Sprite Catch

Cookies

Last updated: 4 September 2026 · Effective: 4 September 2026

Sprite Catch sets no cookies. Not one — not to sign you in, not to remember you, and certainly not to advertise to you. There is no advertising here, no third-party analytics, and no script, font or content delivery network loaded from another company. That is why you have never been shown a cookie banner on this site, and why you will not be: there is nothing to ask you about. One page is not mine to promise for, and section 6 is about it.

1. What a cookie is, and why there are none here

A cookie is a small piece of text a website asks your browser to store and then sends back to a server with every request. That last part is what makes cookies the thing privacy law is written about: they travel, they can be set by companies whose code is embedded in a page, and that is how one company follows a reader from one website to another.

Sprite Catch does none of that. The web version, and every written page on spritecatch.com and app.spritecatch.com, sets no cookie — not a first-party one, not a third-party one — and apart from the one page in section 6 there is no other company's code anywhere on them that could set one. Being signed in does not create a cookie either: that is section 3, and it works differently.

2. No advertising, and no third-party analytics

There are no adverts anywhere in Sprite Catch and no advertising identifier is used, so there is no advertising cookie, no pixel, no tag manager and no remarketing list. There is no third-party analytics product on this site — no Google Analytics, no Meta pixel, nothing of that kind — and no crash reporter. The typefaces the written pages use are served from this website rather than fetched from Google, so even that request does not leave for another company.

Visits are counted, and the way they are counted is the reason this page can be so short. I do want to know roughly how many people use the site, so a page load tells my own server that a visit happened, which kind of screen it was, the language, and the country the request came from. It stores nothing in your browser to do it. Instead the visit is filed under a scrambled stand-in worked out from your network address, your browser's description of itself and today's date — and because the date is part of it, the stand-in is a different one tomorrow, so nothing in it can follow a browser from one day to the next. It carries no account, even when you are signed in, and it records the kind of screen rather than its address, so which collector's profile you read is not in it. Section 2 of the privacy policy describes it in full. The marketing page at app.spritecatch.com counts nothing at all.

3. What your browser does keep

The web version of Sprite Catch is a program that runs in your browser, and like any such program it keeps a few things in your browser's own storage so that it works. This is not a cookie: it is never attached to a request, it is readable only by spritecatch.com itself, and no other website — including app.spritecatch.com — can see it. This is all of it.

Whether or not you sign in

• The sprites you have ticked off, if you use the tracker without an account. This is the oldest thing on the list and the reason the tracker works at all without signing in. It is never sent to me. (spritecatch.web.collection.v1)
• How you like the collection displayed — how you sorted and filtered the grid, and how dense you set it. (spritecatch.web.collection.prefs.v1)
• The language you chose, so the site opens in it next time. (sc-lang)
• The theme for a shareable image, if you have made one, and a trade name if you set one. (sc.poster-theme, spritecatch.web.tradeName)
• A copy of the sprite catalogue — the public list of every sprite and its artwork, the same for everybody, so the site draws quickly and works on a bad connection. It holds nothing about you. (spritecatch.web.query.v1)

Once you sign in

• The token that keeps you signed in, and a copy of your own profile — your name, handle, avatar and settings — so a page can draw itself before it has asked the server anything. Signing out deletes both. (spritecatch.web.session.v1)
• Your own collection, and any marks not yet sent to the server. The unsent ones are what let the site work when the connection drops; they are sent within a minute, or when you close the tab. (spritecatch.web.collection.account.v1)
• The conversations you have already read — the messages, and a copy of your conversation list — so that opening one is instant rather than fetched again every time, and so the list is still there without a connection. It is a copy of messages the site already shows you and it sends me nothing. Signing out deletes it, and so does signing in with a different account on this computer. It is the one item on this page that is not in localStorage: messages are too many and too large for it, so they are kept in the browser's own database instead, which changes nothing about who can read them — still this site alone, still never attached to a request. (spritecatch.web.chat.v1, in IndexedDB)
• Which announcements you have dismissed, so the same banner is not shown to you twice. It is never sent to me. (spritecatch.web.community.dismissed-announcements.v1)
• That you have already been offered the community Discord invitation, because it is offered once and then never again. It is a single yes-it-happened mark, it says nothing about what you answered, and it is never sent to me. (spritecatch.web.discord-prompted.v1)

While a sign-in is actually happening

• Three short-lived values that make signing in with Apple or Google safe: a random value to check that the reply really came from where you were sent, a second one that ties the reply to that one attempt, and the page to put you back on afterwards. They are read once and thrown away, and unlike everything above they do not survive closing the tab. (spritecatch.web.auth-state.v1, spritecatch.web.auth-nonce.v1, spritecatch.web.auth-return.v1, in session storage)

Nothing on those lists is an advertising identifier, none of it is shared with anybody, and none of it is read by any other website. The two items marked as never sent to me are exactly that: they exist so the site does not ask you the same thing twice, and my server never learns them.

4. Why you are not asked to consent to any of it

European and UK law (the ePrivacy Directive, and the UK's PECR) requires consent before storing things on a reader's device — except where the storage is strictly necessary to provide a service the reader has explicitly asked for. Everything in section 3 is in that exception: the tracker cannot track a collection it is not allowed to remember, being signed in is not a thing that can work without the browser holding proof that you signed in, and the conversations kept for you are the messages you opened the page to read, held so that reading them again does not mean asking for them again. There is no analytics storage, no advertising storage and no profiling storage on this site at all — which are the categories that would need a banner — so there is nothing here for a banner to ask about, and adding one would be theatre rather than a choice. The sign-in code on the one page in section 6 falls in the same exception for the same reason: proving who you are is the thing you opened that page to do.

What you are asked about is elsewhere and is real: whether the apps may collect usage information is a switch in their settings (Settings → Privacy & Safety → Share Usage Data), and it is off the moment you turn it off. The web version produces no usage information of any kind, signed in or not.

5. How to clear it

Everything in section 3 is removed by clearing your browsing data for this site, in the ordinary way your browser offers — usually under Settings → Privacy, choosing site data or "cookies and other site data", and where your browser lets you pick a single site, choosing spritecatch.com. Using a private or incognito window keeps none of it after you close the window. Blocking site storage entirely also works; the site will simply forget you between visits.

Two consequences worth knowing before you do it. Clearing it while signed in signs you out, and loses nothing except any marks from the last minute that had not reached the server yet: your collection is on the server, and signing back in brings it back — and so are your conversations, which are fetched again the first time you open them. Clearing it while signed out deletes the collection you ticked off in that browser permanently — there is no copy on my side to restore, because it was never sent to me. If you want that collection kept, sign in first: it offers to merge what you tracked into your account.

Signing out on its own deletes the sign-in token, your cached profile and the conversations kept for you, and leaves the display preferences alone.

6. The one page this does not promise for

spritecatch.com/link is the exception, it has been for as long as it has existed, and it is the only one. That page connects a Discord account to a Sprite Catch account, and to prove you are who you say you are it loads Apple's and Google's own sign-in code from Apple and from Google. That code is theirs, not mine. I do not control what it stores, and it may set a cookie of its own on that page.

Three things bound it, and they are why this is a footnote rather than a hole. It is one page — nothing on it runs anywhere else, and no other page of the website or the web version loads anything from either company. You only reach it deliberately, by choosing to link a Discord account; nobody arrives there by browsing. And it has nothing to do with advertising: it is sign-in code, doing the job you opened the page to do. Section 6 of the privacy policy describes the same page as the one exception to "no third-party script, font or CDN", for exactly this reason.

If you would rather not load either, do the Discord link from inside the app instead: it loads neither, because you are already signed in there.

7. If this changes

If Sprite Catch ever sets a cookie, or loads anything from another company that could, this page changes first and the privacy policy changes with it — and if that storage ever needs consent, you will be asked for it rather than told about it afterwards. The dates at the top of this page are the ones to check.

8. Contact

Questions about any of this: privacy@spritecatch.com
Mateo Duran — Uruguay