Privacy Policy
Effective July 12, 2026
Sprite Broker (the website at spritebroker.com and the Sprite Broker Discord bot — together, "the service") is operated by Altus Labs, LLC ("we"). This policy explains what data the service handles and why.
The short version: we do not sell your data, we do not run ads, and we use data only to provide the service.
If advertising is ever introduced, it would appear only on public (logged-out) pages, be clearly labeled, load third-party content only with the consent the law of your region requires — and this policy will be updated to describe the specific provider and its cookiesbefore any advertising is enabled.
What we collect
Discord account basics. When you log in with Discord we receive your Discord user ID, username, display name, and avatar, plus the list of servers you belong to. The server list is used to work out which trading servers you can access, and to check whether you are already in the official Sprite Broker server so we don't invite you to a community you're in. The Discord tokens that power this are stored encrypted on our servers and are never placed in your browser beyond a session reference.
Things you do in the service. Your sprite collection, trades you propose or accept, moderation records tied to trading (per-server, and — for servers that opt in — a platform-level ban list), your gamer tag if you choose to provide one (shown only to the other party of a trade you both accepted), and support tickets you open (guild tickets are mirrored to a private staff thread in that Discord server).
Collection sharing. When you choose Copy collection link, we create an unguessable link that shows your Discord display name and sprite collection to anyone with that link. We do not make collections public from Discord user IDs alone, and shared collection pages ask search engines not to index them.
Usage counts. We keep a small tally of how the service is used, so we can tell whether features are working and worth keeping. Two things are counted. For your account we store the date you first signed in, the date you last signed in, and how many times — a single row of numbers, not a record of each visit. Separately we count how often each bot command is used per day across the whole service, and how many of those runs failed; those counts are totals only, with no user attached and none of what you typed — a command's name is stored, never its options, so nothing you searched for, wrote, or picked is recorded.
Technical logs. Our servers keep standard technical logs (such as IP address and browser type) for security and troubleshooting, and retain them only briefly.
Analytics. We use Google Analytics to understand how the site is used. If you are visiting from a region whose law requires opt-in consent (the EEA, United Kingdom, or Switzerland), analytics does not load and sets no cookies unless you click Accept in the cookie banner. Everywhere else it runs by default. Either way, you can turn it off at any time via Cookie settings in the footer and your choice is remembered for future visits.
Cookies and local storage
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
session | Strictly necessary | Keeps you logged in. Holds a random session reference — your Discord tokens stay encrypted on our servers. | 30 days |
oauth_state | Strictly necessary | Protects the Discord login handshake against forgery. | Minutes, during login |
sb_join_dismissed | Strictly necessary | Remembers that you dismissed the "join our Discord" prompt so it doesn't reappear. | 30 days |
sb_join_m | Strictly necessary | Caches whether you're already in the official Discord server (a single yes/no) so we don't re-check on every page. | 6 hours |
_ga, _ga_* | Analytics | Google Analytics usage measurement. Where law requires opt-in (EEA/UK/Switzerland), never set before you consent; elsewhere set by default. Expired if you opt out viaCookie settings. | Up to 2 years |
The site also uses your browser's local storage for interface preferences (like the collection view toggle) and to remember your cookie-consent choice. Withdrawing consent expires the analytics cookies from this site; you can also clear them in your browser at any time.
How we use data
To operate the service: showing your collection, running and recording trades, enforcing server moderation and trade accountability, handling support tickets, and keeping the service secure. Under the GDPR our legal bases are performance of a contract (providing the service you signed into), legitimate interests (security and moderation), and consent (analytics only).
Who data is shared with
No one, except people you deliberately give a collection-share link to, and the infrastructure that runs the service: Supabase (database and image storage), our server hosting provider, and — only with your consent — Google (analytics). The service operates partly inside Discord, so things you do there (trades in a server, ticket threads visible to that server's staff) follow Discord's own rules. Data is processed on servers in the United States. We never sell personal data and never share it for advertising.
How long we keep data
Login sessions expire after 30 days. Collections, trades, tickets, and moderation records are kept while they are relevant to running the service — trade and moderation history in particular exists for accountability between traders. The sign-in tally described above is a single row per account that does not expire on its own: unlike a session, it stays for as long as your account exists, and it is removed when you ask us to delete your data. The daily per-command counts are totals with no user attached, so there is nothing in them to tie to you or to delete. You can ask us to delete your data at any time (see below).
Your rights
Depending on where you live (including under the GDPR and UK GDPR), you can ask for access to, correction of, deletion of, or a copy of your personal data; object to processing; withdraw consent (for analytics, use Cookie settings in the footer); and complain to your local data-protection authority. To exercise any of these, contact us through the Support page or in the official Sprite Broker Discord server (linked in the footer when available).
Children
The service is not directed at children. You must meet Discord's minimum age (13, or higher where your local law requires it) to use it.
Changes
If this policy changes, we will update this page and its effective date. Also see our Terms of Service.