Privacy Policy
Last updated: 18 August 2026
ThirdStar is a training tool for restaurant staff. Restaurants use it to teach their teams the menu, the allergens, and how to run a table. We wrote this policy to be read, not to be survived. If something here is unclear, ask us — the contact is at the bottom.
The short version
We collect what the product needs to teach you and to show your manager how you're doing, and nothing else. We do not track you across other apps or websites — no advertising identifiers, no third-party analytics, nothing sold or shared for advertising, ever. Your voice is never stored by us. Audio is transmitted so it can be turned into text and so the guest can speak back to you; we do not keep the recording. Your manager can see your training progress at their restaurant, and not your activity at any other. You can ask us to delete your account and your data at any time.
Who we are
ThirdStar is operated by Stealth Services Inc. Questions about this policy or your data: [email protected].
What we collect, and why
When you sign in. ThirdStar uses Sunday as its identity provider. We receive a stable account identifier and a routing email address issued by Sunday — for most people that is not their personal email address. We use it to know who you are across sessions and to attach your training to you. We do not receive your password.
When you train
Quiz answers, which cards you've reviewed and when, what you've mastered, what you're struggling with, and the transcripts and grades of roleplay conversations you complete. This is the product: without it there is nothing to review, no spaced repetition, and no way for a manager to sign you off.
When you speak
In voice roleplay your speech is sent to a transcription service to be turned into text, and the guest's replies are sent to a speech service to be spoken back. ThirdStar does not store the audio. The resulting text becomes part of the roleplay transcript, which we do store, because that is what gets graded and what a manager reviews.
Your name, your role, and what your account uses
A display name and your track — server, bartender, host — so a manager can find you on their roster. We also keep counts of the requests the app makes on your behalf, so restaurants can see what their account is using. Those are counts, not content.
If your restaurant connects its scheduling system
A restaurant may import a staff list so people can claim their own entry. We hold a first name, a last initial, and an internal identifier. We do not hold staff email addresses from that import, and if the restaurant disconnects it, we delete what came from it.
What we don't do
No advertising identifiers and no ads. No tracking you across other companies' apps or websites, and no profile of you outside ThirdStar. No third-party analytics or advertising SDKs. We do not sell your personal information and do not share it for cross-context behavioural advertising. We do not store your voice recordings. And we do not use your personal information to train general-purpose AI models.
Who can see what
Your manager sees your training at their restaurant: progress, mastery, roleplay grades, and past roleplay transcripts. If you work at two restaurants that both use ThirdStar, each manager sees only their own. Other trainees cannot see your results. We can access data to run and support the service, and do so only when necessary — a support request, an outage, or a security investigation.
The companies that process data for us
ThirdStar runs on infrastructure and services operated by others. They act on our instructions and may not use your data for their own purposes.
| What they do | Who |
|---|---|
| Sign-in / identity | Sunday |
| Database and file storage | Supabase |
| Application hosting | Railway |
| AI conversation and grading | Anthropic |
| Speech transcription and synthesis | ElevenLabs |
How long we keep things
We keep your training data while your account is active, because that is what the product is for — a mastery record with no history cannot schedule your next review. When you delete your account, or a restaurant closes its account, we delete the associated personal data within 90 days. Backups may take a further short period to age out. Roleplay transcripts and grades are kept alongside your account and deleted with it.
Your choices
See your data — ask us and we'll provide it. Correct it — ask your manager for roster details, or us for anything else. Delete it — ask us and we'll delete your account and personal data within 90 days. Use the app without an account — the study and roleplay features work anonymously; nothing is attached to you and nothing follows you to another device. Turn off the microphone — voice is optional, and you can use text mode instead. Depending on where you live you may have additional rights, for example under the GDPR or the CCPA, including the right to object, to restrict processing, to portability, and to complain to a regulator. Write to [email protected] and we'll honour them.
Children
ThirdStar is a workplace training tool. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has used it, contact us and we will delete the account.
Security
Access to restaurant data is enforced in the database itself, not only in the app — a request for another restaurant's data is refused at the data layer. Traffic is encrypted in transit. No system is perfectly secure and we won't pretend otherwise; if we ever have a breach affecting your data, we will tell you and the relevant regulators as the law requires.
Changes
If we change this policy we'll update the date at the top. If a change materially affects how we use your data, we'll say so in the app rather than quietly editing this page.
Contact
Stealth Services Inc · [email protected] · See also our support page.