Privacy Policy

At a glance

• You can use the basic collection tracker locally without creating an account.
• An account is needed to sync across devices and use social features such as Parties, comparisons and feedback.
• Collections are private by default. They are shared only when you explicitly choose Party or public visibility.
• Sprite Tracker does not sell personal data or use advertising trackers.
• Google sign-in is used only for authentication and basic profile information. We do not access Gmail, Drive, contacts or your Google password.

Who controls your data

FN Sprite Tracker is independently operated in the European Union by Fhlo. Fhlo is the controller of personal data processed specifically for this service. For privacy requests, use a private feedback ticket or email support@fnspritetracker.net.

Information we handle

Device-only use

If you use the tracker without signing in, your collection, theme, timezone, display preferences and similar settings are stored in your browser. They remain on that device unless you clear the site’s browser storage, reset the collection, import a replacement, or later merge it into an account.

Account and identity data

For registered accounts we may store a Supabase user identifier, unique username, nickname, optional verified email address, authentication provider, selected profile Sprite, profile visibility and account timestamps. Passwords are handled by Supabase authentication and are not visible to Sprite Tracker staff. Recovery keys are stored only in hashed form.

Collection and community data

We store your Sprite statuses, levels and permanent Mastery history. If you use community features, we also store the information needed for Party membership and invitations, hunt-board entries, trades, notifications, saved comparisons, expiring share links, player blocks, achievements, feedback messages, votes, optional feedback screenshots and structured beta reviews.

Security and service data

Limited technical records may be processed to operate and protect the service, including request times, error and deployment logs, rate-limit counters, audit events and hashed network identifiers. Do not include passwords, recovery keys or other sensitive information in feedback or screenshots.

For up to 90 days, Sprite Tracker also keeps privacy-minimised usage totals for signed-in accounts: the page identifier visited, a random per-tab session identifier, coarse device class (mobile, tablet or desktop), and safe error categories. It does not store page query strings, IP addresses, full browser user-agent strings, email addresses, collection contents or free-form error messages in this analytics dataset.

Structured beta reviews

If you choose to send a beta review, we store your ratings, recommendation score, feature pass/issue choices, improvement categories, review type, session-length bucket, coarse device and orientation, the platform and browser category you select, release-readiness answers and optional written comments. Your account identifier is used only inside the database for access control, rate limits and unique-tester counts. Admin statistics and exports omit your username, email address and account ID. Individual written answers remain private to staff, but may still identify you through what you write, so do not include personal or sensitive details.

Raw structured reviews are retained for up to 180 days. They are never published to other players.

Google sign-in

When you choose “Continue with Google,” Google authenticates you and provides Supabase Auth with the basic OpenID Connect information needed to create or find your Sprite Tracker account. This normally includes your Google account identifier, email address, display name and profile image.

Sprite Tracker requests only openid, email and profile access for sign-in. It does not request access to Google mail, files, contacts, calendars, purchases or passwords.

You can review or revoke Sprite Tracker’s Google access from your Google Account. Revoking Google access stops future Google sign-in but does not automatically delete the Sprite Tracker account or collection already stored; contact us if you also want those removed.

How information is used

• Authenticate your account and support password recovery.
• Save, restore, import and synchronize your collection.
• Show the profile, Party, comparison and trade features you choose to use.
• Enforce collection visibility and prevent private collections from being exposed automatically.
• Respond to feedback, analyse structured beta reviews, moderate public suggestions and investigate abuse or technical failures.
• Protect accounts and the service through access controls, rate limits, audit records and leaked-password protection.

Legal bases

• Contract: to create an account and provide the collection, synchronization, recovery, Party, comparison, trade-coordination and feedback features you request.
• Legitimate interests: to secure accounts, prevent abuse, diagnose failures, moderate shared content and maintain a reliable service. These interests are balanced against user privacy.
• Consent: where you make an optional choice that relies on consent, such as using Google sign-in or deliberately publishing or sharing content. You may withdraw that choice prospectively.
• Legal obligations: where records or disclosures are required by applicable law.

What other players can see

Your collection visibility starts as Private. You may change it to Party or Public. The server rechecks that setting whenever another player tries to view or compare your collection. Joining a Party does not automatically expose your private collection.

Usernames, nicknames, Party roles and content you deliberately submit to a shared Party area may be visible to the relevant members. Suggestions are public only when you choose public submission and staff approves them. Bug reports, questions, “other” tickets and structured beta reviews remain private to you and staff. Beta review aggregates shown in Admin contain no player identity.

Service providers

We use service providers only where needed to run the tracker:

• Supabase for authentication, PostgreSQL data storage, access controls, file storage and server functions.
• Cloudflare for hosting, content delivery, DNS and service security.
• Google when you choose Google sign-in.
• Resend for account verification and recovery email delivery.
• jsDelivr to deliver the public Supabase browser library.

These providers may process technical data under their own terms and privacy notices. We may also disclose information when required by law or when reasonably necessary to protect users, the service or another person.

Some providers may process data outside Belgium or the European Economic Area. Where EU data-protection law requires it, transfers must rely on an adequacy decision or appropriate safeguards such as approved contractual protections.

Your data-protection rights

Depending on applicable law, you may ask for access, correction, deletion, restriction, portability or an objection to processing. Where processing relies on consent, you may withdraw consent without affecting earlier lawful processing. You may also complain to the supervisory authority for your habitual residence, place of work or the place of an alleged infringement. The European Data Protection Board lists the EU and EEA authorities.

We aim to respond within the period required by applicable law. We may need to verify account ownership, and a request may be limited where an exemption or another person’s rights apply.

Retention and your choices

Account data is generally kept while the account is active. Unpinned Collection Restore Points expire after 90 days; pinned restore points remain until unpinned. Expiring comparison links stop resolving after their selected expiry and can be revoked earlier. Raw structured beta reviews expire after 180 days. Security, moderation and audit records may be retained where reasonably needed to prevent abuse, resolve disputes or protect the service.

You can change collection visibility, revoke comparison links, leave Parties, withdraw feedback where available, download a collection backup, reset your collection, clear local browser data, or revoke Google access.

To request access, correction or deletion of account data, send a private ticket through Feedback. If you cannot sign in, email support@fnspritetracker.net. We may need to verify account ownership before acting.

Security, children and changes

We use Supabase Auth, Row Level Security, restricted server functions, encrypted transport and role checks to protect information. No online service can guarantee absolute security, so keep your password and recovery key private and report suspected account misuse promptly.

Sprite Tracker is an unofficial collection tool and is not designed to collect sensitive personal information. If local law requires parental or guardian permission for a younger user, that permission should be obtained before creating an account.

We may update this notice when features or providers change. The current version and update date will remain available on this page.

Contact

For privacy questions or requests, use a private Sprite Tracker feedback ticket or email support@fnspritetracker.net.

Sprite Tracker is an unofficial fan-made Fortnite tracker and is not affiliated with, endorsed by or sponsored by Epic Games.