Spritefetch Privacy Policy

Draft, not reviewed by an attorney.

Last updated: October 19, 2026

This Privacy Policy explains what personal information Spritefetch collects, why, who processes it, and what choices you have. Spritefetch (spritefetch.com, its REST API, and its MCP server, together the "Service") is a sole-proprietor project run by the project owner, based in California ("we", "us", "our").

1. Information we collect

We collect only the following:

What	When	Why
Your email address, for a sign-in link	When you ask for a sign-in link to get a free API key, whether or not you finish signing in	To send you the one-time sign-in link. We store the address encrypted with a key that only the emailed link carries, so we can't read it without that link. The stored request is deleted as soon as the link is used, and otherwise within about an hour after the link expires (links expire after 15 minutes).
A one-way hash of your email address	When you sign in and create an API key	To link your API keys to you, so you can see and revoke them. We don't keep a list of account email addresses: your keys are stored with a hash of your email, not the address.
Salted hashes of your email address and IP address, for sign-up limits	When you ask for a sign-in link	To limit how many sign-in links can be requested per email and per network. Deleted after 24 hours.
Rate-limit counters keyed by a salted hash of your IP address, or by your API key's id	When you make requests, with or without an API key	To apply rate limits and protect the Service from abuse. We store a hash, not the IP address itself. Counters expire after about 2 minutes (per-minute limits) and 48 hours (daily limits).
Search-miss logs	When a search returns no results or only weak matches	To learn which assets people look for that the library doesn't have, and to improve search. Each entry records the search terms, a truncated salted hash of your IP address, whether the request used an API key (but not which key), and whether it came through the website, the REST API, or MCP. Kept for 90 days.

Please don't put personal information in search queries.

Hashing is pseudonymization, not anonymization: a hash of an IP address could in some cases be matched back to that address. We don't store these hashes with your email address or API key.

Our hosting provider, Cloudflare, may keep its own request logs (for example IP addresses and request details) under its own terms. We don't write email addresses, IP addresses, or sign-in links to our own application logs in production.

2. Cookies and local storage

sf_session cookie. When you sign in, we set one cookie, sf_session, so you can manage your API keys. It is limited to the /account pages, is HttpOnly, and expires after 7 days or when you sign out. It holds your email address and a hash of it, signed so it can't be altered.
Theme setting. If you switch between light and dark mode, your choice is saved in your browser's local storage (sf_theme). It never leaves your browser.

We don't use analytics, advertising, or tracking cookies.

3. How we use information

We use the information above only to:

run the Service, including sign-in and API keys;
apply rate limits and prevent abuse;
improve search and the asset library;
respond to your messages and requests; and
comply with the law and enforce our Terms of Service.

4. Who processes your information

We use these service providers to run the Service. They process information on our behalf:

Cloudflare hosts the Service. Like any web host, it processes network data such as IP addresses in order to deliver requests.
Resend sends our sign-in emails, so it receives your email address and the sign-in messages we send you.

Each provider handles data under its own terms and privacy policy.

We may also disclose information if required by law, or if needed to protect the rights, safety, or security of the Service, our users, or others.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

5. How long we keep information

Sign-in requests (encrypted email address): deleted when the link is used, and otherwise within about an hour after it expires. Sign-in links expire after 15 minutes.
API keys and the hash of your email linked to them: until you ask us to delete them. Revoking a key stops it working; to have your keys and their records deleted, email us (see section 7).
Sign-up limit hashes (email and IP): 24 hours.
Rate-limit counters (hashed IP or API key id): about 2 minutes and 48 hours.
Search-miss logs: 90 days.
Your session cookie: 7 days, or until you sign out.

6. Security

We take reasonable steps to protect the information we hold. We store hashes rather than IP addresses, store only the SHA-256 of API keys and sign-in tokens, and encrypt the email address in pending sign-in requests. No system is perfectly secure, and we can't guarantee the security of your information.

7. Your privacy rights

Depending on where you live, you may have rights over your personal information. We extend the following rights to all users, wherever they live:

Right to know. Ask what personal information we hold about you, where it came from, why we use it, and who we share it with.
Right to access. Get a copy of the personal information we hold about you.
Right to delete. Ask us to delete your personal information, including your API keys and the records linked to your email. Some data may be kept where the law requires it.
Right to correct. Ask us to fix information that is inaccurate.
Right to opt out of sale or sharing. We don't sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.
Right to limit use of sensitive personal information. We don't collect sensitive personal information.
Non-discrimination. We won't treat you differently for exercising your rights.

California residents. California law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, may give you the rights listed above. The categories of personal information we collect are identifiers (email address, API key) and internet or network activity information (hashed IP addresses and search-miss logs), for the purposes and from the sources described in sections 1 and 3, and disclosed only to the service providers in section 4.

How to make a request. Email support@spritefetch.com from the address linked to your API keys. We'll verify your request by confirming it through that email address. Because hashed IP addresses and search-miss logs are stored without your email or key, we may not be able to match them to you. You can use an authorized agent to make a request; we may ask for proof of the agent's authority. We aim to respond within 30 days.

8. Children

The Service is not directed to children under 13, and we don't knowingly collect personal information from them. You must be at least 13 to create an API key. If you think a child has given us their email address, contact us and we'll delete it.

9. International users

The Service is hosted on Cloudflare's network. Information is processed in the United States and wherever Cloudflare and Resend operate.

10. Changes to this policy

We may update this policy. We announce changes by updating the "Last updated" date at the top of this page.

11. Contact

Questions or requests about privacy: support@spritefetch.com