Sprite Catch

Privacy Policy

Last updated: 2 November 2026 · Effective: 2 November 2026

Sprite Catch is an app for tracking, trading and talking about Fortnite Sprites. This policy explains what information we collect, how we use it, who can see it, and the choices you have. It covers the iPhone and Android apps, the web version at spritecatch.com, our websites and our Discord bot.

1. What this policy covers

Sprite Catch is made and operated by Mateo Duran, an individual developer based in Uruguay, who is the data controller for the purposes of the GDPR and similar laws. In this policy, "Sprite Catch", "we" and "us" mean him and the people who work with him on the service.

This policy applies to the Sprite Catch apps, the web version at spritecatch.com, the public pages on spritecatch.com and app.spritecatch.com, our Discord bot, and any other product or feature that links to it. Together, these are "the service".

New features. Sprite Catch changes often. A new feature, app or version of the service is covered by this policy unless we say otherwise when it launches. If something new needs a kind of information this policy does not describe, or a new permission on your device, we will tell you in the app or in this policy.

Privacy questions, access requests and deletion requests: privacy@spritecatch.com

2. What information we collect

What we collect depends on how you use Sprite Catch. Someone who only tracks a collection as a guest gives us very little; someone who signs in, posts, trades and sends messages gives us more. The lists below describe the kinds of information involved, with examples. Signing in is optional for the collection tracker and required for community features such as posting, trading and messaging.

Information you give us

• Account information, such as your username, your display name, the email address you sign in with, and a password if you set one. A password is stored only in a scrambled, one-way form that cannot be turned back into the password.
• Your collection and lists, such as the Sprites you mark as owned or mastered, their levels and when you marked them, and the lists you keep in the app, such as your locker, wishlist, loadouts and quests.
• Your profile, such as the character you design, the decorations, flag and badge you choose, your Fortnite tag, your description, and the language you read in.
• What you post, send and make, such as posts, replies, photos, videos and their sound, notes, polls, reactions, votes, trade listings, trade offers, ratings and reviews, and direct messages, including photos and voice messages. This includes the groups and communities you start or join, and how you take part in them.
• What you tell us, such as support messages, reports, appeals, questionnaire answers, screenshots you send to claim a reward, and feedback.
• Your age. The apps ask how old you are, or receive an age range from Apple or Google Play. We keep the age you give, and whether you are under 13 and whether you are 18 or over. We do not ask for your date of birth. If we have good reason to believe the age on an account is wrong, we may correct it.
• Purchases. Sprite Catch Plus is an optional subscription coming to the iPhone app, sold by Apple through the App Store. If you buy it, or anything else we offer in future, the company that sells or processes it tells us what we need to provide it, such as what was bought, when, the price, currency and store country, whether it renews, and any refund. Your payment details, such as your card number, stay with that company. We also keep a record of what you redeem with the benefits that come with a subscription.
• Sign-ups. If you give us an email address to hear about something, such as the box on our website for the Android launch, we use it for that and delete it afterwards. Please only do this if you are 13 or older.

Information we collect automatically

• Identifiers, such as a random device identifier the app creates, a random account ID, and the notification token your phone's platform issues if you turn notifications on. These are not advertising identifiers. On iPhone, the device identifier stays on the phone even if you delete the app.
• Device and connection information, such as your network (IP) address, your app version, your device's language, how far your clock is from UTC, whether you use the iPhone app, the Android app or the web version, and when you were last active.
• Location information. We work out the country your requests come from, using your network address. Today the app does not ask for your device's location.
• Usage information, such as which screens are opened, which features are used, where a flow is abandoned and whether a scan worked. On the apps it records actions, not content: it does not include what you write or who you message, it is filed under a scrambled stand-in for your account that means nothing outside Sprite Catch, and you can switch it off in Settings → Privacy & Safety → Share Usage Data. Our websites count visits in a similar way, without an account.
• How you use community features, such as the posts you open, vote on, react to or reply to, who you follow, block or report, and who invited you.
• Cookies and similar technologies. Our websites can store information in your browser, for example to keep you signed in. The Cookies page lists what is used.

Information from other people and companies

• Companies you sign in with. Apple and Google send us an identifier for your account and, usually, your email address. Apple lets you hide your address behind a relay.
• Apple and Google Play can also tell us your age range, and the records of a purchase.
• Epic Games. If you sign in with Epic to confirm your Fortnite name, Epic gives us your account identifier and display name. You type your password on Epic's own website. Epic's sign-in tells us who you are, not what you own: we cannot see your locker, V-Bucks or purchases through it. The confirmed name stays on your profile after you unlink, until you change it.
• Discord. If you link your account or use our bot, we receive your Discord identifier and username, and information such as which servers you used the bot in and your membership and roles in the Sprite Catch community server. The bot can track a collection without a Sprite Catch account. Typing /spritecatch privacy shows what the bot holds and lets you hide or delete it.
• Other collectors, who may give us information about you through reports, ratings and reviews, scam marks, tags and the messages they send.
• Other services you choose to use with Sprite Catch, such as a site you import a locker from.

3. What stays on your device

Some of what the app does happens on your device and does not reach us. For example:

• The scanners. Recognition happens on your phone. Apart from accounts run by our own team, the photos and screenshots you scan are not uploaded or saved. The Sprites scanner sends only the result. A locker scan also shares small cut-outs of each tile, what the scanner read from them and your corrections, to help improve the scanner, unless you turn that off on the review sheet or in Settings → Privacy & Safety. This never happens on an account under 13.
• Parental Controls and Safe Mode, which are stored on the device they were set on (section 11).
• Your iPhone's Sensitive Content Warning. If it is on, your iPhone can cover a photo before you see it. That check runs on your device, and we are not told about it.
• Things the app keeps so it works quickly, such as message drafts, your activity list, recent searches, and copies of the conversations, photos and voice messages you have received. They stay until you clear them, sign out or remove the app. Settings → General → Storage shows what is saved on that phone and can delete it.
• Device features you choose to use, such as Siri, Shortcuts and on-device AI features. Where a feature can use Apple's Private Cloud Compute, it is off until you turn it on.
• The web version, until you sign in. Sprites you tick off are saved in your browser and not sent to us, so clearing your browser data deletes them for good. Once you sign in, your collection syncs to your account, and your browser keeps things such as your sign-in token, your profile, your collection, conversations you have read and message drafts. The Cookies page lists them.

Device permissions. The app asks before using things like your camera, microphone, photos or notifications, and any other permission a feature needs, now or in future. We use what a permission gives us for the feature that asked for it, as the request describes. You can refuse or withdraw a permission in your device's settings, and the rest of the app keeps working.

4. What is public and what is private

Your profile

A new profile is public by default. Public means anyone can see it, including people who never signed in, in the apps, in the web version and at your profile's web address, spritecatch.com/u/<your username>. Treat a public profile as public to the whole internet. It shows things such as your names, Fortnite tag, character and decorations, your collection and its levels, your trade listings, posts, replies and reactions, who you follow and who follows you, and your trade reputation, including reviews and any scam warning. Other collectors can search for you, and the app can show you in places such as Discover, trade matches, "who has this" lists and leaderboards.

Going private in Settings hides your collection, your description, your written reviews, the list of posts on your profile and your follower lists, and takes you out of search, Discover, trade matching and the leaderboards. It does not hide who you are. A private profile still shows details such as your name and username, your character and decorations, your Fortnite tag, how long you have been here and your trading record, including any scam warning, along with counts such as how many Sprites you have and how many people follow you, and its web page can still be opened by anyone with the link. Posts you have already published can stay visible until you delete them. Posting a trade, a post or a reply makes a private profile public again. Accounts under 13 have extra protections (section 11).

Other things people can see. Depending on your settings, collectors may also see things such as your recent catches, when you were last active, when you are typing, your local time in a conversation, and a trade offer you send, shown to collectors who could take it. Settings → Privacy & Safety has the switches for these.

Anything public can be copied. Other people can screenshot, share or quote what you post. It may appear in search engines or on other services, and it can outlast your deleting it. Please do not put anything in a name, note, post or message that you would not want a stranger to read.

Posts and communities

Posts, replies, trade listings and the photos and videos on them are public and can be read without an account, unless they are in a community that limits who can see them. Anyone can start a community, and by default anyone can find one and walk in. The people who run a community can moderate it: for example, they can remove posts and messages, quieten or remove members, pin content, and see reports and a record of the actions taken there.

A post in a community that is unlisted, invite-only or for adults is shown to its members and to you, and may also be seen by the people who moderate or review content across the service.

Messages and groups

Direct messages are private from other users, not from us. No other collector can read a conversation they are not in. But we run the servers, messages are not end-to-end encrypted, and we can access what is stored, including messages, photos and voice messages. We, and the automated tools and AI assistant described below, may read them where we need to, for example to investigate a report, deal with abuse or a safety problem, answer a support request or fix a bug. Messages are also screened automatically.

• Unsending and deleting hide things; they do not erase them straight away. Unsending a message removes it from the conversation but can keep it on our servers. Deleting a conversation ends your copy, and the other person keeps theirs. Section 9 says for how long.
• Groups. Anything you send to a group goes to everyone in it. People in a group can add others, who see it from that moment on.
• Community rooms keep their past messages. What you say in a community room can be read by anyone in that community, including people who join later, and people in the community can look into a room before joining it. A community can choose rooms that newcomers start in.
• Notifications carry the message. If the person you write to has notifications on, your message passes through Apple's or Google's notification service on its way to their device.

Support

Support conversations are not published. They are read by us and by the people and tools who help us answer them, including automatic replies and the AI assistant described below. Replies written automatically on a support ticket are labelled. If somebody keeps writing about something we have already answered, we may set their tickets aside for a time. A message sent through Support in the app may be handled without a person reading it. Email to support@spritecatch.com always reaches a person, so write there about anything you need a person to see, such as a safety concern or an appeal.

Keeping the community safe

Because people can post, trade and message, Sprite Catch has to be moderated.

• People review content. That includes us, trusted collectors who moderate the feed, people who review videos, who must be adults, and the people who run each community. We may read anything stored on the service where a report, a safety concern or our Terms call for it, including private messages and photos, whether or not that was the thing reported. A video from a newer account may wait for a person to approve it.
• Automated tools review content. What you post or send can be screened on your device and on our servers, before or after it appears, for things such as banned words, scams, spam, explicit pictures and risks to children. The app can also warn you about what you are writing or receiving.
• An AI assistant works through our queues. Claude, made by Anthropic, helps us with support, reward claims and safety on a schedule. It can read support tickets, claim screenshots and conversations our safety measures have singled out, and it can note what a photo in one of those conversations appears to show, such as whether there is a real person in it and roughly how old they look. It can answer tickets, give rewards and take down reviews or marks, and it can restrict accounts as described in section 8. We keep a record of what it opens and does.
• We do not use facial recognition to identify people.

What can happen. We can remove content, reset a collection or reputation, and warn, suspend or delete accounts. We can also hold back an account's posts, messages or photos so that they reach nobody else while still appearing as sent to the author, stop keeping an account's pictures and delete the ones it has already sent, and pause its ability to file reports. A post can also be held back to protect the person who wrote it, for example if it gives out personal details. Several reports from collectors in good standing can put a scam warning on an account automatically. Some restrictions are applied automatically, and some of those are permanent, especially to protect children (section 8).

What you are told. Restrictions on your posts, messages or photos are shown on the Account Standing screen in Settings, with a notification. A pause on filing reports is not shown or announced, and a scam warning is not shown to the account it is on, though everyone else can see it, including on the public web page. A post held back to protect its writer is not listed there either. If you think one of these applies to you, email support@spritecatch.com and a person will look into it.

Starting over. A warning or restriction can follow a person to a new account, as section 9 explains.

5. How we use information

We use the information in section 2:

• To provide the service, such as storing and syncing your collection, running profiles, trades, posts, messages, communities, games, guides and rewards, and providing subscriptions and anything else you buy.
• To connect collectors, such as search, Discover, trade matching, suggestions, leaderboards and showing people posts in their language.
• To personalise and order what you see, such as ordering feeds by things like how new a post is, its votes, replies and content, and suggesting posts, people, communities and trades. In the Communities feed this includes the interests we work out from what you read and do there. Switch Personalize Communities off and that stops, and what was learned is deleted.
• To keep people and the service safe, such as screening content, handling reports and blocks, reviewing videos, preventing scams, fraud and abuse, enforcing our Terms, applying age-appropriate protections, and stopping someone who has been restricted from starting over.
• To support you, such as answering support requests and appeals and checking reward claims, including by comparing pictures to spot duplicates.
• To understand and improve the service, such as seeing which features are used and where people get stuck, fixing bugs, testing changes, measuring how far posts reach, and deciding which countries and languages to support.
• To research and build new features, such as new trading, matching and recommendation tools, better scanners, and features that translate, summarise, draft or answer questions. This can include training and testing our own models and automated systems on things such as public content and how the service is used.
• To communicate with you, such as notifications, in-app announcements, and messages about your account, security or a support request. We send news and promotional email only if you turn that on in Settings → Privacy & Safety, and you can turn it off at any time.
• To run rewards, giveaways, events and programmes you take part in, including giving you what you earned and, if a programme pays you, collecting the details we need to do that.
• To show sponsored cards in the Trading feed, as described below.
• To meet legal obligations and protect our rights and those of our users and the public.
• For other purposes we tell you about when we collect the information, or that are compatible with the ones above.

We may also create aggregated or de-identified information, which no longer identifies you, and use it for any of these purposes or share it, for example as statistics about the Sprites people collect.

Automated systems and AI. We use automated systems, including machine learning and AI from us and from our providers, for things such as screening content, working through support and safety queues, ordering feeds, making suggestions and matches, and helping you use the app. Section 8 explains what happens when one of these makes a significant decision about you.

Sponsored cards. The Trading feed may show cards paid for by a game, an app or a creator, each marked Ad. Today every reader gets the same cards: the only thing about you we use is your age, to keep them away from accounts under 13, and advertisers are told totals, not who you are. If we change how ads work, this policy will say so first, and we will ask for any permission the law or your device requires.

The iOS tracking question. iOS may ask whether Sprite Catch can track you. Today nothing in the app tracks you across other companies' apps and websites, and nothing reads your answer. If that changes, this policy will say so first.

6. Who we share information with

We do not sell your personal information. We share it in these ways:

• Other collectors and the public. What is public can be seen by anyone, as section 4 explains.
• People who help run the service, such as moderators, reviewers, the people who run communities and those who work with us, to the extent their role needs it.
• Service providers, who handle information for us and must protect it to the standard this policy describes. Today they include Cloudflare, for hosting, databases, storage, delivery, email, analytics and automated safety tools on its global network; Anthropic, whose AI assistant Claude helps with support and safety, as section 4 describes; and Google Cloud Vision, which checks pictures shown publicly, such as photos on posts, the poster frames of videos, and pictures on communities and groups, for explicit content. We may change these or add others for similar jobs, such as AI, analytics, crash reporting, translation, customer support, payments or ad measurement, and we will keep this list up to date.
• Apple and Google, which are independent companies with their own privacy policies. They handle sign-in if you use it, deliver notifications, which can include the text of a direct message, and provide age ranges and store ratings. Apple will sell Sprite Catch Plus, take the payment and receive your account ID with the purchase. Google's own software runs inside the Android app for features such as sign-in and notifications.
• Discord, if you use the bot or link an account. Discord is told what is needed to answer you. Roles such as Verified Collector, trader and season roles are visible to everyone in the server, and in the Sprite Catch community server a private profile is given no trader or season role. Commands can post a picture of a collection or trading record in a channel, carrying your display name, and Discord keeps those under its own rules. Anyone can do this with a public profile, not only its owner. What is said in a Discord trade room stays on Discord, and our blocking and reporting tools do not reach it. Holding a staff role in the community server can put a badge on your profile, list your public profile on our Thanks page, and mean automated safety tools refer you to a person instead of acting on their own.
• Other companies you choose to deal with. Signing in with Epic tells Epic you did. A link to YouTube, a sponsored card or another site takes you there, and that company's policy applies from then on.
• Advertisers and partners, who may receive totals and statistics, such as how many times a card was shown, tapped and reported.
• For legal and safety reasons. We may share information where we believe the law requires it, or where it is needed to protect people, investigate abuse, or enforce our Terms. Apparent child sexual abuse material is reported to the National Center for Missing & Exploited Children, as United States law requires. A report carries what the law asks for, such as the material, the accounts and messages around it, sign-in details, timestamps and network addresses. It may be passed to law enforcement, and the person it concerns is not told.
• For copyright complaints. A complaint is forwarded to the collector it names, with the complainant's name and contact details. A dispute must carry that collector's real name, address and phone number, and is forwarded to the complainant. Our Terms set out the procedure.
• If the business changes. If Sprite Catch becomes part of a company, or is sold, merged, financed or reorganised, your information may be transferred as part of that. This policy keeps applying until we tell you otherwise.
• When you ask us to, for example when you link an account or share a link or a picture.

7. Where information is processed

We are based in Uruguay, and our providers operate around the world, so your information may be processed outside your country, including in the United States. Where information from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on a recognised safeguard, such as an adequacy decision or the European Commission's Standard Contractual Clauses. You can ask us for a copy.

8. Legal bases (GDPR)

• Contract, to give you what you asked for, such as storing and syncing your collection and providing a subscription or purchase.
• Consent, for optional things, such as signing in, adding information to your profile, posting, trading and messaging, notifications and other device permissions, linking another account, answering a questionnaire and marketing email. You can withdraw it by removing the information, turning the feature off, disconnecting the link or deleting your account.
• Legitimate interests, to keep people and the service safe and secure, stop restricted accounts from starting over, report and preserve child-safety material, answer support requests, understand and improve the service, develop new features, personalise feeds, measure reach, run sponsored cards and keep a record that you accepted our Terms and this policy, or were told about a change to it. You can object at any time, including by switching off Share Usage Data or Personalize Communities.
• Legal obligation, where a law that applies to us requires us to disclose or keep information.
• Vital interests, where it is needed to protect someone's life or physical safety.

Automated decisions. Most automated checks do not decide anything significant by themselves. Some do. Fixed rules can put a scam warning on an account based on reports from other collectors, pause an account's messages for a short time when it asks several people for pictures of themselves, and pause its ability to file reports when what it files does not look like real reports. Our AI assistant can restrict an account, in some cases permanently and without a person deciding first, on messaging, posting, sending photos or filing reports. It does this where it finds things such as somebody sending a stranger a picture of themselves, grooming, requests for pictures of somebody's body, sexual messages or pictures, or an account posing as different people to reach children. A picture in a direct conversation that looks like it shows a child can stop both people sending photos, whichever of them sent it. These decisions rest on rules we wrote, and on what the conversation, the pictures, the people's apparent ages and an account's trading record show. To have a person review one, email support@spritecatch.com, and we will lift it if it was wrong.

9. How long information is kept

We keep information for as long as we need it for the purposes in this policy. How long that is depends on what the information is and why we have it, whether you can delete it yourself, whether the law requires us to keep it, and whether we need it to keep people safe, review a decision or settle a dispute. As a guide:

• Your account, profile, collection, lists, settings, rewards and purchases: while your account exists. A guest account left unused for a long time may be deleted, and an account under 13 left unused for 12 months is deleted (section 11).
• Posts, replies, trade listings and reviews, with their photos and videos: until you or somebody else entitled to removes them, or your account is deleted. A deleted post or reply is hidden at once and kept for about 90 days for moderation, then erased. Deleting your account erases them without that wait.
• Direct messages: until either person in the conversation deletes their account. An unsent message stays on our servers on the same terms.
• Photos in direct messages: about 90 days on our servers, or longer where a report, a safety review or a legal matter needs them, and no longer than the conversation itself.
• Group and community room messages: yours are deleted with your account, and the group carries on for everyone else.
• Voice messages: about 30 days on our servers. Unsending one deletes it.
• The note above your name: about a day.
• Reports, support conversations and moderation records: for as long as we need to handle them, spot repeat abuse and review appeals, and generally until the account is deleted.
• A video rejected because it may harm a child: up to about a year, out of everyone's reach, so that it can be reported.
• Network addresses: about 90 days, after which only a scrambled form is kept.
• Usage information: up to about 12 months. Deleting your account destroys the link to you.
• Locker scan samples: up to about a year.
• Server logs: a short time.
• Backups and standby copies: something you delete can remain in these for a limited time, normally up to about 30 days.
• What is on your device: until you clear it. The iPhone device identifier in section 2 stays after the app is deleted, which is how a restriction can follow a phone.

Deleting your account. It stops being reachable straight away: you are signed out, and your profile, posts, listings, conversations and follows disappear for everyone else. We erase the data about 30 days later. The gap lets us check the deletion, because an account can be abandoned to escape a warning, and lets you change your mind: signing back in during that time restores the account. Logging out is not a deletion.

What can outlast a deletion.

• An anonymous record that an account was deleted, and totals and de-identified information, such as public counts.
• If an account carrying a scam warning, a suspension or one of the permanent restrictions in section 8 is erased, a scrambled fingerprint of its sign-in, kept for up to a year, so the restriction can be restored if the same person returns.
• A note that an email address bounced, kept so that nothing tries it again. Ask and we will clear it.
• What we must keep by law, as described below.

Restrictions can follow a person. If an account with a warning, suspension or permanent restriction is still here and a new account is started on the same device, the new account can be given the same restriction, with a note of where it came from so that an appeal can be reviewed. Two people sharing a phone can be caught by this. If that is you, email support@spritecatch.com and we will lift it.

Legal holds and child-safety reports. After a report to the National Center for Missing & Exploited Children, United States law requires us to preserve the material and the account records around it for at least one year, and longer if the authorities ask or we decide to. While that runs, nothing belonging to that account is erased on these schedules, even if deletion is requested, and the same goes for the other person's messages in that conversation. A short record of the preservation is kept permanently. We may also keep information where another legal duty or legal hold requires it.

10. Your choices and rights

In the app and the web version you can:

• Control what people see, with profile visibility and the switches in Settings → Privacy & Safety, such as Share My Catches, Show When I'm Active and Show My Local Time.
• Control who reaches you, with settings such as who can message you or add you to a group, and by blocking people.
• Switch off usage data with Share Usage Data, and personalisation with Personalize Communities.
• Choose your email and notifications, with Email Me About Sprite Catch, which is off unless you turn it on, and notification settings by category.
• Disconnect a linked account at any time, and use /spritecatch privacy in Discord for what the bot holds.
• Delete what you made, such as a post, a conversation or what is stored on your phone.
• Delete your account, as section 9 describes. The account deletion page explains how, including if you have uninstalled the app.

Subscriptions are managed with the store you bought from. On iPhone, you cancel in your Apple ID's subscription settings and ask Apple for any refund. Deleting your account does not cancel a subscription, and cancelling does not delete your account.

Your rights. Wherever you live, you can ask us to see a copy of everything stored about you, correct anything wrong, delete your account and its data, export it in a portable format, or restrict or object to processing. Email privacy@spritecatch.com with your username or your account ID (Settings → Account). We respond within 30 days, there is no charge, and nothing about the app works worse because you asked. If you are in the European Economic Area or the United Kingdom, you can also complain to your national data protection authority.

California residents

Sections 2, 5, 6 and 9 set out the categories of personal information we collect, where it comes from, why we use it, who receives it and how long it is kept. California residents have the rights to know, delete and correct described above, and will not be discriminated against for using them. Some of this counts as sensitive personal information under California law, such as account log-ins and the contents of messages, and we use it as section 5 describes.

Do Not Sell or Share My Personal Information

Sprite Catch does not sell personal information or share it for cross-context behavioural advertising, as the CCPA/CPRA define those terms, including for consumers under 16. So there is nothing to opt out of today, and a browser's Global Privacy Control signal has nothing to act on. If that changes, this policy will say so first and give you a way to opt out.

To have this confirmed in writing, email privacy@spritecatch.com and say which account. You will get an answer within 15 business days. You do not need an account to ask, and an authorised agent may ask for you.

11. Children

Sprite Catch is not directed to children under 13, and its community is meant for people 13 and over. The iPhone and Android apps ask everyone's age, or receive an age range from Apple or Google Play, before they continue. The web version asks for no age of its own. This section is more specific than the rest of this policy on purpose, and we will update it before we change any of the limits below. The age rating page has more for parents.

What an account under 13 can do. Once the app knows an account belongs to somebody under 13, it can use the collection tracker, the scanner, the Shop, the arcade and its own private profile. It cannot use the community: it cannot post, reply, react or vote, send messages, photos or voice messages, join groups or communities, follow people, trade, or link a Discord or Epic account, and nobody else can message it, add it to a group or follow it. Our servers refuse all of this, so no setting on a phone and no browser reopens it. Somebody who says they are under 13 during setup is shown this as Safe Mode. If the age on an account is wrong, a parent or the account holder can email support@spritecatch.com to have it corrected.

What we collect. From an account under 13 we collect only what the collection side of the app needs and what keeps the service secure: a random identifier, a display name they choose, their collection and the lists they keep, their age or age range, their network address and the country their requests come from, and anything they or a parent send to support.

Accounts that used the community before we knew. If we learn that an account belongs to somebody under 13 after it has posted or sent messages, we tell the account first. On the date it is given, what it posted and sent is deleted and it leaves its groups and communities. Its collection, decorations and rewards stay.

Extra protections. Once the app has established that an account is under 13, these limits apply on our servers, so they hold on every device:

• the community features above are refused;
• the profile is kept private, and its profile page shows nothing at all, not even a name;
• we do not take an email address from it, and signing up with an email and password is not available;
• no usage information is collected;
• no interests are worked out, and its views are not counted;
• no sponsored cards are shown;
• no locker scan samples are collected;
• it cannot post a video, and is shown only videos a person has approved;
• it is not offered questionnaires, Sprite Catch Plus or trade alerts;
• we do not use its information for advertising or to train our own AI models.

How it is used and who receives it. We use this information to provide the features the account uses and to keep the service safe, as section 5 describes, within the limits above. It is not sold. It may be handled by the providers in section 6 that host the service, deliver notifications and check content, including the AI assistant that reviews conversations and tickets. It may be shared as section 6 describes for legal and safety reasons.

How long it is kept. An account under 13 that is not used for 12 months is deleted the same way as an account deleted on request: it stops being reachable straight away, and its information is erased about 30 days later unless the account is used again in between. Until then it is kept as section 9 sets out, while the account is in use, and erased about 30 days after the account is deleted, apart from the legal and safety exceptions there. Voice messages are kept for about 30 days and photos in direct messages for about 90 days. Network addresses are kept for about 90 days.

What parents of older children should know. From 13, the community features let people talk to strangers. Text is screened automatically and people can block and report one another, but moderation is no substitute for a parent's involvement. On the Parental Controls screen, you can switch each of these features off and lock your choice with a passcode. Parental Controls and the passcode are stored on the phone they were set on, so they do not reach a browser. If you switch the community, direct messages or news off on your child's phone, that does not switch them off for the same account at spritecatch.com. The under-13 limits above are different: they are kept by our servers and follow the account everywhere.

Support stays reachable whatever Parental Controls are set to, so a child can always tell us something is wrong, and email to support@spritecatch.com always reaches a person.

Parents' rights. If you are a parent or guardian, you can ask to see your child's information, ask us to delete it and stop collecting it, by emailing privacy@spritecatch.com. We will delete the account and its data promptly.

12. Security

Traffic between the apps and our servers is encrypted, and so is data at rest. Requests are authenticated with a signed token kept in secure storage on your device. Passwords are stored only in a one-way scrambled form, and the sign-in screen limits how often anyone can guess. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects you, we will tell you as the law requires.

13. Changes to this policy

We update this policy as Sprite Catch changes. The date at the top shows the current version. If a change is significant, we will tell you, for example in the app, by notification or by email. The app may show it on a full screen until you tap Accept, and we keep a record of that, which shows you were told and is not your consent to anything else. If you would rather not accept, you can delete your account.

Before we start using information in a way that is significantly different from what this policy has told you, we will tell you. If that means using information you have already given us, we will also ask for your agreement where the law requires it.

The latest change, 1 November 2026. We rewrote this policy to make it much shorter and easier to read. It now describes information by category, with examples, rather than feature by feature, and it no longer carries a history of past changes. It also describes more broadly how we may use and share information, including building new features, using AI and automated systems, the kinds of providers we work with, sponsored content, purchases, and what happens if the business changes. No new use of your information began with this version. Two things did change: accounts under 13 can no longer use the community (section 11), and new versions of the apps ask you to accept our Terms and this policy, including that our providers, among them third-party AI services, may process what you share, as a step of its own when you start. We keep a record of that acceptance.

Earlier versions stay available. Read the previous version of this policy, which includes its full history of changes.

14. Contact

Mateo Duran
Av. Dra. María Luisa Saldún de Rodríguez 2097
11500 Montevideo, Departamento de Montevideo
Uruguay
Phone: +598 92 545 280
contact@spritecatch.com
Support, read by a person: support@spritecatch.com
Privacy requests: privacy@spritecatch.com