by the server;
- Login tokens, token digests, and expiry dates.
Passwords are transmitted over HTTPS only for verification. The client does not store your password, and the server does not retain passwords in readable plain text.
The client stores the login token, account, order number, and account status in Android secure storage to keep you signed in. This local sign-in information is removed when you sign out, clear App data, or uninstall the App.
2.2 Phone number and SMS verification information
When you choose to register an account, reset a forgotten password, or change a password after signing in, we process:
- Your phone number, the verification purpose (registration, password reset, or password change), and the verification code you enter manually;
- A random SMS challenge identifier and its SHA-256 digest, a random external transaction identifier, and the Alibaba Cloud business transaction identifier;
- The request IP address, send and verification attempt counts, creation and expiry times, and consumption status.
We use this information to send and verify SMS codes, prevent abusive repeat sends or brute-force guessing, and protect your account. Our account server does not store the verification code in plain text. A code is valid for five minutes by default and may be successfully consumed only once.
2.3 Network and security information
To verify accounts, prevent brute-force attacks, detect unusual sign-ins, and protect the server, we may record:
- IP address and User-Agent information supplied by the client;
- Sign-in, verification, last-used, and token-expiry timestamps;
- Successful or failed sign-in status and the number of failed attempts;
- Administrative records of account creation, modification, closure, and password resets.
We do not use this information for advertising or profiling.
2.4 Local settings
StellarBox stores interface language, the accepted Privacy Policy version, SMAPI installation records, mod status, and save-backup information locally on your device. These settings are not uploaded to the account server by default.
2.5 Mods, saves, and game files
To provide mod and save-management features, StellarBox may access or process locally:
- Mod, SMAPI, or save archives that you choose to import;
- Installed, enabled, or disabled mods;
- Stardew Valley saves, backups, version information, and runtime files;
- SMAPI error logs.
StellarBox does not automatically upload mods, saves, or game files to the account server.
When you use an export or sharing feature, the selected files are passed to Android or to the third-party app you choose.
2.6 Diagnostic log uploads
StellarBox does not upload diagnostic logs automatically. Only after you select “Share Diagnostic Log” will the App read the local SMAPI-latest.txt file and upload it to SMAPI.io.
A diagnostic log may contain:
- Game version, SMAPI version, and runtime platform;
- Names, versions, and authors of installed mods;
- Game or mod file paths;
- Error messages, runtime records, and other content written by third-party mods.
Before uploading, make sure the log does not contain information you do not wish to disclose or transmit. Declining to upload does not affect other core features.
- Log recipient
- SMAPI.io / the SMAPI project
- Service
- https://smapi.io/log
- Privacy notice
- https://smapi.io/privacy
- Purpose
- Parsing, displaying, and sharing SMAPI diagnostic logs
According to information currently published by SMAPI.io, uploaded logs are generally retained for 30 days in private Microsoft Azure storage, and its servers may automatically process visitor IP addresses. The service may process data outside China. Please review its privacy notice before uploading.
2.7 Clipboard
After a successful diagnostic-log upload, StellarBox writes the sharing link to the system clipboard. If an error occurs, the App may also write error details to the clipboard for troubleshooting. StellarBox does not proactively read other clipboard content for advertising, profiling, or account verification.
2.8 Software list (installed-app information), device MAC address, and certain sensor types
After you agree to this Policy, when the App starts, the main screen and built-in Wiki WebView initialize, the game launches, the App checks the network, or a compatibility check runs, StellarBox may use Android PackageManager, network/Wi-Fi services, sensor-service interfaces, and the Android System WebView/Chromium system component to read or process the following information within the minimum scope necessary:
- Software list (installed-app information): the App's package name, version, and signing-certificate digest, and the installation status and version information of the international Stardew Valley package (
com.chucklefish.stardewvalley) and Samsung package (com.chucklefish.stardewvalleysamsung). This is used to verify App integrity, identify an available game, and select a compatible launch method. StellarBox does not indiscriminately enumerate all installed apps for advertising or profiling;
- Device MAC address and Wi-Fi identifiers: a WLAN network-interface hardware address (device MAC address), BSSID, or similar information that the system or compatibility runtime may return. This information is used only to determine network conditions, maintain networking and runtime compatibility, troubleshoot problems, and protect against anomalous requests. It is not used for advertising or profiling;
- List and data of certain sensor types: when the built-in Wiki WebView on the main screen initializes or web content checks device capabilities, Android System WebView/Chromium may call
SensorManager.getSensorList() to determine whether the device has orientation, rotation-vector, accelerometer, gyroscope, or other particular sensor types for Web-standard and content compatibility. The App and game may also process orientation or rotation data needed for landscape orientation and game controls. Merely checking whether a sensor exists is not the same as continuously reading its measurements. We do not use this information to infer health conditions or movement history.
This information is read on demand when the relevant feature is triggered and is processed locally by default. StellarBox does not automatically upload it to the account server. If the system or a third-party mod writes such information to an SMAPI diagnostic log, that log is uploaded only when you actively select “Share Diagnostic Log,” subject to section 2.6.
2.9 Built-in Wiki, Android System WebView, and website data
To display the Stardew Valley Wiki inside the App, after you agree to this Policy and enter the main screen, StellarBox initializes the Android System WebView/Chromium system component and automatically requests the Chinese or English Stardew Valley Wiki page according to the interface language. The web page may finish initializing and loading in the background even before you switch to the Wiki tab.
To display and navigate web pages, zoom content, restore page state, and play media, WebView enables JavaScript, DOM storage, cookies, and third-party cookies. During initialization, loading, reloading, navigation, or page interaction, Android System WebView, the Stardew Valley Wiki, and third-party resources referenced by the page may process:
- IP address, User-Agent, network type, and technical device, operating-system, or browser-version information;
- Cookies, third-party cookies, DOM or website local storage, and web-page state;
- Access time, pages visited, clicks or navigation, visit duration, and similar network-activity records;
- Capability-check results indicating whether particular sensor types are available. If a web page requests sensor measurements or another protected capability, Android, WebView, and web-page permission controls also apply.
This information is used to provide Wiki content, maintain compatibility of web and media features, remember page state, measure visits, protect security, and troubleshoot failures. StellarBox does not actively submit your StellarBox account, order number, password, saves, or mod files to the Wiki merely to load it. Websites and their resource providers process information received from WebView requests under their own privacy notices.
3. App Permissions
StellarBox may use the following Android permissions or system capabilities:
- Software-list/package queries: querying only this App and the two Stardew Valley package names expressly declared in the Android manifest for integrity verification, installation detection, and compatible launch;
- Network access: account sign-in, status verification, sign-out, built-in Wiki loading, and user-initiated diagnostic-log uploads;
- Network and Wi-Fi state: determining whether a network connection is available;
- Device MAC address and Wi-Fi identifiers: the system or compatibility runtime may access these through network and Wi-Fi state capabilities for network availability, compatibility, troubleshooting, and security protection;
- Sensors, WebView capability checks, and screen orientation: Android System WebView/Chromium may query the sensor-list interface to determine whether particular sensor types are available for web-feature compatibility. The App and game may also process necessary orientation, rotation, and game-input data to maintain landscape display and game controls;
- Android System WebView: loading and displaying the Stardew Valley Wiki inside the App through network access, JavaScript, DOM storage, cookies, third-party cookies, media playback, and device-capability checks;
- System file picker: selecting SMAPI, mod, or save archives that you choose to import;
- System sharing: sharing saves or exported files selected by you;
- Vibration: necessary operation feedback;
- App-specific file directories: storing SMAPI, mods, saves, logs, and backups.
StellarBox does not request access to contacts, permission to read or send SMS, call logs, precise location, camera, or microphone. Some package queries, network-identifier access, or sensor access do not trigger an Android runtime permission dialog, but the App still processes them only within the scope stated in this Policy.
4. How We Use Information
We use relevant information only as necessary to:
- Create, verify, and maintain user accounts;
- Verify orders and provide fulfillment and after-sales support;
- Use SMS codes for account registration, forgotten-password reset, and password changes;
- Determine whether an account is in good standing;
- Prevent brute-force attacks, account abuse, and server attacks;
- Provide SMAPI, mod, and save-management features;
- Verify App integrity, identify the installation status of specified game packages, and support compatible launch;
- Determine network availability, maintain landscape orientation and game input, and perform necessary compatibility checks and troubleshooting;
- Load Wiki and media content through the built-in WebView, restore page state, and check device compatibility with web features;
- Process user-initiated diagnostic-log uploads;
- Troubleshoot issues, handle complaints, and resolve disputes;
- Comply with applicable legal obligations.
We do not sell personal information, use it for personalized advertising, or make automated decisions that subject you to unreasonable differential treatment.
5. Sharing, Entrusted Processing, and Public Disclosure
We do not provide your personal information to another person or organization except when:
- At your request, we provide necessary information to Alibaba Cloud SMS Authentication through server-side interfaces;
- To display Wiki and page media resources inside the App, your device directly accesses the Stardew Valley Wiki and third-party resources referenced by the page through Android System WebView; the relevant servers may receive necessary information such as IP address, User-Agent, cookies, and access records;
- You choose to upload a diagnostic log to SMAPI.io;
- You choose to share a file with a third-party app through Android's sharing feature;
- A service provider processes data under our instructions as necessary for server hosting, network maintenance, backups, or security;
- Disclosure is required by applicable law or a lawful request from a judicial or administrative authority;
- Disclosure is necessary to protect the personal or property safety of you, other users, or the public.
Alibaba Cloud SMS Authentication
- Third-party operator
- Alibaba Cloud Computing (Beijing) Co., Ltd.
- Product/service
- Alibaba Cloud Phone Number Verification Service — SMS Authentication
- When used
- When you request or submit an SMS code for registration, password reset, or password change
- Processing method
- The StellarBox account server communicates with Alibaba Cloud servers through encrypted online interfaces. The Alibaba Cloud SMS Authentication SDK is not integrated into the App client.
- Information provided
- Country/region code, phone number, SMS signature and template codes, template parameters such as code length and validity period, and a random external transaction identifier; when you verify a code, the code you entered manually is also provided
- Purpose
- Generate, send, and verify SMS codes; control send frequency; prevent fraud and abuse; and analyze service failures
- Privacy notice
- Alibaba Cloud SMS Authentication Privacy Policy
Alibaba Cloud and the telecommunications operators it works with may process necessary information under their own rules to deliver and verify SMS messages, manage security risks, and analyze client-service data. Please also read the privacy notice above before using SMS verification.
If the service operator changes in the future, we will provide notice as required by law and require the recipient to continue protecting personal information.
We do not publicly disclose your account, order number, IP address, or other personal information unless required by law or separately authorized by you.
6. Third-Party Services, Mods, and External Websites
Processing by Alibaba Cloud SMS Authentication and the SMAPI.io log service is described in sections 5 and 2, respectively.
Built-in Wiki and Android System WebView
- System component
- Android System WebView/Chromium; its provider and version depend on your device
- Website operator
- ConcernedApe LLC / Stardew Valley Wiki
- Website
- https://stardewvalleywiki.com/ and https://zh.stardewvalleywiki.com/
- When activated
- WebView and the Wiki page initialize with the main screen after you agree to this Policy. Processing continues when you open the Wiki, refresh, navigate, or interact with a page.
- Processing method
- Your device communicates with the website and its resource servers through WebView requests. The Wiki homepage uses an HTTPS address; other resources referenced by a page load according to their own connection protocols. WebView locally checks capabilities required by web content, including calling
SensorManager.getSensorList() to determine whether particular sensor types exist.
- Information
- IP address, User-Agent, network and technical device/system/browser information, cookies and third-party cookies, DOM or website storage, access and interaction records, and availability information for particular sensor types
- Purpose
- Display Wiki and media content, maintain web-feature compatibility, restore page state, measure visits, protect security, and troubleshoot failures
- Privacy notice
- Stardew Valley Wiki Privacy Policy
The Stardew Valley Wiki privacy policy states that use of the Wiki may involve processing IP address, browser type, visit count and duration, cookies, and network interactions, potentially outside China, including in the United States. Wiki pages may also reference SoundCloud, Bandcamp, or other third-party resources. Those resources process necessary information under their own notices only when loaded, when a media feature is enabled, or when you interact with them.
Third-party mods you install or enable may have their own network connections or data-processing capabilities. StellarBox cannot control third-party mod code or data practices.
Before installing a third-party mod, review its source, permissions, and privacy information. The relevant mod provider is responsible for its collection of information, modification of files, or network transmissions under its own terms.
In addition to the built-in Wiki that initializes with the main screen as described above, when you actively open another external website through StellarBox, the browser and that website may process IP addresses, cookies, and access records under their respective privacy policies.
7. Retention
- Login tokens are valid for 30 days by default and are revoked when you sign out, close the account, or reset the password;
- Account details, password hashes, order numbers, and status are retained for as long as necessary to operate the account service and provide after-sales support;
- Phone numbers, optional email addresses, membership details, and trial information are retained for as long as necessary to maintain accounts, verify eligibility, and provide after-sales support;
- SMS verification codes are valid for five minutes by default, and our account server does not store them in plain text. SMS challenge digests, phone numbers, purposes, transaction identifiers, IP addresses, attempt counts, and timing or consumption status are retained only as long as necessary for rate limiting, security auditing, and dispute resolution. Alibaba Cloud determines its processing and retention periods under its own privacy policy;
- Failed sign-in records, security records, and administrative action logs are retained as needed for attack prevention, auditing, dispute resolution, and legal obligations;
- Information required by law is retained for the legally required period;
- When a retention period ends, we delete or anonymize the information. If immediate deletion is not possible, processing is restricted to storage and security protection;
- Local mods, saves, backups, and settings generally remain until you delete the files, clear App data, or uninstall the App;
- The software list (installed-app information), device MAC addresses/Wi-Fi identifiers, sensor lists, and orientation data are processed temporarily in memory by default while the relevant feature is running. If written into a local diagnostic log, they remain until log rotation, deletion of the relevant files, clearing of App data, or uninstallation;
- WebView cookies, third-party cookies, DOM or website local storage, page state, and cache may remain until their own expiry, clearing by the website or WebView, clearing of App data, or uninstallation. The Stardew Valley Wiki and third-party resources referenced by its pages determine the retention of their server logs, cookies, and other information under their own privacy notices;
- Diagnostic logs uploaded to SMAPI.io are handled under its privacy notice, which currently states a 30-day retention period.
8. Security
We use security measures appropriate to the scale of the service, including:
- HTTPS for account information in transit;
- Non-reversible password hashes for verification;
- No storage of login passwords in the client;
- Random login tokens with token digests stored on the server;
- Android secure storage for client login information;
- Access controls, login rate limiting, and administrator authentication;
- Logging of necessary administrative operations;
- Revocation of login tokens when an account is closed or a password is reset;
- Access restrictions for databases and server configuration files.
No internet service can guarantee absolute security. If an information-security incident may affect your rights, we will take remedial measures and provide notice or report to the appropriate authority as required by applicable law.
9. Your Rights
Subject to applicable law, you may request to:
- Access or obtain a copy of your personal information;
- Correct or supplement inaccurate information;
- Delete information when legal deletion requirements are met;
- Restrict or object to certain processing;
- Withdraw consent-based processing;
- Cancel or close your account;
- Receive an explanation of this Policy;
- Transfer personal information when legally required and technically feasible;
- Submit a complaint about personal-information processing.
Send requests to zcs2004@126.com. To protect account security, we may ask for information necessary to verify account ownership, but we will not request excessive information unrelated to verification.
Withdrawing consent does not affect processing lawfully performed before withdrawal. If you delete your account or necessary account information, we may no longer be able to provide account verification, proof of fulfillment, or after-sales support.
10. Children's Privacy
StellarBox is not designed specifically for children under 14.
Users under 14 should use the App only with the consent and guidance of a parent or other guardian. Do not submit an account, order number, diagnostic log, or other personal information without guardian consent.
If we learn that we processed personal information of a child under 14 without guardian consent, we will delete it or stop the relevant processing after verification, as required by law.
11. Policy Updates
If there is a material change to the purpose, method, or categories of processing, retention period, third-party recipients, or contact details, we will update this Policy and provide notice through an in-App prompt or the Privacy Policy website.
Where renewed consent is required, we will request it before the new version takes effect. We will not expand processing beyond the previously authorized scope without legally required consent.