Privacy Policy

Last updated: July 9, 2026

Sprite Locker (spritelist.site) is a fan-made Fortnite Sprite checklist and optional Trade Hub. We are not affiliated with Epic Games. This policy explains what we collect, why, and your choices.

1. Who operates this site

Sprite Locker is operated as a fan project. If you have privacy questions, contact the site operator through the channels listed on the site or your Epic / hosting provider support path for this deployment.

2. Sprite checklist (main site)

When you use the checklist at / without signing in:

• Collection progress (which sprites you checked off, your checkmark color, and Most Wanted selections) is stored in your browser’s localStorage on your device only. We do not receive this data on our servers.
• Catalog images and sprite list are loaded from our hosting; standard web server logs (IP address, browser type, pages requested) may be recorded by our host (Vercel) for security and operations.
• Export / share generates an image in your browser. We do not upload your poster unless you choose to share it elsewhere yourself.

3. Trade Hub (optional — Epic sign-in)

If you use /trade and sign in with Epic:

• Epic account ID and Epic display name are received through Epic Account Services OAuth (basic_profile scope). We use these to show your listing as “Epic verified” and to match traders by in-game name. We do not receive your Epic password.
• Epic access tokens are used once during sign-in and are not stored long-term on our servers.
• Trade listing data you publish (sprites you have/need, optional note, ratings, trade requests) is stored in our Postgres database so other signed-in traders can browse and request trades.
• Session cookie (sl_trade_session): a signed, HTTP-only cookie keeps you signed in to the Trade Hub for up to 30 days. It contains your Epic account ID and display name — not your Epic password.
• OAuth state cookie (sl_trade_oauth_state): short-lived cookie used only during Epic sign-in to prevent login forgery; deleted after sign-in completes.
• Optional email alerts: if you opt in, we store your email address and send trade notifications through our email provider (Resend). You can remove or change it in Trade Hub settings.
• Optional push notifications: if you enable them, your browser’s push subscription endpoint and keys are stored so we can send trade alerts. You can disable push in settings or via your browser.
• Reports: if you report a listing, we store your Epic account ID, the reported account, reason, and optional detail for moderation.

4. What we do not collect

• Fortnite inventory, V-Bucks balance, or in-game trade history from Epic APIs
• Payment card or banking information (we do not process payments)
• Epic passwords or two-factor codes
• Third-party advertising or analytics trackers on the public checklist pages

5. How we use information

We use data only to:

• Run the checklist and Trade Hub features you request
• Display listings, send trade-related notifications you opt into, and enforce basic safety (rate limits, reports)
• Operate, secure, and debug the service (including server logs from our host)

We do not sell your personal information.

6. Third-party services

• Epic Games — Epic Account Services for sign-in; governed by Epic’s Privacy Policy
• Vercel — hosting and serverless functions
• Neon / Postgres — Trade Hub database storage
• Resend (optional) — transactional email for trade alerts
• GitHub (admin only) — private catalog publishing; not used for visitor accounts

7. Data retention

• Checklist localStorage — until you clear site data in your browser
• Trade session cookie — up to 30 days, or until you sign out
• Trader profile and listings — until you deactivate your listing, sign out long-term, or we remove inactive accounts per our trade cron maintenance
• Rate-limit and report logs — pruned automatically on a schedule

8. Children

Fortnite has many younger players. Sprite Locker does not knowingly collect more information from children than is needed to run the Trade Hub features their guardian allows. If you are under 13 (or the age required in your country), use the Trade Hub only with a parent or guardian’s permission. Parents may contact us to request deletion of a child’s Trade Hub account data.

9. Your choices

• Checklist only: use the site without Epic sign-in; clear localStorage in browser settings anytime
• Trade Hub: sign out to clear your session cookie; deactivate your listing in Manage; opt out of email/push in settings
• Epic connection: you can revoke Sprite Locker’s access in your Epic account settings

10. Security

We use HTTPS, HTTP-only session cookies, server-side secrets, and parameterized database queries. No method of transmission over the Internet is 100% secure; use the Trade Hub at your own discretion and follow our trading safety guide.

11. International users

Our servers and providers may process data in the United States or other regions where they operate. By using the site you understand your information may be transferred to those locations.

12. Changes

We may update this policy as features change. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.

13. Epic developer disclosure

For Epic Account Services brand review: this privacy policy is published at https://spritelist.site/privacy. Sprite Locker requests Basic Profile only (account identifier and display name).