Effective: 2026-05-09 Version: 1.0 (Wave 4 Ciclo 7 — Spriteoven) Operator: Fer Gonzalez Llanos, persona física, Ciudad Autónoma de Buenos Aires (CABA), República Argentina.
Spriteoven is operated as a personal project by an individual, not a corporation. This document describes — in plain language — what data Spriteoven collects, how it is stored, what it is used for, and what rights you have over it.
Spriteoven is a web tool that helps you generate, edit, and export pixel art sprite sheets using third-party AI providers. The service is operated by Fer Gonzalez Llanos as a sole individual based in CABA, Argentina. There is no parent company, holding entity, or external investors. References below to "we", "us", or "Spriteoven" refer to that single operator.
Contact: legal@spriteoven.com
We collect the minimum data required to make the product work.
When you sign up:
We do not ask for your real name, billing address, phone number, or government ID.
When you use the app:
getting-started.md.All of the above are stored in Supabase Postgres (database) and Supabase Storage (binary files). Access is enforced by Row-Level Security policies keyed on your user ID — you can only read or write your own rows. Spriteoven personnel (i.e. Fer) have administrative access to the underlying database for operational reasons (debugging, backups, restoring deleted data on user request).
Server logs include the timestamp, HTTP method, path, status code, response size, and the operator-issued user ID of authenticated requests. They do not include API keys, prompt content, asset binaries, or email addresses. Logs are retained for up to 30 days for debugging and rate-limit enforcement and then rotated.
We do not load Google Analytics, Meta Pixel, Mixpanel, Hotjar, or any other third-party analytics or session-replay script during Wave 4.
Spriteoven uses the minimum cookies required for the app to work:
There are no advertising cookies, no cross-site tracking cookies, and no consent-banner cookies because we do not load tracking scripts. If this changes in a future version we will publish an updated policy and add a consent UI.
We use Resend (resend.com) to deliver transactional email:
Resend processes your email address on our behalf as a sub-processor. Spriteoven does not run marketing email campaigns.
When you generate a sprite, your prompt and (optionally) your reference image are sent to the AI provider you selected:
Each provider has its own privacy policy, retention rules, and training-data policy. Spriteoven does not add prompts, images, or generations to any training corpus. We forward, we receive, we return.
Provider API keys live in server environment variables only —
Spriteoven holds the relationship with each provider on its account.
BYOK ("Bring Your Own Key") was retired 2026-05-19; see
docs/archive/byok-disclaimer.md for the historical policy.
spriteoven-prod, region
South America (São Paulo, sa-east-1).getting-started.md (oldest unpinned versions are pruned first).Spriteoven aligns voluntarily with Argentina's Ley de Protección de los Datos Personales 25.326 and, for users located in the EU/UK, the General Data Protection Regulation (GDPR).
You have the right to:
To exercise any of these rights, write to the contact address in §1. We aim to respond within 10 business days (Argentina LFP standard).
The Argentine supervisory authority is the Agencia de Acceso a la Información Pública (AAIP) — you may file a complaint there if we fail to respond in time.
Spriteoven is not directed to people under the age of 13. If you believe a minor has signed up, contact us and we will delete the account.
No system is perfectly secure. If you find a vulnerability, please report it to the contact email in §1.
If we make material changes we will publish an updated version at this URL and bump the version number. Non-material wording fixes (typos, clarifications) may be applied without a version bump.
For privacy questions, data-rights requests, or security reports: