DRAFT — this text has not been reviewed by the person it binds. It describes what the software actually does today, and it is not yet a published policy.
Spritesmith is a sprite editor that runs in your browser. This page says exactly what it stores, why, for how long, and how to get it back or get rid of it. It describes what the software actually does — if something here does not match what you observe, that is a bug and we want to hear about it at hello@spritesmith.studio.
Signed out, nothing you draw ever leaves your browser. Spritesmith keeps your sprites on your own machine and works with no account at all. The one request the app makes before you sign in is to ask whether you are signed in, and its answer is no; it stores nothing about you. An account exists for one reason — so that your work survives a lost laptop and reaches your other machines.
Spritesmith is operated as an independent project. For anything about your data, write to hello@spritesmith.studio.
Only if you make an account. Everything below is empty until you do.
| What | Why |
|---|---|
| Your email address | It is the whole of your account. There are no passwords — signing in means we email you a code. An optional display name can be stored alongside it; nothing in the product shows one today. |
| The sprites you draw | So they are there on your other machines and after a lost laptop. Each sprite's layers, frames and pixels are stored as one file. We do not look at them, and nothing about them is used for anything except giving them back to you. |
| What a sprite is called, how big it is, its palette, tags and thumbnail | So the library can list your work without downloading every sprite in it. The thumbnail is a small picture of the sprite, made in your browser. |
| A session cookie | One HttpOnly cookie so you stay signed in. It is strictly necessary — it holds
no analytics and follows you nowhere. |
| Your network address, for an hour | Asking for a sign-in code is counted against the address that asked and against the network it came from, so that nobody's inbox can be used as a weapon. Reporting an error is counted the same way, for the same reason. Those counters hold a number against a network address and nothing else, they expire after an hour, and they are the only place a network address appears in anything Spritesmith stores — it is never attached to a sprite, an account or an error report. |
| What went wrong, when the app breaks | See When something goes wrong below — it is four fields, and one of them is your account id. |
Your sprites are held in your browser's local storage, which is what makes the editor work offline and instantly. That copy is yours: we cannot read it, and clearing your browser's site data deletes it. Signing out does not touch it — the sprites stay in the browser you drew them in.
Two companies, each doing one job:
Neither is permitted to use your data for their own purposes. Nobody else gets it, and it is not sold.
When a sign-in email fails to send, the failure is written to Cloudflare's log for the person fixing it, and that line contains the address it was being sent to.
If the app throws an error in your browser, it sends a report so that it can be fixed. This is the only thing Spritesmith reports automatically, and it happens when something breaks — not as you use it. It is not analytics: nothing is sent when things work.
A report is four fields, and that is the whole of it:
/api/sprites/…. A path, not a full address.It does not include your sprites, your pixels, what you had typed, a screenshot, or your network address. Identifiers inside the message are stripped before it is stored, because the same fault hitting four hundred sprites is one bug and should be one row.
Repeats of the same error are counted rather than stored again, and no more than 120 reports an hour are accepted from one network. Reports are kept for 30 days and then deleted. They are read by the person fixing the fault and are shared with nobody.
Once a night, a copy of the database and of every sprite file is written to a separate store, also at Cloudflare, so that a fault on our side is something you recover from rather than something you lose your work to. Nothing reads it in normal use — it exists for the day something goes wrong.
It is a copy, so deleting something is not instant everywhere. Deleting a sprite, or closing your account, removes it from the live service on the schedule below. A copy of it can still sit in a backup afterwards, and backups are kept for 90 days before they are deleted in turn. That is the whole of the delay: nothing is kept beyond it, and nothing in a backup is ever looked at or used for anything else.
Error reports are not in the backup. It holds your account, your sprites and the folders they sit in, and nothing else.
| What | How long |
|---|---|
| Sign-in codes and links | 10 minutes, then they expire on their own. Each is good for one use, and 5 wrong guesses destroy it. |
| A signed-in session | 90 days, or until you sign out |
| Sign-in request counters | One hour |
| Your sprites | Until you delete them, or close your account |
| After you close your account | 30 days, so a change of mind is recoverable. Then it is deleted from the live service. |
| Error reports | 30 days, then deleted |
| Backup copies | 90 days. Anything you deleted before then can still be inside one until it ages out. |
Closing your account is a real closure, not a hidden flag: every device you are signed in on is signed out at once, and the whole bank goes with it — out of the live service on the schedule above, and out of the backups within 90 days of the last one that held it.
These are buttons, not a request process. You do not have to write to anyone, and you do not have to explain why.
These rights are offered to everyone who uses Spritesmith, wherever you live, rather than only where the law compels them.
Spritesmith is a tool for making game art and is not intended for children under 13. We do not knowingly collect anything from them.
If this policy changes, the date at the top changes with it. We do not have a mailing list to tell you on — the only message this service sends is a sign-in code you asked for — so the date is the notice. We will not quietly broaden what we do with data you have already given us.