Privacy
Last updated 22 August 2026. This describes what the running code does. If the two ever disagree, the code is the truth and this page is the bug.
Your asset files stay on your machine
When you drop a project folder into the import screen, that folder is read in your browser. Your sprites, audio, fonts, models and shaders are never uploaded — most are only counted by name and never opened at all. Where a folder cannot be identified any other way, its files are hashed, and the hashing happens in the tab too: a hash is a fingerprint, and you cannot rebuild a sprite from one.
The files that are opened and read are the ones that exist to be read: LICENSE, COPYING, OFL.txt and the readmes sitting beside your assets. Their text is sent, because that text is the licence — it is the entire thing you came here to keep track of, and a record of your terms that does not contain your terms would be useless.
Before you have an account
The preview on the try page is stricter than the import screen, because you have not agreed to anything yet. Your folder is read in the browser exactly the same way, and what reaches us is one hash per filename and a count. No paths, no licence text, no readme text, nothing you typed.
Hashing is one way, so those numbers cannot be turned back into your filenames. What we can do is hash the packs already in the shared corpus and see which numbers match — so a pack that was already public is recognised, and a file that only exists in your unreleased game stays a number nobody here can read. The scan itself is kept in your browser, and it is sent to us only when you have an account and press the button that says so.
Exactly what leaves your machine
What never does
That list is about the import. Two kinds of file are stored, and only ever because you chose to attach them — see below.
The two files that are stored, because you asked
Receipts you attach. A receipt is proof you paid for something, so it has to be the actual file. Up to 2 MB, and only PDFs, images and plain text — archives and executables are refused. They go in a private store: nobody outside your workspace can open one, and even you open it through a link that stops working after a minute.
Photographs are re-encoded in your browser before they are sent, which drops the EXIF block. That matters more than it sounds: a phone stamps the coordinates of wherever the picture was taken into every photo, and for a receipt that is usually your home. Proving you bought a tileset should not hand over your address.
Attachments you forward. If you send an email to your workspace’s inbox address, what you attached is kept — storing the receipt you posted us is the entire point of posting it. Same short list of accepted types.
Both are deletable from the screen you attached them on, and both go when the asset or the account does.
What is kept about you
Your email address, a password hash, and a hash of your recovery code. That is the whole of it. No phone number, no real name, no payment details on our side.
The address is kept twice: once as you typed it, which is what we send to, and once with the aliasing removed — a.b+two@gmail.com and ab@gmail.com stored as the same key. That second copy exists for one reason: so one person cannot hold several free plans by punctuating their own address differently. It is never sent anywhere and never used to contact you.
This changed. Accounts used to have no address at all, and that page said so. It was true, and it meant that losing the recovery code lost the account with no way back — which is a bad trade for the person it happens to. The address is the second way in.
A log of actions in your workspace, so the people in it can see who changed what.
No tracking, and you can check
There is no analytics, no advertising, no tracking pixel and no third-party script on any page. That is not a policy that could be quietly changed — the content security policy served with every response forbids them outright, and the browser enforces it:
curl -I https://credits-app-eight.vercel.app/login
Who else sees it
People you invite to your workspace. Anyone at all, for a credits page you choose to publish — that is what publishing means, and nothing is public until you say so.
Two companies host this: Supabase stores the database, Vercel runs the site. They can technically reach the data because they operate the machines. Nobody else is sent anything, and nothing is sold to anybody, ever.
If you accept a pack match, its pack name and file names join a shared corpus so the tool can recognise that pack for other people. Contributions are pooled so no single contributor can be picked out of them, and they never carry your project, your email or your artwork. Nothing joins it unless you accept a match.
One kind: messages to creators and collaborators you have asked us to contact about an asset of theirs you are crediting. Never to you — we have no address for you. Every one of those carries a one-click unsubscribe that needs no account, works forever, and also cancels anything already queued.
Getting your data out, and getting rid of it
Export from Settings, any time, on any plan, without asking: JSON and Markdown, no proprietary format, no account needed to read it.
Delete your account from Settings. That removes your sign-in record and every workspace you own, with the projects, assets and snapshots inside them. Where you acted inside somebody else’s workspace — published a snapshot there, sent an invite — the record of the action stays and your name comes off it, because deleting their history is not yours to do.
Both are ordinary buttons, not a request you file and wait on. A product you cannot leave is one people are right to be wary of joining.
Asking
lajordan5314@gmail.com. One person reads it.