Privacy Policy

1. What this policy covers

This Privacy Policy explains what personal data the hosted Spriterrific service (app.spriterrific.com, the HTTP API, and the spriterrific.com website) collects, how it is used, who it is shared with, and the choices you have. The Service is operated from the United Kingdom, and we handle personal data in accordance with the UK GDPR and the Data Protection Act 2018. The open-source CLI run on your own machine with your own provider keys is not covered — it sends data to providers you configure, not to us.

2. Data we collect

Account data: your email address, name, and avatar image, provided by your sign-in method (Google, GitHub, or email) through our authentication provider, Clerk. We also record first-touch marketing attribution (e.g. utm parameters) when you create your account.

Content you submit: prompts, character descriptions, and reference images you upload or link for generation, plus curation choices such as frame picks.

Generated content and job metadata: the images, videos, and spritesheets generated for you, and job records (parameters, timing, per-step outcomes, credits spent, provider cost, and error messages).

Optional quality feedback: thumbs-up or thumbs-down ratings, selected issue reasons, and any comment you choose to provide about a generated result.

Billing data: your credit balance, ledger history, and subscription state. Payments are processed by Dodo Payments; we never see or store your full card details.

API keys: stored only as SHA-256 hashes with a short display prefix — we cannot recover a full key after creation.

Technical data: standard server and security logs (IP address, user agent, timestamps) kept by us and our infrastructure providers for operations, debugging, and abuse prevention.

3. How we use your data

We use your data to operate and improve the Service: authenticating you, running generation jobs, storing and serving your artifacts, metering credits, processing payments, preventing fraud and abuse (including trial-credit farming and API misuse), providing support, diagnosing generation quality from optional feedback, improving product reliability and output quality, and sending account notices, receipts, and occasional product updates. When you add feedback details, an authorized Spriterrific operator may review the associated generated result to investigate the issue. We do not sell your personal data, and we do not use your prompts, reference images, or generated assets to train AI models.

Our lawful bases depend on the purpose: contract where processing is needed to provide the Service you request; legitimate interests for security, abuse prevention, service analytics, support, optional quality feedback, and product improvement; legal obligation where records must be kept by law; and consent where we specifically ask for it. When we rely on legitimate interests, we consider and balance those interests against your privacy rights.

4. AI generation and third-party model providers

To generate assets, your prompts and reference images are transmitted to third-party AI model providers — currently fal.ai and the image/video models it hosts — which process them under their own privacy policies. Treat anything you submit for generation as data that leaves our systems. Don’t submit sensitive personal information, and don’t upload photos of identifiable people unless you have their consent.

5. Where your content is stored — and who can see it

Generated artifacts are stored in Cloudflare R2 object storage and served from unlisted public URLs: they are not listed or indexed anywhere, but anyone who obtains a specific artifact URL can view that file without signing in. Uploaded reference images are stored separately in private file storage (Convex), are never published to the public artifact store, and are only transmitted to the AI model providers that perform generation. Your dashboard, run history, credit balance, and account details are not visible to other customers. Authorized Spriterrific operators may access job records and generated artifacts where needed for support, security, service operation, or investigation of optional quality feedback.

6. Service providers (subprocessors)

We rely on a small set of infrastructure providers to run the Service, each receiving only the data needed for its role: Clerk (authentication and account identity), Convex (application database and backend), Vercel (web app hosting), Railway (generation worker compute), Cloudflare (object storage and CDN), DataFast (privacy-first product analytics on the marketing site and the app), fal.ai (AI model inference), Dodo Payments (payment processing), and Resend (transactional and product email).

These providers are based primarily in the United States, so your data is transferred outside the UK. Where required, we rely on the providers’ standard contractual safeguards (such as UK-approved standard contractual clauses or equivalent mechanisms in their data-processing terms) for those transfers.

7. Cookies and analytics

The app uses cookies set by Clerk to keep you signed in; these are strictly necessary for the Service and are not used for advertising. The marketing site (spriterrific.com) and this app use DataFast analytics to understand traffic and conversions; it is privacy-oriented and is not used for advertising. We do not use third-party advertising trackers.

8. Data retention and deletion

We keep your account data, job history, optional quality feedback, and stored artifacts while your account is active, and billing records as long as required for accounting and legal obligations. You can request deletion of your account and associated data at any time by contacting us (section 11); we will delete or anonymize your personal data within a reasonable period, except records we must keep by law. Stored artifacts may also be removed after extended retention periods or if they violate our Terms.

9. Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you may have rights to access, correct, export, restrict, or delete your personal data, and to object to processing based on legitimate interests. To exercise any of these rights, contact us (section 11). You can also update your name and avatar through your sign-in provider, and revoke API keys in Settings at any time.

10. Children

The Service is not directed at children under 13 (or the higher minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes and contact

We may update this Privacy Policy from time to time. We will update the “last updated” date and proactively bring material new uses of personal data to your attention through the Service or by email before they begin. A Privacy Policy update is a notice and does not by itself require you to accept revised contractual Terms. Questions or data requests? Reach out to @chongdashu on X (x.com/chongdashu).