Privacy Policy

1. Who is responsible

SpriteReady is an independently operated software service based in Ontario, Canada. It is operated by an individual, not an incorporated company. References to “we”, “us” and “our” mean the operator of the service. The operator is responsible for personal information collected for the service, including information handled by providers on its behalf.

Privacy questions and requests: spriteready.support@gmail.com. Business support telephone: +1 416-477-4138.

2. Your artwork and local processing

When you select an image, the image tools read and process it in your browser. The normal processing workflow does not upload your source image, filename, image-content hash, intermediate pixels or exported PNG to SpriteReady, Firebase, Stripe or an AI image-processing service. We do not receive an artwork library through that workflow and do not use your artwork for model training or advertising.

The current editor keeps the source and result in the open browser session. Download files you want to keep. Closing or refreshing the page can lose unfinished work. Files you download remain on your device until you remove them, and your browser, operating system, extensions or device backup services may handle local data under their own settings.

If you deliberately send an image to support, you are sharing it outside the normal local-processing workflow. Send only what is necessary, avoid confidential or sensitive material, and make sure you have permission to share it.

3. Information handled online

We handle the following information as needed for the features you use. You can view public examples without opening an account.

Support email is handled through Gmail. If you call the business support number, Fongo handles call routing, caller information and any voicemail recording you choose to leave; voicemail may be delivered to the support email inbox. Avoid including passwords, full card details or unnecessary sensitive information in support messages.

• Account information: email address, account identifier, verification status, sign-in provider, and any name or profile information supplied through sign-in or by you. Firebase Authentication handles password-based sign-in; SpriteReady does not receive your plaintext password.
• Usage and access records: random workspace and request identifiers, tool mode, software version, image dimensions and result colour count, processing status, free-fix balance, and relevant timestamps. These records do not contain your artwork or its filename.
• Billing information: Stripe customer and subscription identifiers, purchase and payment status, plan and price information, currency, billing dates, cancellation status and transaction references. Stripe collects payment and billing details through its hosted pages. We do not receive full payment-card numbers or card security codes through checkout.
• Technical information: hosting, authentication and security systems may record IP addresses, browser or user-agent information, requested URLs, timestamps and error or security events as part of providing the website and preventing abuse.
• Communications: the contact information, message and attachments you choose to send when asking for help or exercising a privacy right.

4. Why we use information

We use information to provide the features you request, verify and protect accounts, apply free-fix and subscription access rules, handle payments and cancellations, troubleshoot errors, answer requests, prevent misuse and comply with applicable legal obligations.

We do not sell personal information, use session-replay software, or use workspace metadata to evaluate the subject matter of your artwork. With separate optional consent, we measure whether our Google ads lead to account creation and initial subscription purchases.

Optional campaign and Google Ads measurement is off until you accept it in Privacy choices. If you accept, SpriteReady remembers validated UTM source, medium, campaign, term and content labels for the first and most recent tagged visit on this browser for up to 90 days. At new-account setup, we save those labels in your account record in Firebase so we can connect acquisition campaigns to verified subscription purchases using our existing billing records. These labels are self-reported marketing data, not proof that an ad caused a purchase. We do not store full arrival URLs, referrers or Google click IDs in this account attribution. Account-linked labels remain until account deletion; contact support to request their earlier removal. Rejecting clears the browser's campaign labels and stops future optional collection, but does not automatically erase previously saved account data. Google may receive advertising click and cookie identifiers, basic device/browser and network information, a sanitized page URL, completed-signup events, and confirmed initial subscription purchase events with an opaque transaction reference, amount and currency. We do not send artwork, filenames, email addresses, Firebase account IDs or payment-card details in those events. Enhanced customer-data matching and personalized advertising are disabled. Declining does not limit the tools or your free fixes. Use Privacy choices on any page to withdraw consent and stop future measurement; withdrawal does not erase information already received by Google. Browser privacy controls and ad blockers can prevent measurement.

Where consent is required, we request it in a way appropriate to the information and purpose. This policy is not blanket consent for unrelated uses. If a proposed new use requires consent, we will ask before carrying it out.

5. Service providers and other disclosures

Google Firebase and Google Cloud provide the configured hosting, authentication, database and backend services. Stripe provides hosted payments, subscriptions and billing management when paid services are enabled. These providers receive information needed for those functions. If you choose Google sign-in, Google also handles that sign-in under its own terms and privacy information.

Providers may have their own legal obligations and purposes, including payment security and fraud prevention. Their notices explain those activities. Their policies do not replace our responsibility for our own handling of your information.

We may disclose necessary information to professional advisers subject to appropriate confidentiality, where disclosure is legally required, or where law permits it to protect people, accounts or the service. If ownership of the business changes, any transfer of personal information must follow applicable law and appropriate confidentiality and notification requirements.

6. Where information is processed

Online account, technical and payment information may be processed outside your province, state or country, including in the United States. Firebase Authentication operates from United States data centres. Other locations depend on the configured services and provider operations.

Information processed in another country may be subject to that country's laws and lawful access by authorities. We remain responsible for transfers we make to providers and use appropriate contractual and other safeguards where required. This does not change the local processing of artwork described above.

7. Cookies and browser storage

Authentication uses browser storage and, where needed by the sign-in process, cookies or similar mechanisms to establish and maintain a session. The sign-in settings and provider determine whether a session persists. Your browser may also cache application code and image-processing runtime files so they do not need to be downloaded again.

These mechanisms serve login, security and delivery of the application. They are distinct from saving an artwork workspace. The current application does not provide an opt-in persistent artwork library. Clearing site data may sign you out and remove local settings or unfinished work. Blocking required storage may prevent sign-in or processing features from working.

We remember your optional measurement choice on this browser for up to 180 days. When you accept, Google Ads may use first-party advertising cookies to attribute events to ad clicks. We keep up to 100 opaque event references locally for up to 90 days to avoid duplicate reporting. Global Privacy Control keeps optional measurement off. No Google Ads tag is loaded before acceptance. External Google and Stripe pages have their own storage practices.

8. How long information is kept

Successful workspace metadata becomes eligible for cleanup after 90 days without an authorized processing run. Failed, released, or expired reservations become eligible after 30 days. Completed webhook delivery receipts become eligible after 90 days, rate-limit counters shortly after their enforcement window, and account-deletion recovery receipts after 30 days. Cleanup runs weekly and may not occur at the exact eligibility time. Active workspaces, pending recovery operations and records on legal hold are protected.

Account and free-fix balance records remain while an account is open. Account deletion immediately blocks app access and starts cancellation of future billing. Ordinary account/workspace records and the sign-in identity are normally removed within 7 business days during weekly cleanup, after billing cancellation is verified. Contact support if completion is delayed. Checkout and billing audit records needed to prevent duplicate charges, meet legal obligations or resolve disputes can remain separately after closure. Where Canadian tax-record requirements apply, relevant financial records are generally kept for at least six years after the end of the last tax year to which they relate, and longer where required.

Support correspondence, voicemail and security records are reviewed separately and retained only while needed for support, security, legal obligations or unresolved disputes. Gmail, Fongo, Stripe and Google may have separate retention obligations or backup cycles; the application's cleanup job does not erase every provider copy. If you request deletion, we will explain any records that must remain and why. No artwork library is stored by the normal processing workflow.

9. Security

We use safeguards appropriate to the information and risks, including authenticated access to account APIs and restrictions on direct access to account records. We limit access to people and providers who need it for their role. No internet service or device can guarantee absolute security.

Keep your credentials private, use a secure device, and sign out on shared devices. Tell us if you suspect unauthorised account access. We will assess security incidents and make notifications required by applicable law.

10. Your choices and privacy rights

You may ask what personal information we hold about you, request access or correction, ask for account closure or deletion, withdraw consent where it is the basis for processing, or raise a concern. Depending on the law that applies, you may have additional rights, such as portability, restriction or objection. Some requests are subject to lawful exceptions and retention requirements.

Contact the privacy address in section 1. We may need proportionate information to verify your identity before acting. Do not send a password or full card details. We will respond within the time required by applicable law, explain any lawful refusal or extension, and describe available complaint options. Where PIPEDA applies, access requests are generally subject to a 30-day response period, with limited lawful extensions.

You may also complain to the privacy regulator responsible for your location. Where applicable in Canada, this includes the Office of the Privacy Commissioner of Canada or the relevant provincial authority. Withdrawing information needed to run an account may mean we cannot continue that part of the service.

To request account closure or deletion, email our privacy contact. Do not rely on signing out or clearing browser data to close your online account or cancel billing.

11. Children and eligibility

SpriteReady is intended for people who can lawfully enter the service agreement and provide any consent required for their information. It is not directed at young children. Do not create an account if you cannot meet these requirements.

If you believe a child has supplied account information without the consent or capacity required by law, contact the privacy address so we can assess the situation and take appropriate action.

12. Changes to this policy

We will identify the effective date of each published version. Material changes will be brought to your attention through the website or account contact details as appropriate. We will obtain new consent when required and will not treat a policy update as retroactive permission for a new use of your information.