Privacy
Last updated 2026-09-18
Sprite HQ is a free, unofficial fan tracker for Fortnite sprites, run by an individual rather than a company. This page says exactly what it stores, why, and how to get it back or erase it. It is written to be read, not to be survived.
The short version
- It stores your email address, the username you choose, and which sprites you have ticked off.
- It sets no cookies and runs no advertising or tracking.
- You can export everything or delete everything yourself, from inside the app, at any time.
- Nothing is sold, and nothing is shared with anyone beyond the services listed below that are needed to run the site.
What is stored, and why
| What | Why | How long |
|---|---|---|
| Your email address | Google gives it to the site when you sign in. It identifies your account and reconnects you to your collection if you sign in again. | Until you delete your account |
| Your username, friend code and avatar colour | So friends can find you and so your collection has a name on it. | Until you delete your account |
| Your collection: which sprites and variants you have, and which are mastered | It is the entire point of the site. | Until you delete your account |
| Your friends list | To show a shared leaderboard and recent activity. | Until you delete your account, or remove the friend |
| An activity log: what you ticked off and when | Powers your timeline and your friends' feed. | Deleted automatically after 180 days |
| Crash reports: an error message, the page it happened on, and your browser version | So a bug that stops you signing in can be found and fixed. | Deleted automatically after 30 days |
| Feedback you send through the form | To read and reply to it. | Until you delete your account |
| Reactions and comments you leave, and reports you make | So other people can see them, and so a reported comment can be hidden automatically. | Until you delete your account, or 180 days after the activity they are attached to |
| Only if you switch notifications on: a push address for that one browser, plus the two keys your browser generates so the message can be encrypted, and which kinds of alert you asked for | It is the only way to reach your device when a friend catches something. The address is issued by your browser, not by us, and it identifies the browser rather than you. | Deleted the moment you switch notifications off, and when you delete your account |
Reactions, comments and the community feed
You can react to what other collectors catch, and leave a comment. Two rules shape how that works, and they are deliberate:
- Anyone can react. Only friends can write. A comment can only be left on your own post or on a post by someone you have added as a friend, and adding someone needs their friend code. Somebody you have never met cannot send you text.
- The community feed only shows public profiles. If your profile is set to private, your activity does not appear there at all. That switch is in your profile and you can change it at any time.
Comments are checked automatically before they are posted. Links, email addresses, phone numbers, other apps and requests for personal details are refused outright, because moving a conversation off this site is how most harm to a young person begins. A comment that two people report is hidden immediately, and its author is muted, without anyone having to review it. You can block any collector, which removes them from your feed and undoes the friendship in both directions.
Your comments and reactions are part of your data: they come out in your export and they are erased when you delete your account or when the activity they are attached to is deleted after 180 days.
Notifications
Notifications are off unless you turn them on, and you choose which kinds you want. Nothing is sent until you have both granted your browser's permission and picked at least one category.
The message itself is encrypted end to end. Google, Mozilla or Apple relay it to your device without being able to read it: only your browser holds the key. What they can see is that a message was delivered, and when.
Turning notifications off inside the app deletes the stored address immediately. You can also revoke permission in your browser settings, which stops delivery whatever the site thinks. On iPhone and iPad, notifications only work at all once Sprite HQ has been added to your Home Screen, which is an Apple restriction rather than a choice made here.
Cookies
Sprite HQ sets no cookies at all. Staying signed in uses your browser's local storage, which holds only your sign-in token, on your own device. That is required for the site to work once you have chosen to sign in, so there is nothing here to consent to and no banner to click.
Visitor numbers come from Cloudflare Web Analytics, which is cookieless, does not fingerprint your device and cannot follow you to other sites.
Who else is involved
- Google handles sign-in. Sprite HQ never sees your Google password; it receives only your email address and whether Google has verified it.
- Supabase hosts the database that stores the table above.
- Cloudflare serves the site and provides the cookieless visitor counts.
- jsDelivr serves one JavaScript library to your browser.
Nothing is sold, rented or shared for advertising. There is no advertising.
What other people can see
If you mark your profile public, your username and your collection are visible at https://spritehq.pages.dev/u/your-name and on the leaderboard. Your email address is never shown to anyone, on any screen. You can switch your profile to private at any time in the app, and the public page stops working immediately.
Your data is yours
Inside the app: footer → Privacy & your data.
- Export downloads everything held about you as a JSON file.
- Delete erases your profile, collection, activity, friendships, feedback and crash reports, and removes your login. It is immediate and cannot be undone.
These are self-service on purpose: you should not have to ask permission, or wait for a reply, to get your own data back or remove it.
Children
Fortnite is played by children, so this is worth saying plainly. Sprite HQ does not ask for a date of birth and cannot tell how old you are. It collects no more than the table above and shows no advertising. If you are a parent or guardian and want an account removed, the delete button does it in one step from inside the app.
Contact
Use the feedback form in the app: footer → Send feedback. Requests to see or delete your data do not need a message at all, because the export and delete buttons do both immediately and without asking anyone.
Changes
If what the site stores changes, this page changes with it, and the date at the top moves. There is no mailing list to notify, because there is no mailing list.