Privacy Policy

1. Who is responsible

SpriteReady is the name of the service. References to “we”, “us” and “our” mean its legal operator, operating the service under that name. The operator is responsible for the personal information it collects for the service, including information handled by providers on its behalf.

Privacy questions and requests: spriteready.support@gmail.com

2. Your artwork and local processing

When you select an image, the image tools read and process it in your browser. The normal processing workflow does not upload your source image, filename, image-content hash, intermediate pixels or exported PNG to SpriteReady, Firebase, Stripe or an AI image-processing service. We do not receive an artwork library through that workflow and do not use your artwork for model training or advertising.

The current editor keeps the source and result in the open browser session. Download files you want to keep. Closing or refreshing the page can lose unfinished work. Files you download remain on your device until you remove them, and your browser, operating system, extensions or device backup services may handle local data under their own settings.

If you deliberately send an image to support, you are sharing it outside the normal local-processing workflow. Send only what is necessary, avoid confidential or sensitive material, and make sure you have permission to share it.

3. Information handled online

We handle the following information as needed for the features you use. You can view public examples without opening an account.

• Account information: email address, account identifier, verification status, sign-in provider, and any name or profile information supplied through sign-in or by you. Firebase Authentication handles password-based sign-in; SpriteReady does not receive your plaintext password.
• Usage and access records: random workspace and request identifiers, tool mode, software version, image dimensions and result colour count, processing status, free-fix balance, and relevant timestamps. These records do not contain your artwork or its filename.
• Billing information: Stripe customer and subscription identifiers, purchase and payment status, plan and price information, currency, billing dates, cancellation status and transaction references. Stripe collects payment and billing details through its hosted pages. We do not receive full payment-card numbers or card security codes through checkout.
• Technical information: hosting, authentication and security systems may record IP addresses, browser or user-agent information, requested URLs, timestamps and error or security events as part of providing the website and preventing abuse.
• Communications: the contact information, message and attachments you choose to send when asking for help or exercising a privacy right.

4. Why we use information

We use information to provide the features you request, verify and protect accounts, apply free-fix and subscription access rules, handle payments and cancellations, troubleshoot errors, answer requests, prevent misuse and comply with applicable legal obligations.

We do not sell personal information, run behavioural advertising, or include advertising trackers or session-replay software in the current application. We do not use workspace metadata to evaluate the subject matter of your artwork.

Where consent is required, we request it in a way appropriate to the information and purpose. This policy is not blanket consent for unrelated uses. If a proposed new use requires consent, we will ask before carrying it out.

5. Service providers and other disclosures

Google Firebase and Google Cloud provide the configured hosting, authentication, database and backend services. Stripe provides hosted payments, subscriptions and billing management when paid services are enabled. These providers receive information needed for those functions. If you choose Google sign-in, Google also handles that sign-in under its own terms and privacy information.

Providers may have their own legal obligations and purposes, including payment security and fraud prevention. Their notices explain those activities. Their policies do not replace our responsibility for our own handling of your information.

We may disclose necessary information to professional advisers subject to appropriate confidentiality, where disclosure is legally required, or where law permits it to protect people, accounts or the service. If ownership of the business changes, any transfer of personal information must follow applicable law and appropriate confidentiality and notification requirements.

6. Where information is processed

Online account, technical and payment information may be processed outside your province, state or country, including in the United States. Firebase Authentication operates from United States data centres. Other locations depend on the configured services and provider operations.

Information processed in another country may be subject to that country's laws and lawful access by authorities. We remain responsible for transfers we make to providers and use appropriate contractual and other safeguards where required. This does not change the local processing of artwork described above.

7. Cookies and browser storage

Authentication uses browser storage and, where needed by the sign-in process, cookies or similar mechanisms to establish and maintain a session. The sign-in settings and provider determine whether a session persists. Your browser may also cache application code and image-processing runtime files so they do not need to be downloaded again.

These mechanisms serve login, security and delivery of the application. They are distinct from saving an artwork workspace. The current application does not provide an opt-in persistent artwork library. Clearing site data may sign you out and remove local settings or unfinished work. Blocking required storage may prevent sign-in or processing features from working.

We do not currently set advertising or analytics cookies in the SpriteReady application. If optional tracking is introduced, we will explain it and provide any choices or consent required before it operates. External Google and Stripe pages have their own storage practices.

8. How long information is kept

We keep personal information for the purposes described in this policy and for a justified period needed to meet legal obligations, handle disputes, prevent fraud and maintain security. Retention depends on the record's purpose, whether an account or transaction remains active, applicable requirements and any unresolved request or dispute.

Account and free-fix balance records are needed while an account remains open. Payment, tax and dispute records may need to remain after an account closes. Support and technical records should be removed or de-identified when no longer needed. We do not promise that all records disappear immediately when an account is closed; provider backups and legally required records may have different deletion cycles.

We review retention needs and remove or de-identify information when there is no longer a justified reason to keep it. If you ask us to delete information, we will explain any records that must be retained and why. Provider-specific retention information is available in the notices linked above.

9. Security

We use safeguards appropriate to the information and risks, including authenticated access to account APIs and restrictions on direct access to account records. We limit access to people and providers who need it for their role. No internet service or device can guarantee absolute security.

Keep your credentials private, use a secure device, and sign out on shared devices. Tell us if you suspect unauthorised account access. We will assess security incidents and make notifications required by applicable law.

10. Your choices and privacy rights

You may ask what personal information we hold about you, request access or correction, ask for account closure or deletion, withdraw consent where it is the basis for processing, or raise a concern. Depending on the law that applies, you may have additional rights, such as portability, restriction or objection. Some requests are subject to lawful exceptions and retention requirements.

Contact the privacy address in section 1. We may need proportionate information to verify your identity before acting. Do not send a password or full card details. We will respond within the time required by applicable law, explain any lawful refusal or extension, and describe available complaint options. Where PIPEDA applies, access requests are generally subject to a 30-day response period, with limited lawful extensions.

You may also complain to the privacy regulator responsible for your location. Where applicable in Canada, this includes the Office of the Privacy Commissioner of Canada or the relevant provincial authority. Withdrawing information needed to run an account may mean we cannot continue that part of the service.

To request account closure or deletion, email our privacy contact. Do not rely on signing out or clearing browser data to close your online account or cancel billing.

11. Children and eligibility

SpriteReady is intended for people who can lawfully enter the service agreement and provide any consent required for their information. It is not directed at young children. Do not create an account if you cannot meet these requirements.

If you believe a child has supplied account information without the consent or capacity required by law, contact the privacy address so we can assess the situation and take appropriate action.

12. Changes to this policy

We will identify the effective date of each published version. Material changes will be brought to your attention through the website or account contact details as appropriate. We will obtain new consent when required and will not treat a policy update as retroactive permission for a new use of your information.