SpriteLight

Privacy

Last updated 27 September 2026

We don't store your sprites and we don't use cookies. Unless you create an account, we have no way to identify you — and if you do, the only thing we know is your email address. The rest of this page explains exactly what that means.

Your sprites

When you generate a normal map, the image is sent to our service in Norway, held in memory while it is processed, and the result is sent back to your browser. The file is never written to disk. We keep no copy of it.

Your sprites are never stored, never shared, and never used to train our models. We couldn't train on them if we wanted to — nothing is kept. Your art is your art; we compute a normal map from it and forget we ever saw it.

When you drop a sprite on the front page, or have to sign in before generating, your browser keeps it in its local storage so it can be carried over to Studio — also when the sign-in link opens a new tab. That copy never leaves your browser, and it is deleted the moment Studio picks it up.

What we count

We want to know how many people find SpriteLight, where they give up, and whether anyone comes back. We count that ourselves, with one line in our own log per event. Nothing is sent to an analytics company, and there are no cookies.

Before you sign in, we count that a page was viewed (which page, and the domain of the site that linked you here, such as reddit.com — never the full address), that a sprite was loaded in Studio (its width and height, never the image), whether generating was blocked (not signed in, not enough credits, or too large), and that you asked for a sign-in link (not the address you typed).

These lines carry a code instead of your address: a one-way hash of your network address and a secret only we hold. It cannot be turned back into your address and says nothing about who or where you are. It is stable over time, so we can see that a visitor came back — not who.

After you sign in, we count that the account was created, each map generated (model, image size, how long it took, and the credits it cost), each download (model and strength setting), opening checkout, and changes to a subscription (started, renewed, changed plan, cancelled, ended). These lines carry a different code, derived from your account. We can connect that code to your account when we have to — to answer a billing question or delete your data — but the lines themselves don't contain your email.

The two codes are never written on the same line. We can see how many visitors loaded a sprite and how many accounts were created, but not which visitor became which account.

The log is kept for 30 days and then deleted. We changed what we count on 26 September 2026 — before, we only counted generated maps and downloads. The reason is plain: with sign-in required, we need to know whether people give up at the sign-in step, and we can't find out without counting it.

If you create an account

Generating a map requires an account; browsing the site does not. An account exists so your credits — the free ones to start with, and any you subscribe to — belong to you. When you sign in we store your email address, your credit balance, and a record of what you bought and what you used, so we can show you the balance and answer questions about it.

There is no password. You sign in with a link or code we email you, or through Google or Apple; in that case we receive your email address from them and nothing else. We never see your Google or Apple password.

Your maps are still not tied to your account in any way that lets us see them: a generation deducts credits and writes the log line described under «What we count». We do not keep which sprite it was.

Cookies and local storage

No cookies, and no third-party tracking scripts. That is why you were never asked to accept anything. If you sign in, your browser keeps the sign-in token in its local storage so you stay signed in; signing out removes it. A sprite waiting to be carried over to Studio is kept there too, as described above.

Who else is involved

Microsoft Azure

Hosts both the website and the service, in the Norway East region, so your data stays within the EEA. Azure keeps ordinary server logs — times, addresses, status codes — as part of running the infrastructure.

Supabase

Handles sign-in. When you create an account, Supabase stores your email address. It is only involved if you sign in; anonymous use never touches it.

Resend

Delivers the sign-in emails, from servers in the EU. It receives your email address and the email itself — the sign-in link and code — and nothing else. It is only involved when you ask for a sign-in email.

Stripe

Handles payment. When you buy credits you are taken to Stripe's checkout page; your card details are entered there and never reach us. Stripe tells us that a purchase went through, and what was bought — that is all we receive.

That is the whole list. There is no analytics provider and no ad network, and the typefaces are served from this site rather than from Google, so nothing about you reaches a third party just because a page loaded.

If you email us

Write to hello@spritelight.com and we keep your message so we can reply to it. It isn't used for anything else, and it doesn't go on any list.

Your rights

Under the GDPR you can ask to see, correct, or delete personal data an organisation holds about you. If you have an account, email us from that address and we will send you what we hold (your email, balance and purchase history) or delete the account. Deleting it forfeits any credits left on it, so we will ask you to confirm first.

The visitor code in our logs cannot be traced back to a person from our side. If you want those entries deleted, email us your IP address and we can compute your code and remove them — that is the only way even we can find them. Entries tied to your account are found through the account itself; asking from your account's email address is enough. Either way, everything in the log is gone after 30 days.

Questions go to hello@spritelight.com.

Changes

SpriteLight is small and still moving. If we start collecting something new, this page changes first and the date at the top changes with it.