Account info: email address, via our authentication provider (Clerk).
Clerk sets its own session cookie to keep you signed in; this cookie is strictly necessary
for the service to work, so it doesn't require a cookie-consent banner. We use privacy-friendly,
cookieless analytics (Plausible) for aggregate page-view and funnel counts — it sets no
cookies and builds no cross-site or advertising profile. We run no advertising trackers and set
no other cookies ourselves.
Generated content: the grid/palette data and metadata of assets you create,
stored so your gallery syncs across devices.
Edit links: when you open a sprite in the editor through an edit link —
yourself, or through an AI assistant such as Claude acting on your request — that sprite's
pixel and palette data is stored under an unguessable link so the editor can load and save it
without an account. Anyone holding the link can view and edit that sprite. Edit links aren't
tied to an account and are deleted automatically 24 hours after the last edit, and never kept
more than 7 days after they're created.
AI assistant connectors: if you connect your SpriteForge account to an AI
assistant (such as Claude) through our sign-in, that assistant can read and change your
projects and sprites, see your credit balance, and start AI generations that spend your
credits, when you ask it to. Download links it creates for your sprites work without sign-in
and expire after 24 hours; anyone holding one can download that sprite until then. It can't
delete your sprites or projects, make purchases or change your account. You can disconnect it
at any time in the assistant's settings.
Prompts & reference images: the text prompts and any reference images
you submit for a generation are sent to the third-party AI model provider that fulfills that
specific request (see "Third parties" below), and retained by us only as long as needed to
bill and debug that generation — we don't otherwise store or reuse prompt content.
Usage logs: which model was used per generation and its cost, for billing
and abuse prevention — not the content of your prompts beyond what's needed to bill and
debug a failed generation.
Payment info: handled entirely by Polar, our merchant of record; we never
see or store your card details.
How we use it
To run the service: authenticate you, sync your gallery, meter and bill generations, prevent
abuse (rate limits and per-account caps), and fix bugs. We don't sell your data or generated
content to third parties.
Third parties
We rely on a small set of processors (sub-processors) to run the service:
Clerk — authentication and account/session management.
Vercel — our hosting and serverless-compute platform; serves the site
and runs the API, processing your requests, IP address, and operational logs.
Neon — our Postgres database host; stores your account, assets, and
usage-log rows.
Polar — payments, acting as merchant of record; handles checkout,
card data, VAT/sales tax collection and remittance. We never see your full card details.
Plausible Analytics — privacy-friendly, cookieless website analytics;
receives aggregate page-view and event data only (no cookies, no cross-site tracking, no
advertising profile).
AI model providers — your prompt and any reference image are sent to
OpenRouter, the routing service that fulfils generation requests, and on to the
underlying AI model providers it routes to (which currently include OpenAI and Anthropic), for the
sole purpose of generating your requested asset. Some of these providers process data in the
United States.
Each processor only receives the data needed to perform its function. If we add a new
sub-processor that materially changes this list, we'll update this page.
Retention & deletion
Your data is retained while your account is active. You can delete your account at any time
yourself from the account panel in the app (the Delete account button), or by
emailing us below; either way this first exports a downloadable copy of your gallery and usage
history, then permanently deletes your account, assets, and usage-log rows from our database and
your account from Clerk. We aim to complete deletion requests without undue delay, and in any case
within the timeframes required by applicable law (for EU users, within one month under GDPR,
extendable by up to two months for complex requests). We may also delete, limit, or refuse to
store content ourselves — e.g. for accounts over their storage quota, inactive for an
extended period, or reasonably suspected of abusing the service — as described in our
Terms of Service; where practical we'll try to give you a chance to export first.
Legal basis (EU/EEA/UK)
Where GDPR applies, we process your personal data on these bases: performance of a
contract (creating and running your account, syncing your gallery, and metering and
billing generations); legitimate interests (preventing abuse and fraud, keeping
the service secure, and basic aggregate analytics), balanced against your rights and freedoms;
and legal obligation (tax and accounting records, handled by Polar as merchant
of record). We don't use your data for advertising or automated profiling.
International transfers
Some of our processors — notably certain AI model providers (see Third parties) —
process data in the United States. Where personal data is transferred outside the EEA/UK, that
transfer is covered by the relevant provider's safeguards (such as the EU Standard Contractual
Clauses). We only send what's needed to fulfil your request.
Children
SpriteForge is not directed to children. You must be at least 16 (or the age of digital consent
in your country, if higher) to create an account and use the service.
Your rights
If you're in the EU/EEA or UK, you have rights under GDPR to access, correct, export, or
delete your personal data, and to object to or restrict certain processing. Deleting your
account from the app also returns a downloadable export of your data; to access, correct, or
export your data without deleting your account, email us below and we'll fulfil the
request. Contact us below to exercise any of these rights. You also have the right to lodge a
complaint with your local data-protection authority; in Slovakia this is the Úrad na ochranu
osobných údajov Slovenskej republiky (dataprotection.gov.sk).
Data controller & contact
The data controller for personal data processed by SpriteForge is
Ondrej Knizat, Dunajska 1, 949 11 Nitra, Slovakia
(operating as an individual). Questions or data requests:
support@spriteforge.tech.