Gensprite
Sign in

Privacy policy

Last updated: August 16, 2026

Who we are

Gensprite (gensprite.ai and api.gensprite.ai) is operated by Triangle Interactive, LLC (“we”, “us”). It generates game sprites, turnarounds and animations, used through the web workshop and an HTTP API with API keys. Questions about this policy go to hello@gensprite.ai.

What we collect

  • Account: your name, email address, whether the email is verified, and an optional avatar image URL from your sign-in provider. There are no passwords — sign-in is by email magic link (valid for ten minutes, stored only as a hash) or by Google or GitHub OAuth, whose tokens we store to keep you signed in.
  • Sessions: each signed-in session records the IP address and browser it was started from.
  • Generations: every job keeps its input — the prompt you typed, the settings, the resolved seed, and references to input images — together with the files it produced. Job records are what your history and credit ledger are made of.
  • Uploads: images you upload for rotation or animation (PNG, JPEG or WebP, up to 20 MB).
  • API keys: stored as hashes with the first eight characters kept for display, plus a last-used timestamp. The secret itself is shown to you once and never stored.
  • Billing: payments are handled by Stripe. We store only what is needed to grant what you bought — Stripe’s event ids and your subscription state. Card numbers never touch our servers.

Cookies, and the absence of tracking

One essential session cookie keeps you signed in, set for .gensprite.ai so the workshop and the API can share it. Your theme choice is kept in your browser’s local storage. That is the complete list: we run no analytics, no tracking pixels and no third-party advertising scripts, and the documentation search runs on our own server.

Who else sees data, and why

Gensprite runs on a small set of processors, each receiving only what its job requires:

  • Stripe — payments. Receives your email address and our internal account id.
  • fal.ai — runs the generation models. Receives your prompts and, for rotations and animations, the images being worked on. While a job runs, input images are reachable at unlisted public URLs so the models can read them.
  • Cloudflare R2 — stores uploads and generated files. Your browser uploads directly to it using links that expire after fifteen minutes.
  • Resend — sends all email (sign-in links, balance warnings, announcements) and hosts the mailing list, including the record of whether you have opted out. Receives your email address and first name.
  • Vercel — hosts the website and API.

We do not sell personal data, and we do not use your prompts, uploads or generated art to train models.

Email

Sign-in links and account notices are transactional and arrive as long as you have an account. New accounts are also subscribed to product announcements; every such message carries a one-click unsubscribe, and the same switch lives in Settings and at gensprite.ai/unsubscribe, which works without signing in. Opting out sticks.

How long things stay

  • Generated files are kept while your account has spendable credits or an active plan. When both lapse, a 90-day countdown starts — announced in the workshop with the exact date — after which the files are deleted. Topping up before then stops the clock.
  • Job records (prompts, settings, the credit ledger) survive file expiry, because they are the account’s history of what was charged and refunded.
  • Uploads nothing references are deleted after 24 hours. Working files of failed jobs are discarded immediately.
  • Magic-link tokens expire after ten minutes.

Security

Sign-in tokens and API keys are stored hashed, never verbatim; uploads travel over short-lived signed URLs; payment webhooks are verified by signature; cookies are marked Secure in production. No measure makes a system impenetrable, but secrets we never store are secrets that cannot leak from us.

Your rights

You can ask us to access, correct, export or delete the personal data we hold about you by writing to hello@gensprite.ai from your account’s email address. Deletion removes the account and everything attached to it, including remaining credits. We answer within 30 days.

Children

Gensprite is not intended for children under 13, and we do not knowingly collect personal information from them.

Changes

When this policy changes, the date at the top changes with it, and material changes are announced by email. Continued use after a change means acceptance of it.