Sprite Catch

Privacy Policy

Last updated: 28 July 2026 · Effective: 28 July 2026

Sprite Catch is a free hobby app made by one person. It has no ads, no trackers, no analytics and no in-app purchases, and it does not sell your data to anyone. This page explains, in plain language, exactly what it does store and why.

1. Who is responsible for your data

Sprite Catch is made and operated by Mateo Duran, an individual developer based in Uruguay. For the purposes of the GDPR, I am the data controller.

Privacy questions, access requests and deletion requests: [email protected]

2. What the app collects

Information the app creates for you

Data	Why
A random device identifier (a UUID generated on your iPhone)	So your collection can be saved and restored without asking you to create an account. It is generated by the app itself — it is not Apple's advertising identifier and it is not linked to your Apple ID unless you choose to sign in.
A friend code	A short random code so other collectors can find you if you share it.

Information you give the app

Data	Why
Your collection: which sprite variants you mark as owned, mastered, or on your wishlist	This is the whole point of the app. It is stored on your device and synced to the server so it survives a reinstall or a new phone.
Your Sign in with Apple identifier (optional)	Only if you choose to sign in. The app deliberately requests no name and no email address from Apple — it receives only an opaque identifier that lets it recognise you on another device.
A display name (optional)	Shown next to your trades and on your profile if you make it public. You choose it; it does not have to be your real name, and I would suggest it isn't.
A Fortnite tag (optional)	So other collectors know who to add in-game to complete a trade. You type it in yourself, and it is stored exactly as you typed it — it is never checked against Fortnite or any other service.
Trade listings and the free-text note attached to them (optional)	Shown to other users in the app's Social area. Anything you type here is public.
Your friends list and your chosen avatar sprite (optional)	To show your friends' collections in the app.
Posts and reactions in the social feed (optional)	If you write a post or react to someone else's, it is stored and shown to other users of the feed. Posts are public.
Direct messages, and the optional note you send when you request a chat (optional)	Messages you send another collector are stored on the server so the conversation survives a reinstall or a new phone. They are private to the two of you (see section 3).
A photo you attach to a direct message (optional)	If you choose to attach a photo to a message, it is uploaded so the recipient can see it, and it is stored as you sent it. The app only ever touches a photo you pick yourself — it has no access to your photo library otherwise.
Trade ratings and reviews you leave (optional)	After you and another collector both confirm a completed trade, either of you can rate the other from one to five stars and add a short written review. The star rating and the review are public: they appear on the rated collector's profile, shown under your display name and avatar, and they count towards the trade reputation other collectors see before agreeing to a trade. You can change or remove a rating you left at any time.
Reports you file (optional)	If you report a user, trade, post or message, I store who you reported, the reason, and any detail you add, so I can act on it and spot repeat abuse. Ordinary reports are private — only I see them. The one exception is marking a collector as a scammer, which is deliberately public: the mark and anything you write with it appear on that collector's profile under your name, so other collectors are warned before trading with them. If the report system is used to retaliate rather than to report, I can withdraw an account's ability to file, and reports filed after that are not stored at all — see Moderation and safety in section 3.
Support messages you send me (optional)	If you contact support from inside the app (menu → Support), I store the category you picked, everything you write, and the replies, so the conversation is there next time you open it. It is private — only you and I can read it, and it never appears anywhere else in the app. This is also why the app doesn't ask for your email address: the reply comes back inside the app instead. If you are appealing a warning on your profile, the app also records which warning was showing when you wrote, so I can see what you are appealing.
A push notification token (optional)	Only if you turn on notifications. It is an identifier issued by Apple that lets the server ask Apple to deliver a notification to your device; it is used for delivery only. Turn notifications off in iOS Settings and it stops being used. The server does not keep a record of the notifications it sends you — see “Your activity list” below.

Information collected automatically

The app's server runs on Cloudflare. Like any web server, Cloudflare logs standard request metadata — including your IP address, the time of the request and your device's user agent — to route traffic, block abuse and defend against attacks. I do not use this data to build a profile of you, and it is not joined to your collection data.

Each request also carries the app's own version and build number. This lets the server tell an out-of-date version of the app that it needs updating — for example when an older release can no longer talk to the server correctly. It describes the release you installed, not you, and it is not stored alongside your account.

Age and parental controls

To offer age-appropriate features, the app checks whether you are over or under 13 — using Apple's Declared Age Range service where your device supports it, or by asking your date of birth if it does not. The app keeps only the over/under-13 result, stored on your device; it never stores or transmits your date of birth or your exact age, and Apple does not reveal your birthday to the app. If the result is under 13, the community feed, trades, other collectors' profiles and direct messaging are turned off automatically.

A parent or guardian can also restrict those features behind a passcode (Settings → Parental Controls). The passcode and the on/off choices are stored only on your device (in the iOS Keychain) and are never sent to the server. Turning the social features off also makes the profile private — that is the one part that reaches the server, and it uses the same private-profile setting described elsewhere in this policy.

Your activity list

The app's Activity screen — new followers, reactions, trade matches, message alerts and so on — is stored only on your device. When a notification is delivered to your phone, the app saves that notification locally so you can look at it again later; the server keeps no copy and holds no record of which notifications you have read. This list is capped and old entries are discarded automatically. Deleting the app removes it, and it is never uploaded anywhere.

One consequence worth knowing: if you have not turned notifications on, there is nothing for the app to save, so your Activity screen stays empty. Everything it would have told you is still visible in the app itself — in your chats, on your posts and in your followers list.

What the app does not collect

No email address — support lives inside the app, so a reply reaches you without one. No real name. No phone number. No postal address. No location of any kind. No contacts. No access to your photo library, camera roll or camera — the only image the app ever touches is a single photo you deliberately choose to attach to a message. No health or fitness data. No payment or financial information. No browsing or search history. No advertising identifier. No server-side history of the notifications you have been sent or read. There is no analytics SDK, no advertising SDK and no third-party tracker of any kind in the app.

3. What is public and what is not

A new profile is public by default, so that other collectors can find you and match trades with you, and posting a trade or writing a post turns a public profile back on automatically and tells you so before you confirm. Public means the following are visible to other users of the app: your display name, your Fortnite tag, your avatar sprite, your collection and wishlist, your trade listings and notes, your posts and reactions in the social feed, and your trade reputation — the star rating built from trades you have completed, together with any written reviews and scam marks other collectors have left about you. You can make your profile private at any time in Settings, which hides you from Discover, from trade matching and from the "who has this" lists.

What you have caught is never public on its own: a private profile keeps your collection, wishlist and activity to yourself.

Your profile as a web page

Every public profile also has a shareable web address — spritecatch.com/u/<your friend code> — so you can send your profile to someone who does not have the app. It shows your display name, Fortnite tag, avatar sprite, friend code, how many sprites you have caught and mastered, your trade count and star rating, and some of your sprite art: the same things another collector sees in the app, minus the written reviews and scam-report text, which stay inside it. If a warning has been placed on your account after scam reports, the page says so too.

No account is needed to open that link, so treat it as public to the whole internet. Three things limit it: search engines are asked not to index the page (noindex); the address contains your 8-character friend code, which is randomly generated and cannot be guessed from your name; and if your profile is private the page shows nothing at all — not your name, not your art, not your friend code. Turning your profile private takes the page down within a few minutes, and deleting your account removes it.

Ratings and reviews you leave about other people are public wherever that person's profile is, and stay attributed to you even if you later make your own profile private — the point of a review is that other collectors can see who wrote it. Delete a rating and it disappears from their profile and stops counting towards their reputation.

Direct messages are private from other users — they are never shown in any public feed, and no other collector can read them. They are not private from me. I run the server, so I can access anything stored on it, including direct messages and the photos attached to them, and I may review that content where I need to: investigating a report, dealing with abuse or a safety problem, answering a support ticket, or fixing a bug. Messages you send are also screened automatically for banned content the same way public posts are (see Moderation and safety below).

I access message content when there is a reason to, not as a routine — but I am not going to promise you a technical limit that does not exist. Nothing you send is encrypted in a way that would stop me reading it, and no third party receives it (see Who your data is shared with).

Please do not put anything in your display name, your Fortnite tag, a trade note, a post or a message that you would not want a stranger to read.

Moderation and safety

Because people can post, trade and message each other, the app has to be moderated. Text you post publicly or send in a message is automatically screened for banned content before it posts or sends. Photos attached to messages are not scanned automatically — they are stored as sent and moderated on report. You can block another user, and you can report a user, trade, post or message; I review reports and can remove content or suspend accounts that break the rules set out in the Terms. To do this I may need to read or view any content stored on the server, including a private message or a photo attached to one, whether or not it was the thing reported — context usually sits in the messages around it.

Moderation runs both ways. If I put a warning on your profile and you think it is wrong, you can appeal it from inside the app (menu → Support) and I will read the appeal alongside whatever the decision was based on. I reply either way, and if I got it wrong the warning comes off.

The reporting tools get abused too — most often by someone who has just been marked as a scammer and marks every person who marked them straight back, which puts a public warning on people who did nothing wrong. Where I see that, I can withdraw that account's ability to file reports and scam marks. When an account is in that state its reports are discarded rather than stored, and they have no effect on anyone's profile. I keep a record of the decision — the account, the date, my reason, and a count of how many filings were discarded — so it can be reviewed and undone. I can also remove scam marks somebody has already filed, which takes them off the profiles they were placed on.

4. Who your data is shared with

I do not sell your data, I do not share it for advertising, and I do not use it for tracking as Apple defines that term. Data reaches exactly two other parties:

• Cloudflare, Inc. — hosts the app's server, database and images. Cloudflare processes data on my behalf as a service provider, on its global network; no photo or message is sent to any other company, for moderation or for anything else.
• Apple, Inc. — if you use Sign in with Apple (Apple handles that sign-in), and if you turn on notifications, in which case Apple's Push Notification service delivers them: the app hands Apple your device's push token and the notification to show, never your collection.

That list used to have a third entry. Until July 2026 a Fortnite tag you typed was sent to fortnite-api.com to check whether the name existed. That check is gone: your Fortnite tag now stays between your device and Sprite Catch's own server, and nothing about you is sent to any Fortnite-related service.

I may also disclose data if I am legally required to, or where it is genuinely necessary to investigate abuse of the app.

5. Where your data is processed

Cloudflare's network is global, and requests are served from wherever is nearest to you, so your data may be processed outside your own country, including in the United States. Where data originating in the European Economic Area or the United Kingdom is transferred, Cloudflare relies on the European Commission's Standard Contractual Clauses.

6. Legal basis for processing (GDPR)

• Performance of a contract — storing and syncing your collection is the service you asked for; the app cannot do it without storing it.
• Consent — for the optional parts: signing in, adding a display name or Fortnite tag, posting trades, writing posts, messaging other collectors, contacting support and answering a support request you sent me, turning on notifications, and making your profile public. You can withdraw consent by removing the information, turning the feature off, or asking me to delete your account.
• Legitimate interests — for server logs and for moderation (screening content, handling blocks and reports), to keep the service running securely and to deal with abuse.

7. How long data is kept

• Your account and collection — for as long as your account exists. If you ask me to delete it, I will do so within 30 days.
• Trade listings, posts and reactions — until you delete them, or your account is deleted.
• Direct messages and any photos attached to them — kept so the conversation persists across your devices, until either participant deletes their account. Deleting your account removes your messages and the photos you uploaded.
• Trade ratings and reviews — kept until you change or remove them, or until either you or the collector you rated deletes their account. Deleting your account removes the ratings you left about other people as well as the ones left about you.
• Reports you file — kept while the report is open and for a reasonable period after it is resolved, so repeat abuse can be spotted.
• Moderation decisions about your account — a scam warning, or a withdrawal of your ability to file reports, is kept while it is in force and for a reasonable period afterwards, so a decision that gets appealed or repeated can be reviewed against what came before. Deleting your account removes it.
• Support conversations — kept while the conversation is open and for a reasonable period after it is closed, so I have the context if the same problem comes back. Deleting your account removes them.
• Your activity list — kept on your device only, never on the server. Entries are discarded after about a month, and the list is capped at a few hundred; blocking a collector removes theirs immediately, and deleting your account or the app removes all of it.
• Cloudflare server logs — short-lived operational logs retained by Cloudflare under its own retention schedule; they are not used to build any long-term record of you.

If an account is anonymous and has been inactive for a long period, I may delete it to keep the database clean.

8. Your rights

Wherever you live, you can ask me to:

• See a copy of everything stored about you;
• Correct anything that's wrong;
• Delete your account and all associated data;
• Export your data in a portable format;
• Restrict or object to processing.

To exercise any of these, email [email protected] from the device you use the app on, or include your friend code. I will respond within 30 days. There is no charge, and nothing about the app will work worse because you asked.

If you are in the EEA or the UK, you also have the right to complain to your national data protection authority.

California residents

I do not and will not sell or share personal information as those terms are defined by the CCPA/CPRA, and I do not use personal information for cross-context behavioural advertising. Californian users have the rights to know, delete, and correct set out above, and will never be discriminated against for exercising them.

9. Children

Sprite Catch is not directed to children under 13, and the App Store listing is rated accordingly. I do not knowingly collect personal information from children under 13. Because the app works anonymously and never asks for a name, email address or location, an under-13 user who simply tracks their collection is not providing personal information to me at all.

The app's social features — public posts, trades, and direct messages with photos — do let users communicate with strangers. Text is screened automatically and users can block and report one another, but photos are not scanned automatically, and moderation is not a substitute for a parent's involvement. These features are not intended for children under 13. The app checks your declared age range (see Age and parental controls above) and turns the social features off automatically for under-13 users, and a parent or guardian can lock them off behind a passcode.

Contacting support is deliberately not restricted: it stays reachable whatever the parental controls are set to and whatever age range the device reports, because a child must always be able to tell me something is wrong. It reaches me and nobody else.

If you are a parent or guardian and you believe your child has entered personal information — for example a real name in the display name field, a Fortnite tag, a message, a support message, or a photo — email me and I will delete the account and its data promptly.

10. Security

All traffic between the app and the server is encrypted with HTTPS/TLS. Data at rest is encrypted by Cloudflare. Requests are authenticated with a signed token stored in your device's Keychain. That said, no system is perfectly secure, and I can't guarantee absolute security — which is one more reason the app collects as little as it possibly can.

11. Changes to this policy

If this policy changes materially, I will update the date at the top of this page and note the change in the app's release notes. Continuing to use the app after a change means you accept the updated policy.

12. Contact

Mateo Duran — Uruguay
[email protected]