Privacy Policy

Last updated: April 23, 2026. Short version: we collect the minimum needed to run the service, we don't sell your data, and you can delete your account at any time.

1. What we collect

• Account info: email address, optional username, and a hashed password (we never see the plaintext).
• Your project data: spritesheets, animations, masks, and settings you save to your account.
• Session cookies: a sign-in cookie so you stay logged in.
• Operational logs: IP address and request metadata, briefly, for abuse prevention and debugging.

2. Where it lives

Account and project data is stored on a server we operate in a Postgres database. If you use SpriteWash as a guest (without signing in), your work is stored in your browser only (IndexedDB) and never leaves your device.

3. Who we share with

We don't sell your data, and we don't share it with third parties for advertising. We use a couple of service providers to run the app:

• Resend — to send sign-in and password-reset emails. Your email address is shared with them for that purpose only.
• Hosting provider (Hetzner) — hosts the server your data is stored on.

4. Email

We only email you transactional messages — magic links, password resets, account notifications. No marketing.

5. Cookies

We use a single first-party cookie to keep you signed in. No analytics cookies, no third-party trackers.

6. Your rights

You can export or delete your account and all associated project data at any time — email [email protected] and we'll handle it.

7. Changes

If we change how we handle data in a material way, we'll update this page and surface a notice in the app.

8. Contact

Questions? [email protected].