Privacy Policy
Updated 18 September 2026
This policy covers Spritely, sprites.codes and the dedicated Spritely Support service. Dion M. and Evan S. operate the service. Contact us through a private ticket in Spritely Support for privacy questions, access, correction or deletion requests.
Information processed
- Discord identity and collections: Discord user ID, display name, avatar reference, trading note, indexed and mastered sprite forms and timestamps, wanted forms, collection changes and relevant restrictions. Collections are shared across the servers where you use Spritely.
- Server setup: server IDs, names, owner IDs and observed ownership history, approximate membership, bot installation/setup state, selected channels and roles, and configuration changes.
- Operational records: command names, timestamps, user and channel IDs, recorded outcomes, errors, audit events and processing status. These records do not capture every interaction.
- Support: ticket contents, participants, attachments and evidence, transcripts, claims, escalations, moderation cases and staff actions. Support messages may remain in a transcript after the original message is edited or deleted. Support-server security features also process messages, links, joins and relevant Discord audit events.
- Optional bulk indexing: where available in Spritedex, submitted tables or screenshots, processing results and job history may be retained to complete and review the request. Screenshots submitted for automated reading may be sent to the configured AI processing providers (currently DeepSeek and MiniMax); this is not used for ordinary /index entries.
- Website operation: essential sign-in/session records and technical request/error logs. The web server may process IP addresses and browser/request information for delivery, troubleshooting and security. Do not interpret Discord sign-in as anonymity from hosting logs.
Server investigations
For a valid service-related investigation, authorised operators may inspect the bot’s accessible server configuration and activity and, where its Discord permissions permit, create an invite and join the server. Relevant investigation evidence may be retained with support or security records. We do not bypass channel permissions, and staff visits must have a valid reason such as abuse, security, a terms breach or a reported technical issue. See the prominent investigation section in the Terms of Service.
Why we use it
We use this information to provide collections and server features, authenticate users, answer support requests, investigate abuse, correct mistakes, secure the service and recover from failures. We do not sell personal information or use it for advertising.
Discord sign-in and cookies
Member sign-in requests Discord’s identify permission, not your email or password. The OAuth access token retrieves your profile and is not saved by the member website. A secure HTTP-only cookie keeps you signed in for up to seven days; signing out revokes that session. A separate sign-in protection cookie expires after ten minutes. Administrators have separate authenticated sessions. These are essential cookies.
Optional website analytics
On public pages, you can allow or decline first-party analytics using the analytics controls at the bottom of the page. Analytics remain off until you allow them; the website works without them. Your preference is saved in your browser until you change it or clear site data. Do Not Track and Global Privacy Control disable analytics. After you opt in, a random browser-tab session identifier is stored in session storage and hashed on the server to count sessions. We record public page paths, referring website domains, broad device category, approximate country, clicks on bot-invite and sign-in/collection links, and active viewing seconds while the page is visible and recently used. We do not record admin pages, private collections, form contents, URL query strings, raw user-agent strings, Discord identity or IP addresses in the analytics database. An IP address is used transiently for a local country lookup and abuse limiting; it is not sent to a geolocation API. IP Geolocation by DB-IP provides the approximate country database. Hosting security logs remain separate.
Analytics are available only to Dion and Evan in the existing admin area and are retained for up to 90 days. You can withdraw consent using the same controls; this stops future analytics but does not automatically remove earlier records, which cannot be linked to your Discord identity. Analytics are not used for advertising or cross-site profiling. Counts omit visitors who decline, block scripts or request privacy and therefore do not represent every visitor. Active viewing time and country are estimates.
Who can see information
- People who can see a Discord channel can see collection cards or notes posted there. Public boards may show opted-in profiles and progress;
/privacy show:Falsehides your public-board entry. This does not delete your records or withdraw cards already posted. - You can sign in to view your own collection. Server ownership does not grant access to everyone’s private collection records.
- Authorised operators can access administration records. In the support server, Support, Management and Ownership Team can handle tickets and run a private diagnostic for the ticket opener. Member diagnostics include collection records, history, restrictions and servers where live checks confirm membership alongside Spritely. Server diagnostics verify the opener’s ownership before retrieving configuration, bot permissions and recorded command activity.
- Diagnostic lookups are audited. Results are private Discord responses to staff but may include downloadable reports. Staff must treat these exports as support records and not redistribute them unnecessarily.
- Discord processes bot interactions, sign-in, messages and attachments under its Privacy Policy. Hosting and any enabled processing providers handle data needed to deliver their services. Spritely does not request your Epic Games password or read your Fortnite account.
Retention and backups
Active collection records are retained to provide the service until removed or no longer needed. When a guest server removes the bot, server-scoped data is held live for seven days, archived for restoration until thirty days after removal, and then purged by the retention scheduler. Global collections, server bans, essential installation and recorded ownership history, and security/admin audit records are separate from that server-data cleanup. Support tickets, evidence, moderation and diagnostic audit records currently have no automatic expiry; staff review removal requests, with relevant security or dispute evidence retained where necessary. Downloaded staff reports and Discord-hosted messages require separate handling from database deletion.
Database backups are scheduled daily and the newest fourteen snapshots are retained. Deleted records can remain in those snapshots until they rotate out; fourteen snapshots is not a guaranteed fourteen-day period during an outage. Backups are kept on the same host and do not provide protection against loss of that host. A recovery must account for prior deletion requests.
Your choices and requests
Use a private support ticket to request a copy, correction or deletion of your information, or to ask about an objection or restriction. We verify identity before disclosing or deleting records and explain any records we need to retain. Hiding your public profile, leaving a server or removing the bot does not automatically delete your global collection or support history. Applicable data-protection rights remain available, including contacting your relevant supervisory authority.
Security and changes
Controls include restricted staff permissions, ownership checks, read-only support diagnostics, abuse limits and service monitoring. No service can promise absolute security. The date above shows the latest policy update; material changes will be announced in the support server.