MOSS Sprite · in your browser

Privacy Policy

Last updated: 17 September 2026

MOSS Sprite is the drawing toy you paint with in a browser, made by Brainfruit Studio, Inc. ("we", "us"). This page covers moss.town and play.moss.town, and nothing else. The MOSS Studio app for iPhone and iPad has its own policy.

The short version

• Your drawings stay in your browser. We see one only when you publish or submit it.
• MOSS Sprite has no accounts. We never ask for your name, your age, or your address.
• No advertisements. No tracking. We do not sell data.
• The site sets no cookies and runs no third-party analytics, so there is no banner to click.
• Everything that leaves your browser leaves because you pressed a button.

What stays in your browser

MOSS Sprite keeps your work in your own browser, in local storage and in IndexedDB. Nothing there goes to us.

• Your canvas, your brushes, your palettes, and your pad names
• Your saved pads, your display case, and the frames MOSS records so you can replay a drawing
• The undo history for the pad you have open
• The name you typed for yourself, and your answer to the sharing question
• Small settings, such as the last time the boot screen ran
• A random MOSS device name, described below

MOSS Sprite sets no cookies. To erase all of it, clear site data for play.moss.town in your browser. Your pads go with it, so export anything you want to keep first.

The MOSS device name

MOSS Sprite makes a random identifier the first time you use it and keeps it in your browser. It lets us count publishes per day, show you your own work, and remove a pad you ask us to remove.

It rides along with every request MOSS makes to our server, including the two it makes by itself at startup to ask which features are on and which challenge is running. Those two record nothing.

The first time you publish, submit, or pick a display name, we make a row against that identifier. It holds the name you chose, when we first saw the identifier, and when we last saw it. That is the whole row.

It is a random number and nothing more. Nothing else in the world knows it, so it cannot connect you to anything outside MOSS. Clear your browser data and it is gone for good.

What leaves, and when

Each of these happens only when you press the button for it.

You publish a pad

Publishing puts a pad at a public link that anybody can open. We store the whole pad, which holds your pixels and your brush code, together with the pad name, the display name you chose, your MOSS device name, and your IP address. We keep the IP address to stop floods and to remove a pad that breaks the rules.

A message goes to our private Discord so we can see new work and moderate it. It holds a picture of the pad, the names, the link, your IP address, and the town and country we look up from it.

You submit to a challenge

We store the whole pad, the display name you chose, your MOSS device name, and four counts from the session: how many strokes you made, how long you painted, how long the session ran, and how many brushes you had. The counts rank submissions, so that careful work rises above a single scribble. A message goes to our private Discord for review.

You join the MOSS Studio waitlist

We store your email address, where you signed up, your IP address, and the date. A message goes to our private Discord. We use your address to tell you when the app is out, and for nothing else. Write to hey@brainfruit.studio to come off the list.

You report a pad

We store which pad you reported, why, and your IP address. The IP address stops one person reporting the same pad again and again. It is not shown to the person who made the pad.

What MOSS Sprite never does

• No advertisements
• No third-party analytics, and nothing that measures your visit
• No cookies, and no tracking pixels
• No accounts, no sign-in, no password
• No selling or sharing of your information, to anybody, for any price
• No chat, no comments, and no way to meet other people
• No location, no contacts, and no access to your files beyond the one you open

Nothing we make follows you to other sites.

Who else handles this

These companies act for us. None of them may use your information for anything of their own.

• Vercel hosts moss.town and play.moss.town. Vercel keeps a record of each request, holding the IP address, the time, the page, and the browser type. It keeps the site up and stops attacks, and it goes after one day.
• Railway runs our API server and our database, where published pads, challenge submissions, reports, and waitlist addresses live. Its request log goes after one day.
• Discord shows us new pads, submissions, reports, and waitlist signups so we can moderate and answer.
• ipwho.is turns an IP address into a town and country for those messages. The request goes over HTTPS and asks for the town, the region, and the country only.
• YouTube serves the MOSS Studio trailer on moss.town. The picture of the trailer is ours and loads from our own site. The video loads only when you press play, from youtube-nocookie.com, which sets no advertising cookie.

Nobody else receives anything.

Children

MOSS Sprite is made for everybody, and children use it. We built it so that a child can paint without giving anything away. It asks for no personal information, has no sign-in, shows no advertisements, and has no chat or comments.

Publishing a pad is different, because a person chooses to do it and it puts a drawing at a public link. Parents: if you do not want your child to publish, tell them not to use that button.

If you believe a child sent us something you want removed, write to hey@brainfruit.studio and we will delete it.

How long we keep it

An IP address goes on a timer. The rest is work you chose to put in public, so it stays until you ask us to take it down, or until we take it down.

• A published pad: until you ask us to take it down, or we take it down
• A challenge submission: until we retire the challenge it belongs to, which deletes it
• A report about a pad: as long as we hold the pad it names
• A waitlist address: until the app ships, or until you ask to come off the list
• The row against your device identifier: until you ask us to delete it
• An IP address, wherever we store one: 90 days. A job clears it every night.
• Vercel and Railway request logs: one day each

Write to hey@brainfruit.studio and we will delete anything we hold that came from you. We do not need a reason.

Your choices

• Send us nothing. Paint, export your work to a file, and never press publish or submit.
• Take a published pad down. Write to hey@brainfruit.studio with the link.
• Erase everything here. Clear site data for play.moss.town.

If you live in the European Economic Area, the United Kingdom, or a US state with a privacy law, you can ask us what we hold about you, ask us to correct it, ask us to delete it, and complain to your data protection authority. Write to hey@brainfruit.studio. Please tell us the date and the link, because there is no name on any record and this is the only way we can find it.

For people in the EEA, the UK, and Switzerland: our lawful basis for a published pad, a submission, and a waitlist signup is your consent, and you can take it back at any time. Our lawful basis for keeping an IP address against a publish or a report is our legitimate interest in keeping MOSS safe.

Changes to this page

If we change what MOSS Sprite sends, we will change this page and move the date at the top. If the change is large, we will say so in the app.

Contact

Brainfruit Studio, Inc.
136 E. Rosemary Street, Suite 100
Chapel Hill, NC 27514, USA
hey@brainfruit.studio

Looking for the iPad app? Read the MOSS Studio privacy policy.