SpriteForge

1. Introduction

Welcome to SpriteForge ("we," "our," or "us"). We respect your privacy and are committed to protecting the personal data we hold about you. This Privacy Policy explains how we collect, use, store, and safeguard your information when you access or use the SpriteForge application, website, and related services (collectively, the "Service").

Because our operations are based in the European Union (Estonia), we process your personal data in strict compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Estonian Personal Data Protection Act. By authenticating into or using SpriteForge, you acknowledge that you have read and understood the practices described in this Privacy Policy.

2. Data Controller & Contact Information

For the purposes of the GDPR and applicable data protection laws, the Data Controller responsible for the collection, processing, and protection of your personal data is:

If you have any questions, concerns, or requests regarding how your data is handled, you may reach out directly to the Data Controller using the contact details above.

3. Categories of Data We Collect and Store

We adhere to the principle of data minimization and only collect data that is necessary to deliver, maintain, and improve the SpriteForge experience. When you connect your account and use our Service, we collect and store the following specific categories of data:

• Player ID: We store the unique account identifier assigned to your profile upon authentication. This identifier is required to recognize your account across sessions, link your game data, and maintain your in-app state without requiring us to store your login credentials or passwords.
• Player Public Statistics: We retrieve and store your publicly available gameplay statistics (such as match performance, wins, scores, and general progression metrics) to display your profile metrics and power core features within SpriteForge.
• Player Friends List: With your authorization during sign-in, we retrieve and store your account's friends list so that we can enable social functionality, allow you to view or compare progression with friends, and connect you with people you know inside the Service.
• Player Provided Sprite Progression: We store all custom sprite data, configurations, unlocks, and progression milestones that you generate, submit, or achieve while interacting with SpriteForge so that your progress is saved and synchronized across sessions.
• Session Recordings (Random) for UX Research: To better understand how players interact with our interface, we randomly sample and record anonymized or pseudonymized user sessions. These recordings capture in-app navigation, clicks, and interaction flows strictly for user experience (UX) research, diagnosing technical bugs, and improving interface design.

We do not intentionally collect sensitive personal data (such as financial payment details, government identifiers, health data, or biometric information).

4. Technologies & Third-Party Services Used

To provide seamless authentication, gameplay data synchronization, and backend functionality, SpriteForge relies on the following technologies and infrastructure:

• EPIC AUTH (Epic Games Account Services): We use Epic Auth to securely authenticate your identity when you sign in to SpriteForge. Your login credentials are entered directly on Epic Games' secure interface and are never visible to or stored by us. Epic Auth provides us with a secure authentication token and your Player ID.
• EPIC API: Once authenticated, our Service communicates with the official Epic API to fetch authorized account information, specifically your Player ID, Player Public Statistics, and Player Friends List, in accordance with the permissions you grant during the login flow.
• SPRITEFORGE.DEVVU.IO: This is our dedicated backend infrastructure. All data collected by the Service—including your Player ID, statistics, friends list, sprite progression, and randomly sampled UX session recordings—is transmitted securely over encrypted connections (HTTPS/TLS) to spriteforge.devvu.io for processing and storage.

Please note that your use of Epic Games' authentication and services is also subject to the Epic Games Privacy Policy.

5. How and Why We Use Your Data (Legal Basis)

Under the GDPR, we must have a valid legal basis to process your personal data. We process your information for the following purposes and corresponding legal bases:

• Performance of a Contract / Provision of Service (GDPR Art. 6(1)(b)): Processing your Player ID, Player Public Statistics, Player Friends List, and Player Provided Sprite Progression is strictly necessary to provide you with the core features of SpriteForge, authenticate your sessions, save your sprite progression, and display social and statistical features you request.
• Legitimate Interests (GDPR Art. 6(1)(f)): Processing randomly sampled Session Recordings for UX Research is carried out under our legitimate interest in maintaining service stability, identifying usability bottlenecks, fixing software bugs, and improving the overall quality of the user interface.
• Consent (GDPR Art. 6(1)(a)): Where required by platform rules or applicable law (such as authorizing Epic Auth permissions to share your friends list with SpriteForge), we process your data based on the explicit consent you grant during authentication. You may revoke this authorization at any time through your Epic Games account settings or by contacting us.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for marketing or advertising purposes. Your data is only accessible to:

• The Data Controller (Taavi Suikkanen): For system administration, database maintenance, customer support, and UX evaluation.
• Essential Infrastructure Providers: Hosting and server providers that power spriteforge.devvu.io under strict confidentiality and data processing agreements.
• Legal Authorities: If required to do so by Estonian or European Union law, or in response to valid legal requests by public authorities.

7. Data Retention Period

We retain your personal data only for as long as you actively use SpriteForge and for a limited period thereafter to allow you to return without losing your progress.

Specifically, all stored data—including your Player ID, Player Public Statistics, Player Friends List, Player Provided Sprite Progression, and any associated UX Session Recordings—is stored for a maximum period of 6 months from your last usage of the Service.

If your account remains completely inactive and does not authenticate or communicate with spriteforge.devvu.io for 6 consecutive months, all data associated with your Player ID is automatically and permanently deleted from our databases. You may also request immediate deletion prior to the 6-month mark at any time.

8. Data Security

We implement appropriate technical and organizational security measures to protect your stored data against unauthorized access, alteration, disclosure, or destruction. All communication between the SpriteForge client, Epic APIs, and spriteforge.devvu.io is encrypted in transit using industry-standard TLS/SSL protocols, and access to backend databases is strictly restricted to the Data Controller.

9. Your Rights Under GDPR

As a user whose data is processed in the European Union, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You have the right to request confirmation of whether we process your data and to receive a copy of the data stored about you.
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): You have the right to request the immediate deletion of your Player ID, sprite progression, statistics, friends list data, and session recordings from our servers prior to the standard 6-month expiration period.
• Right to Restriction of Processing (Art. 18): You have the right to request that we temporarily or permanently restrict the processing of some or all of your data.
• Right to Data Portability (Art. 20): You have the right to request a copy of your provided data (such as your sprite progression) in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You have the right to object to the processing of your data where we rely on legitimate interests, including opting out of random UX session recordings.

To exercise any of these rights, please send an email to spriteforge@devvu.io with your Player ID. We will respond to and fulfill all valid requests within 30 days in accordance with GDPR requirements.

If you believe our processing of your personal data infringes data protection laws, you also have the right to lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon,