1. Who is responsible
The controller of your personal data (the "data controller" under the GDPR and the KVKK, Türkiye's personal data protection law) is MorbidBear, Kocaeli, Türkiye, Türkiye. Contact: mobear.dev@gmail.com.
2. What we collect
Account: when you sign in with GitHub or Google we receive your verified email address and the provider's account id. We never receive a password. You also give us a display name.
Your work: your workspaces, projects, prompts, the images you make and upload, and the API keys you create (stored hashed).
Billing: your credit history, your plan and a Paddle customer reference. Paddle holds your card and billing details; we do not see your card.
Technical: the IP address and browser details in server and access logs, job and API request logs, and error reports.
Analytics, only if you accept: page views and a few events, described in the Cookie Policy.
If you disconnect GitHub or Google in Settings, we delete that provider's link (its account id) from your account. Signing in again with that provider and the same email links it again. You can't disconnect your last sign-in method.
3. Why we use it, and on what legal basis
Where the GDPR applies to you (you are in the EU or UK), each purpose rests on a basis in Article 6. Under the KVKK the equivalent bases are in Article 5.
| Purpose | Data | GDPR basis | KVKK basis |
|---|---|---|---|
| Run your account, projects and generation | Account, your work | Contract (Art. 6(1)(b)) | Necessary to perform a contract (Art. 5(2)(c)) |
| Take payment, keep tax and billing records | Billing, account | Contract; legal obligation (Art. 6(1)(b), (c)) | Contract; a legal obligation (Art. 5(2)(c), (ç)) |
| Keep the service secure, prevent abuse and fraud, fix errors | Technical, logs, error reports | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 5(2)(f)) |
| Answer your messages, copyright notices and requests | Account, your message | Legitimate interests; legal obligation | Legitimate interests; a legal obligation |
| Measure which pages help people get started | Analytics data | Consent (Art. 6(1)(a)), only after you accept | Explicit consent (Art. 5(1)) |
4. Training and automated decisions
We do not train or fine-tune any model on your prompts, images or outputs, and the providers below are bound not to either. We make no decisions about you by automated means that have legal or similarly significant effects.
5. Who processes it, and where
We use these companies to run SpriteDock. Where one is outside the European Economic Area or Türkiye, the transfer relies on the safeguard shown; you can ask us for a copy of the relevant clauses.
| Company | What it does | Country | Transfer basis |
|---|---|---|---|
| fal | Runs image and video generation models on your prompts and images | United States | Standard contractual clauses |
| Anthropic | Runs the painter model on your prompts and images | United States | Standard contractual clauses |
| RunPod | Runs the drawing model on GPU servers | United States | Standard contractual clauses |
| Cloudflare (R2) | Stores your images and files, and backups | United States (storage region as we configure it) | Standard contractual clauses |
| Hetzner | Hosts our servers and database | European Union | None needed inside the EEA; standard contractual clauses for transfers on to Türkiye |
| Paddle | Merchant of record: takes payment, tax and invoices, and handles refunds | United Kingdom | UK adequacy decision (EU); standard contractual clauses (Türkiye) |
| GitHub | Verifies your sign-in if you choose GitHub | United States | Standard contractual clauses |
| Verifies your sign-in if you choose Google | United States | Standard contractual clauses | |
| Google Analytics (via Firebase) | Analytics, only after you accept | United States | Standard contractual clauses |
| Sentry | Receives error reports from our servers | United States | Standard contractual clauses |
6. How long we keep it
We keep each kind of data only as long as shown here.
| Data | Kept for |
|---|---|
| Account, projects and stored images | Until you delete them or your account; then purged from our database and storage within 30 days |
| Prompts saved in a project (on a reference, frame or gallery asset) | As long as that project or item exists; deleted with it |
| Job records (including the prompts and settings a job ran with) and API request logs | 30 days |
| Server and access logs | Kept in a size-limited rotation (at most 50 MB per service) that overwrites the oldest entries |
| Cost and usage records (which model ran, when and at what cost; no prompts or images) | Kept with the billing records |
| Backups | Up to 8 weeks, so data you delete is gone from backups within about 60 days |
| Billing and credit ledger | As long as tax and accounting law requires |
| Google Analytics data | 14 months |
7. Your rights
You can ask us to tell you what we hold about you, to correct it, to delete it, to limit or object to our use of it, to give you a copy you can move, and, where we rely on consent, to withdraw it at any time. Under the KVKK you have the matching rights in Article 11. Email mobear.dev@gmail.com; we answer within one month (KVKK: thirty days). You can delete your account yourself from Settings.
You can complain to the data protection authority where you live or work in the EU, or to the Personal Data Protection Board (KVKK Kurul) in Türkiye. We would be glad to hear from you first.
8. Children
SpriteDock is for people aged 16 and over. We do not knowingly collect data from anyone younger; if we learn we have, we delete the account. If you think a child has signed up, tell us.
9. Deleting your data
Deleting your account can't be undone. It deletes your projects and stored images, removes your API keys and invites, ends your sessions, unlinks your sign-in methods, drops your display name and cancels your subscription with no refund for the current period. Starting a deletion first revokes your API keys, invites and other sessions, even if the deletion is then refused (for example because a job is running or the subscription could not be cancelled).
What we keep: the account record stays, with your email address replaced by a hash of it and no name, so records that refer to your account still resolve. Credit and billing records stay too. Credits you spent in someone else's workspace stay in its history, shown as "deleted user".
The free trial is recorded under a hash of your email address, which is how the same address can't claim it twice. Our credit history cannot be edited, so for an account created before we started hashing, the record of its free trial still holds the email address in readable form, and we cannot rewrite it.
10. Security
Data is encrypted in transit, API keys are stored only as hashes, and access to our servers is limited. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.
11. Changes
If we change this policy in a way that matters, we will tell you by email or in the app before it applies. The date at the top shows the latest version.