Home › Step 3
Signing up without handing over more than you need
Step three of seven. Registration takes two minutes and shapes the next several years: whether the account can be recovered, who can reach the person using it, and how much personal information is sitting in someone else's database. This page covers what sign-up normally asks for, what is worth thinking about before you answer, and how the process works when the player is a child.
Registration and activation are two different things
Registration creates the account. Activation proves that the email address given belongs to whoever created it, usually by way of a link sent to that address. Until activation has happened the account often exists but cannot be used, which produces the single most common "the sign-up is broken" complaint in this category. Star Stable Online, the title covered in detail on this site, requires an account to be created and activated before play begins.
Two practical consequences follow. First, use an address you can open immediately, on the device in front of you. Second, if the message has not arrived within a few minutes, check the spam or junk folder before requesting another — repeated requests sometimes invalidate the earlier link and make the problem worse. Step seven covers what to do when it genuinely has not arrived.
What a sign-up normally asks for
Requirements differ by publisher, and the only authoritative list is the form itself. Broadly, fields fall into three groups, and it is worth recognising which is which as you fill them in.
| Field | Why it is usually asked | What to consider |
|---|---|---|
| Email address | Account identity, activation, password resets and service notices | The one field that genuinely matters. An address you will still control in five years is worth more than a convenient one. |
| Password | Authentication | Long and unique to this account. Length beats complexity; reuse is the real risk. |
| Display name | How other players see you | Visible to strangers. Not a real name, not a school, not a birth year. |
| Date of birth | Age-gating, and which features or controls apply | Answer accurately: an inaccurate date can attach the wrong protections to a child's account. |
| Country | Pricing, currency, applicable terms and consumer law | Selecting Australia is what makes Australian pricing and consumer protections the relevant ones. |
| Parent or guardian email | Consent and oversight for younger players | Use an address the adult actually reads. This is the route through which spending and safety notices arrive. |
| Marketing consent | Promotional email | Optional by nature. Declining does not affect the service. |
The password, and the account that comes back
Game accounts accumulate value — time more than money — and they are stolen routinely because that value is resellable. The Australian Cyber Security Centre publishes plain guidance for individuals on cyber.gov.au, and its consistent advice is the same in every context: use a long passphrase, use a different one for every account, and turn on multi-factor authentication wherever it is offered.
- Choose a passphrase of several unrelated words rather than a short string of substituted characters. It is easier to remember and harder to attack.
- Do not reuse the password from an email account, a school account or a bank. A game account compromised elsewhere should not open anything else.
- If a password manager is available, use it; if not, written down and kept at home is better than reused.
- Turn on multi-factor authentication if the publisher offers it, and record the recovery codes somewhere other than the device that generates them.
- Keep the email account itself secure. Whoever controls the mailbox controls every account that resets through it.
When the player is a child
An adult signing a child up is agreeing to terms on that child's behalf, and it is reasonable to read them first — particularly the sections on chat, on purchases and on what happens to an account if the terms are breached. The practical decisions are usually these: which email address the account is attached to, whether chat is available and in what form, and whether any payment method is reachable from the account. The first of those is easiest to get right at sign-up and hardest to change later.
Attaching the account to an adult's email address, or to an address the household controls jointly, keeps password resets and purchase receipts visible. It is not surveillance; it is the same reasoning that puts a parent's name on a library card. The eSafety Commissioner's material for parents and carers covers the conversation side of this, and step five deals with chat and classification specifically.
Terms are worth three minutes of skimming
Nobody reads a full set of terms. Four headings are worth finding: how accounts can be suspended or closed, what happens to purchased items if that occurs, how to cancel a recurring payment, and how to close the account and have personal information deleted. Those four determine what your options are on the day something goes wrong.
Privacy, and what happens to the information you provide
A publisher collecting personal information from people in Australia is generally required to say what it collects, why, and to whom it discloses it. The Office of the Australian Information Commissioner explains the Australian Privacy Principles and the rights that go with them — including access to your own information and correction of it — at oaic.gov.au. If a publisher's privacy policy cannot be found before sign-up, that in itself is information.
Many game publishers are based overseas, which means personal information is likely to be held outside Australia. That is lawful and common; it is worth knowing because it affects which regulator can help you and how long a request may take. The OAIC is the body to approach with a complaint about the handling of personal information in Australia.
What to watch out for at this stage
- Sign up on the publisher's own site or in the official app, never through a link in an unexpected message. Phishing pages copying game sign-in screens are common enough that Scamwatch maintains reporting for exactly this kind of report.
- No legitimate publisher, moderator or support agent asks for your password. Not in chat, not by email, not to "verify" anything.
- Offers of free currency, rare items or account upgrades in exchange for signing in somewhere are a credential-harvesting pattern, not a bargain.
- Be careful with "sign in with" buttons on shared devices: they link two accounts together, and untangling them later is more work than it sounds.
A sign-up worth keeping
- The email address is one you will still control in several years, and it is itself secured.
- The password is long, unique to this account, and recorded somewhere you can find it.
- Multi-factor authentication is on, if the publisher offers it.
- The display name gives away nothing about identity, school or age.
- The country is set to Australia, so that Australian pricing and consumer law apply.
- For a child's account, an adult's email address is attached and the terms on chat and purchases have been read.
- No payment method has been saved yet. That decision belongs to step four, deliberately and separately.
Step three in one line
Spend two minutes on the email address and the password, answer the age and country fields accurately, and leave payment details out of it until you have decided what you are willing to spend. Next: step four.