Privacy Policy

What we collect

When you sign in we receive your name, email address and profile picture from Google. When you generate a skin we store the photo or text prompt you submit and the skin we make. Payment details are handled by our payment partner; SpriteSkin never sees your card number.

The free editors, such as the Cape Maker, run entirely in your browser. What you draw there is not uploaded to us.

How we use it

Your photo is used only to generate the skin you request. It is never shown publicly or added to a gallery. We use your email to operate your account, send receipts and service notices and answer support requests. We do not send marketing email. We do not sell personal data and do not use your photos to train models.

Storage and retention

Files are stored with our infrastructure provider in encrypted form. Uploaded photos are deleted automatically within 24 hours of upload. Generated skins are kept until you delete them, unless you delete them or your account sooner. Order and payment records are kept as required for tax and accounting. When you delete your account we keep only a one-way hash of your email address, so the same email cannot claim the sign-up bonus twice.

Children

SpriteSkin is not directed to children under 13, and you must be 13 or older to create an account or upload a photo (16 or older in the EU and UK unless a parent or guardian consents). We do not knowingly collect personal information from children under 13, in line with the US Children’s Online Privacy Protection Act (COPPA). If you believe a child under 13 has given us personal information, email support@spriteskin.com and we will delete it.

Safety checks

Before a photo is used it may be checked by an automated content-safety classifier. The check runs only to enforce our rules, and its result is not used for anything else. Public forms are protected by a bot-detection service that may process your IP address and browser signals.

Cookies and analytics

The site uses a few cookies and similar browser storage that it needs to work, such as your sign-in session and your light or dark theme preference.

We also set a first-party cookie (vt_attr, kept for 90 days) that records how you first and most recently reached us, such as a referring website or campaign link. We use it only to see which channels lead to sign-ups and purchases, and we do not share it with advertising networks. It is only set after you accept analytics cookies in the banner, and withdrawing consent deletes it.

If you open a friend’s invite link, we set a cookie (vt_ref, kept for up to 30 days and removed once you sign up) so the invite can be credited. To prevent abuse of invite rewards, we store a salted hash of your IP address with the invite, not the address itself. Neither of you can see the other’s account details.

We count visits with Umami, a cookie-free analytics tool loaded from our own domain. It does not set cookies or store your IP address; your IP address is only used to determine your country and to count unique visits.

If you accept analytics cookies in the banner, we also use Google Tag Manager and Google Analytics. They set cookies (such as _ga) and let Google process your IP address and device information to produce usage reports for us. Nothing from Google is loaded until you accept. You can withdraw consent at any time under “Cookie settings” in the footer, which also deletes these cookies.

Service providers

We rely on a small number of processors: cloud hosting, storage and email delivery, an AI image provider that processes your photo or prompt only for your request, a content-safety classifier, a payment provider acting as merchant of record, and the analytics services described above.

Your rights

You can download or delete your skins at any time. In Settings you can export a copy of your data as JSON or delete your account. For any other privacy request, email support@spriteskin.com.