Privacy
What is kept, and what is not.
This describes the actual database rather than the usual template. Where it says something is not stored, that means there is no column for it.
Last updated 7 August 2026
1. Who holds it
Bitwright is run by an individual in the United Kingdom, trading as Bitwright, and that person is the data controller. Contact hello@bitwright.app about anything on this page, including a request to see or delete your data.
2. What is kept
Three things, and this is the whole list.
| What | Detail |
|---|---|
| Your account | Your email address, the date you signed up, your plan, and how many sprites you have drawn in the current period. Nothing else. No name, no address, no card. |
| Sign-in records | For each sign-in link and each signed-in browser, a hash of the token and when it expires. The tokens themselves are never written down, so a copy of the database is not a set of working keys to anybody's account. |
| A row per drawing | When it happened, which model and setting were used, how many tokens it cost, how long it took, whether it worked, whether an image was attached, which viewing angle was chosen, and which account it belonged to. This is how the service is costed and priced. |
There is also a counter, kept for a day, that limits free drawing per internet address. The address is salted and hashed before it is used as a key, so what is stored cannot be turned back into an address.
3. What is not kept
Not the descriptions you type. Not the sprites you get back. Not the images you upload. None of these has a column in any table, and none is written to a log, including when something goes wrong.
Sprites live in your own browser's storage, on your own machine. That is why they survive closing the tab and why clearing your browser data deletes them permanently, including for us. It is also why a paid plan will one day offer to keep them for you, which will be a thing you switch on rather than a thing that happens to you.
Images you upload for the classifier on the front page never leave your browser at all. That whole demonstration runs on your machine.
4. Why, and on what basis
- Your email address, to sign you in and to tell you about your own account: that it was created, that your trial is nearly used up, that it has been deleted. This is necessary to perform the contract you entered into by signing up. It is never used for marketing, and there is no mailing list to be on.
- Sign-in records, to keep you signed in and to stop a used link working twice. Also contractual necessity.
- The row per drawing, to know what the service costs and to price it. This is our legitimate interest in running a business that does not lose money, and it is a small interference because the rows describe work rather than people.
- The hashed address counter, to stop one person spending the whole day's budget. Legitimate interest, and deliberately built so it counts without identifying.
5. Who else sees it
Three companies are involved and none of them are advertisers.
| Who | What they get |
|---|---|
| Anthropic | The description you type, and any photograph or sprite you attach, because that is what draws the sprite. They process it under their commercial terms and it is not used to train their models. We do not send them your email address or anything identifying you. |
| Cloudflare | Hosts the site, the database and the bot check, so requests pass through them, including your IP address. Standard infrastructure logging. |
| Resend | Sends sign-in emails, so they handle your address and the link. |
Some of these process data outside the UK, under the transfer safeguards in their own terms. Nothing is sold, and nothing is shared with anybody else.
6. How long
- Sign-in links: thirty minutes, then deleted.
- Sessions: sixty days, or until you sign out.
- The hashed address counter: twenty-four hours.
- Your account: until you delete it.
- The row per drawing: kept indefinitely, because it is the record of what the service costs over time. When an account is deleted, its rows are detached from it and stay only as anonymous cost data.
7. Your rights
Under UK GDPR you can ask for a copy of what we hold, ask for it to be corrected or deleted, object to the processing done on legitimate interests, and ask for it in a portable form. Email hello@bitwright.app and you will get an answer within thirty days, usually much sooner.
Given how little is held, most of these are quick: an export is your email address, your plan, and a list of dates and costs.
If you are not happy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but you do not have to.