Privacy Policy

Last updated: July 14, 2026

Sprite Locker (spritelist.site) is a fan-made Fortnite Sprite checklist and optional Trade Hub. We are not affiliated with Epic Games. This policy explains what we collect, why, and your choices.

1. Who operates this site

This website is operated by Spritelist (“we”, “us”, or “our”) as a fan-made Fortnite Sprite checklist and optional Trade Hub at https://spritelist.site. We are not affiliated with Epic Games. For privacy and data-protection requests, see Section 15.

2. Sprite checklist (main site)

When you use the checklist at / without signing in:

• Collection progress (which sprites you checked off, your checkmark color, and Most Wanted selections) is stored in your browser’s localStorage on your device only. We do not receive this data on our servers.
• Catalog images and sprite list are loaded from our hosting; standard web server logs (IP address, browser type, pages requested) may be recorded by our host (Vercel) for security and operations.
• Export / share generates an image in your browser. We do not upload your poster unless you choose to share it elsewhere yourself.

3. Trade Hub (optional — Epic sign-in)

If you use /trade and sign in with Epic:

• Epic account ID and Epic display name are received through Epic Account Services OAuth (basic_profile scope). We use these to show your listing as “Epic verified” and to match traders by in-game name. We do not receive your Epic password.
• Epic access tokens are used once during sign-in and are not stored long-term on our servers.
• Trade listing data you publish (sprites you have/need, optional note, ratings, trade requests) is stored in our Postgres database so other signed-in traders can browse and request trades.
• Session cookie (sl_trade_session): a signed, HTTP-only cookie keeps you signed in to the Trade Hub for up to 30 days. It contains your Epic account ID and display name — not your Epic password.
• OAuth state cookie (sl_trade_oauth_state): short-lived cookie used only during Epic sign-in to prevent login forgery; deleted after sign-in completes.
• Optional email alerts: if you opt in, we store your email address and send trade notifications through our email provider (Resend). You can remove or change it in Trade Hub settings.
• Optional push notifications: if you enable them, your browser’s push subscription endpoint and keys are stored so we can send trade alerts. You can disable push in settings or via your browser.
• Reports: if you report a listing, we store your Epic account ID, the reported account, reason, and optional detail for moderation.

4. What we do not collect

• Fortnite inventory, V-Bucks balance, or in-game trade history from Epic APIs
• Payment card or banking information (we do not process payments)
• Epic passwords or two-factor codes
• Third-party advertising or analytics trackers on the public checklist pages

5. How we use information

We use data only to:

• Run the checklist and Trade Hub features you request
• Display listings, send trade-related notifications you opt into, and enforce basic safety (rate limits, reports)
• Operate, secure, and debug the service (including server logs from our host)

We do not sell your personal information.

6. Third-party services

• Epic Games — Epic Account Services for sign-in; governed by Epic’s Privacy Policy
• Vercel — hosting and serverless functions
• Neon / Postgres — Trade Hub database storage
• Resend (optional) — transactional email for trade alerts
• GitHub (admin only) — private catalog publishing; not used for visitor accounts

7. Data retention

• Checklist localStorage — until you clear site data in your browser
• Trade session cookie — up to 30 days, or until you sign out
• Trader profile and listings — until you deactivate your listing, sign out long-term, or we remove inactive accounts per our trade cron maintenance
• Rate-limit and report logs — pruned automatically on a schedule

8. Children

Fortnite has many younger players. Sprite Locker does not knowingly collect more information from children than is needed to run the Trade Hub features their guardian allows. If you are under 13 (or the age required in your country), use the Trade Hub only with a parent or guardian’s permission. Parents may submit a request through our privacy request form to request deletion of a child’s Trade Hub account data.

9. Your choices and privacy rights

• Checklist only: use the site without Epic sign-in; clear localStorage in browser settings anytime
• Trade Hub: sign out to clear your session cookie; deactivate your listing in Manage; opt out of email/push in settings
• Epic connection: you can revoke Sprite Locker’s access in your Epic account settings
• Access, correction, or deletion: submit our online privacy request form (Section 15) to request access to, correction of, or deletion of Trade Hub data we hold about you

10. Security

We use HTTPS, HTTP-only session cookies, server-side secrets, and parameterized database queries. No method of transmission over the Internet is 100% secure; use the Trade Hub at your own discretion and follow our trading safety guide.

11. International users

Our servers and providers may process data in the United States or other regions where they operate. By using the site you understand your information may be transferred to those locations.

12. Changes

We may update this policy as features change. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.

13. Regional privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, and to lodge a complaint with a supervisory authority. Spritelist does not sell personal information. Trade Hub data is processed to provide the service you request when you sign in and publish a listing.

14. How to submit a privacy request

To exercise privacy rights relating to Trade Hub data we store (such as your Epic account ID, display name, listing, ratings, or optional email), use our online privacy request form on this page (https://spritelist.site/privacy#privacy-request). Checklist-only use stored in your browser can be cleared locally without contacting us. We may ask you to verify your identity (for example, by confirming your Epic display name or details tied to your listing) before fulfilling a request. We respond to the email address you enter in the form.

15. Data Protection Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, request access to your personal information, request deletion of your data, or have any other data protection inquiries, please contact us using our online form:

• Spritelist
• Website: https://spritelist.site
• Privacy request form: https://spritelist.site/privacy#privacy-request (open form on this page)

When submitting a privacy request, please include enough information for us to verify your identity and properly process your request, including a valid email address so we can reply. We will respond to legitimate privacy and data protection requests within the timeframe required by applicable privacy laws.

For users located in regions with specific privacy protections, including the European Economic Area (GDPR) or California (CCPA/CPRA), this online form may be used for submitting privacy-related requests.

16. Epic developer disclosure

For Epic Account Services brand review: this privacy policy is published at https://spritelist.site/privacy. Data-protection and privacy inquiries are handled via https://spritelist.site/privacy#privacy-request. Sprite Locker requests Basic Profile only (account identifier and display name).