SpritePals Back to home
Privacy statement

SpritePals Privacy Policy

Version: 1.7 Last updated: 9 October 2026 Online version: https://spritepals.app/privacy-policy

1. Who we are

SpritePals is an iOS app by Ivo van der Zee ("we"). We are the data controller for the personal data we process in the app, which means we decide why and how that data is processed. Third parties like Apple, Cloudflare, OpenAI, and Telegram process data under their own policies for their services.

2. What data we process

  • Photos you pick or capture (and the generated sprite images).
    • Before upload, we run an on-device animal check; those results are not uploaded.
    • To support retries / restoring an in-progress flow, the app may temporarily store the selected source photo in its Application Support directory, excluded from backups and protected with complete file protection. It removes the photo when the flow completes or is cleared.
    • You should only upload photos you have the right to use and avoid sensitive or unlawful content.
  • Generated sprite images: we use these to provide app features such as displaying your SpritePal, animations, and optional widgets / Live Activities (if enabled).
  • App data and sync data stored on your device, including your characters, world layout and placed world items, World Points balance and reward/spending ledger, generation-token balance and purchase/spending journal (including StoreKit purchase transaction identifiers), Pro bonus entitlement status, optional associated StoreKit transaction identifier, and character-related timestamps. When iCloud is enabled in your device settings, synced data is stored in iCloud through Apple’s iCloud services (CloudKit and iCloud key-value storage). Settings are not synced through iCloud.
  • Apple Watch companion: if you use the Apple Watch app, your SpritePals (names, images, stats and levels), which pals you have selected, whether you have Pro, your generation-token and World Points balances, the layout of your World (its tiles and placed items) with compact movement-path data for your pals, your app language setting, and your device ID are sent locally to your paired Watch using Apple's WatchConnectivity. Your Watch sends back to your iPhone the pal selections you make on it, requests for up-to-date data (listing the pal artwork and World version it already has), and purchase/restore signals, including the StoreKit transaction identifier of a purchase made on the Watch. The Watch app itself does not connect to our server, OpenAI, or iCloud.
  • App icon exports that you choose to save to your photo library.
  • Device identifier: a random device ID generated on first launch, used for support, security (App Attest), and consent logging.
  • App Attest / security data: cryptographic assertions and related identifiers used to help protect the service against abuse.
  • Consent logs: the policy version, consent status, app version, and timestamp. We store a local record on your device and, on devices that support App Attest, queue an authenticated server record for compliance logging (with automatic retry if delivery fails). On devices that do not support App Attest, the consent record remains local only.
  • Purchase notifications: when you make a purchase in the app or a purchase is refunded, Apple sends our purchase notification service a signed notification with the transaction details (such as the product, price, currency, purchase date, storefront, and Apple’s transaction identifiers). The service verifies the notification and forwards only a short sales message to our private Telegram chat: the type of event, the product, the price and currency, and whether it was a test (sandbox) or real purchase. It does not forward transaction identifiers, and these notifications do not contain your name, email address, or Apple Account.
  • Network/technical data processed by providers: IP address and request metadata (e.g., for security and reliability).
  • Diagnostics (optional): Apple may provide us with aggregated crash and diagnostic information (such as crash reports and basic device/OS details) through App Store Connect, depending on your iOS settings (e.g., “Share with App Developers”). We do not run a separate third-party crash reporting SDK in the app.

3. Legal basis and purpose

  • Performance of the contract: to provide the app features, manage your SpritePals, and sync data.
  • Consent: to upload a photo to OpenAI for sprite generation.
  • Legal obligation: to keep a record of your consent.
  • Legitimate interests: to keep the app secure, troubleshoot issues, and keep track of purchases and refunds.

4. Sharing with third parties

  • Cloudflare, Inc. (United States) runs our Worker proxy, which relays requests to OpenAI, and our purchase notification service. Our proxy is designed to process the image in transit and not intentionally store it, but Cloudflare may process and log limited technical data (e.g., IP address, timestamps) to operate and secure these services.
  • OpenAI, LLC (United States) receives the photo over TLS to generate your sprite; OpenAI may retain data for safety/abuse monitoring under their policies. See https://openai.com/policies/privacy-policy.
  • Apple Inc. provides iCloud services (CloudKit and iCloud key-value storage) for sync, Photo Library access for user-requested exports, and StoreKit for purchases; see https://www.apple.com/legal/privacy.
  • Telegram Messenger Inc. delivers the sales messages from our purchase notification service to our private Telegram chat; see https://telegram.org/privacy.

5. International transfers

Some providers are based outside the EEA (notably the United States). Where applicable, we rely on appropriate safeguards offered by our providers, such as Standard Contractual Clauses, to protect your data.

6. Retention

  • Photos: the app may temporarily store a copy of the selected source photo in its Application Support directory during an in-progress generation flow (to support retries / restore). The copy is excluded from backups, protected with complete file protection, and cleared when the flow completes or is cleared.

    We do not store your photos on our own servers; they are forwarded to OpenAI via our proxy for generation. We cannot delete a photo after it has been sent to OpenAI, but you can contact us and we will submit a request to OpenAI where possible.

  • App data, purchase metadata, and sprites: stored on your device and in iCloud until you delete them in the app or from iCloud.
  • App icon exports: if you save an exported icon preview to Photos, that copy remains in your photo library until you delete it.
  • App Attest / security data: server-side key records are kept only as long as needed to validate legitimate app requests and expire after a period of inactivity.
  • Consent logs: kept locally until you remove the app and stored on our server as long as needed to meet legal obligations.
  • Purchase notifications: our purchase notification service does not store Apple’s notifications; the sales messages remain in our private Telegram chat until we delete them.
  • Diagnostics (optional): retained according to Apple’s crash reporting retention, where applicable.

7. Your rights

You can request access, correction, deletion, restriction, objection, and data portability for data we control. Most data is stored on your device and in iCloud; you can delete it in the app or via iCloud settings. For our server-side consent logs, email support@spritepals.app and include your Device ID (shown in the settings of the app); we may ask for additional information to verify your request. For data controlled by Apple, Cloudflare, OpenAI, or Telegram under their own policies, you may also contact them directly. We can help forward requests where applicable, but we cannot guarantee outcomes for data we do not control. You have the right to lodge a complaint with your local supervisory authority.

8. Children

SpritePals is not directed at children. If you are under the minimum age required in your country, please ask a parent or guardian before using the app.

9. Contact

Questions about privacy or your rights? Email support@spritepals.app.

We update this statement whenever features or processors change by updating the Version and Last updated fields above. For significant updates we will ask for your consent again.