Privacy Policy

1. Who we are

SpritePals is an iOS app by Ivo van der Zee ("we"). We are the data controller for the personal data we process in the app, which means we decide why and how that data is processed. Third parties like Apple, Cloudflare, and OpenAI process data under their own policies for their services.

2. What data we process

• Photos you pick or capture (and the generated sprite images). Before upload, we run an on-device animal check; those results are not uploaded.
• App data and sync data (your characters, token balance, settings, and timestamps) stored on your device and, if enabled, in iCloud via CloudKit.
• Device identifier: a random device ID generated on first launch, used for support and consent logging.
• Consent logs: the policy version, consent status, app version, and timestamp. We store a local record on your device and send a record to our server for compliance logging.
• Diagnostics: crash logs and basic device/OS information, only if you have granted permission in iOS.

3. Legal basis and purpose

• Performance of the contract: to provide the app features, manage your SpritePals, and sync data.
• Consent: to upload a photo to OpenAI for sprite generation.
• Legal obligation: to keep a record of your consent.
• Legitimate interests: to keep the app secure and troubleshoot issues.

4. Sharing with third parties

• Cloudflare, Inc. (United States) runs our Worker proxy and relays requests to OpenAI. The Worker processes the image in memory and does not store it.
• OpenAI, LLC (United States) receives the photo over TLS to generate your sprite; OpenAI may temporarily retain it for abuse monitoring. See https://openai.com/policies/privacy-policy.
• Apple Inc. provides iCloud CloudKit for sync and StoreKit for purchases; see https://www.apple.com/legal/privacy.

5. International transfers

Some providers are based outside the EEA (notably the United States). Where applicable, we rely on appropriate safeguards offered by our providers, such as Standard Contractual Clauses, to protect your data.

6. Retention

• Photos: we do not store photos; they are forwarded to OpenAI. We cannot delete a photo after it has been sent, but you can contact us and we will submit a request to OpenAI where possible.
• App data and sprites: stored on your device and in iCloud until you delete them in the app or from iCloud.
• Consent logs: kept locally until you remove the app and stored on our server as long as needed to meet legal obligations.
• Diagnostics: retained according to Apple's crash reporting retention.

7. Your rights

You can request access, correction, deletion, restriction, objection, and data portability. You can withdraw consent at any time by not uploading photos or by removing the app. To exercise rights, email ivovanderzee@live.nl. You also have the right to lodge a complaint with your local data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

8. Children

SpritePals is not directed at children. If you are under the minimum age required in your country, please ask a parent or guardian before using the app.