← Back

Privacy Policy

Last updated 2026-07-21

What we collect

• Account info: email address, via our authentication provider (Clerk). Clerk sets its own session cookie to keep you signed in; this cookie is strictly necessary for the service to work, so it doesn't require a cookie-consent banner. We use privacy-friendly, cookieless analytics (Plausible) for aggregate page-view and funnel counts — it sets no cookies and builds no cross-site or advertising profile. We run no advertising trackers and set no other cookies ourselves.
• Generated content: the grid/palette data and metadata of assets you create, stored so your gallery syncs across devices.
• Prompts & reference images: the text prompts and any reference images you submit for a generation are sent to the third-party AI model provider that fulfills that specific request (see "Third parties" below), and retained by us only as long as needed to bill and debug that generation — we don't otherwise store or reuse prompt content.
• Usage logs: which model was used per generation and its cost, for billing and abuse prevention — not the content of your prompts beyond what's needed to bill and debug a failed generation.
• Payment info: handled entirely by Polar, our merchant of record; we never see or store your card details.

How we use it

To run the service: authenticate you, sync your gallery, meter and bill generations, prevent abuse (rate limits and per-account caps), and fix bugs. We don't sell your data or generated content to third parties.

Third parties

We rely on a small set of processors (sub-processors) to run the service:

• Clerk — authentication and account/session management.
• Vercel — our hosting and serverless-compute platform; serves the site and runs the API, processing your requests, IP address, and operational logs.
• Neon — our Postgres database host; stores your account, assets, and usage-log rows.
• Polar — payments, acting as merchant of record; handles checkout, card data, VAT/sales tax collection and remittance. We never see your full card details.
• Plausible Analytics — privacy-friendly, cookieless website analytics; receives aggregate page-view and event data only (no cookies, no cross-site tracking, no advertising profile).
• AI model providers — your prompt and any reference image are sent to OpenRouter, the routing service that fulfils generation requests, and on to the underlying AI model providers it routes to (which currently include OpenAI and Anthropic), for the sole purpose of generating your requested asset. Some of these providers process data in the United States.

Each processor only receives the data needed to perform its function. If we add a new sub-processor that materially changes this list, we'll update this page.

Retention & deletion

Your data is retained while your account is active. You can delete your account at any time yourself from the account panel in the app (the Delete account button), or by emailing us below; either way this first exports a downloadable copy of your gallery and usage history, then permanently deletes your account, assets, and usage-log rows from our database and your account from Clerk. We aim to complete deletion requests without undue delay, and in any case within the timeframes required by applicable law (for EU users, within one month under GDPR, extendable by up to two months for complex requests). We may also delete, limit, or refuse to store content ourselves — e.g. for accounts over their storage quota, inactive for an extended period, or reasonably suspected of abusing the service — as described in our Terms of Service; where practical we'll try to give you a chance to export first.

Legal basis (EU/EEA/UK)

Where GDPR applies, we process your personal data on these bases: performance of a contract (creating and running your account, syncing your gallery, and metering and billing generations); legitimate interests (preventing abuse and fraud, keeping the service secure, and basic aggregate analytics), balanced against your rights and freedoms; and legal obligation (tax and accounting records, handled by Polar as merchant of record). We don't use your data for advertising or automated profiling.

International transfers

Some of our processors — notably certain AI model providers (see Third parties) — process data in the United States. Where personal data is transferred outside the EEA/UK, that transfer is covered by the relevant provider's safeguards (such as the EU Standard Contractual Clauses). We only send what's needed to fulfil your request.

Children

SpriteForge is not directed to children. You must be at least 16 (or the age of digital consent in your country, if higher) to create an account and use the service.

Your rights

If you're in the EU/EEA or UK, you have rights under GDPR to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Deleting your account from the app also returns a downloadable export of your data; to access, correct, or export your data without deleting your account, email us below and we'll fulfil the request. Contact us below to exercise any of these rights. You also have the right to lodge a complaint with your local data-protection authority; in Slovakia this is the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk).

Data controller & contact

The data controller for personal data processed by SpriteForge is Ondrej Knizat, Dunajska 1, 949 11 Nitra, Slovakia (operating as an individual). Questions or data requests: support@spriteforge.tech.