TH3RANCH.ONLINE ("the Site," "we," "us," or "our") is an independent fan website created and operated by Nathan Crandell (Th3Ranch). The Site provides Fortnite-related community tools, including Sprite collection tracking, profile features, community highlights, and Fortnite-related news or fan content.
This Site is not affiliated with, sponsored by, endorsed by, or officially connected to Epic Games, Inc., Fortnite, or any Epic Games product or service. Fortnite-related names, trademarks, logos, images, characters, items, and other game-related materials belong to their respective owners.
This page contains our Privacy Policy, Cookie Notice, Children’s Privacy Notice, and Terms of Use. By using the Site, creating an account, submitting information, uploading an avatar, using the Sprite Tracker, or sharing a collection link, you agree to these terms. If you do not agree, do not use the Site or create an account.
The Site is operated by Nathan Crandell (Th3Ranch). For privacy questions, account deletion requests, child-safety concerns, copyright concerns, or other legal requests, contact us using the information in Section 20.
Operator contact information:
Nathan Crandell (Th3Ranch)
10 W Boscawen St, Ste 22, Winchester, VA 22601
Phone: 540-214-9682
Email: info@th3ranch.online
For privacy-law purposes, the operator of this Site is the party responsible for deciding what personal information is collected and how it is used. Some privacy laws refer to this role as a “controller,” “business,” or “organization.”
This Site is intended for users who are at least 13 years old. If you are under 13, you may not create an account, submit a gamertag, upload an avatar, provide social links, use share features, or submit personal information to the Site.
By creating an account or using account-based features, you confirm that you are at least 13 years old. If you are under the age of majority where you live, you should use the Site only with permission from a parent or legal guardian.
If you are located in the European Economic Area, United Kingdom, Switzerland, or another region with a higher digital-consent age, you should not use optional account or profile features unless you are old enough to consent under your local law or have permission from a parent or legal guardian.
We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will delete the information and associated account as promptly as reasonably possible.
We try to collect only the information needed to operate the Site, protect accounts, provide the Sprite Tracker, and support optional community features.
4.1 Account Information Provided by You
4.2 Optional Profile Information
If you choose to complete your profile, you may provide:
Profile fields are optional. Per-field visibility defaults to "off" (private) for new accounts. Existing accounts with data stored before July 2026 retain their prior visibility setting. Do not include sensitive personal information in your display name, avatar, bio, social handles, gamertag, or any public area of the Site.
4.3 Sprite Tracker and Site Feature Data
sprite_uid):
A randomly generated identifier stored in a browser cookie
so the Sprite Tracker can save progress before you create an account.
If you register, this ID is linked to your account
so your pre-registration progress is preserved.
4.4 Automatically Collected Technical Data
Like most websites, our hosting provider and server software may automatically process technical information when you access the Site, including:
We use this information for site security, troubleshooting, abuse prevention, and basic server operation. We do not use it for targeted advertising.
For rate limiting (for example, preventing excessive login attempts), our application stores a one-way SHA-256 hash of your IP address combined with the action being rate-limited. We never store your raw IP address in our application data; the hash is used only for counting and cannot be reversed to identify you. Rate-limit records are deleted after 7 days.
4.5 Information We Do Not Intentionally Collect
We do not intentionally collect, and you should not submit:
We use collected information for the following purposes:
We do not sell personal information. We do not use personal information for targeted advertising. We do not knowingly share personal information with third parties for their own marketing purposes.
If you are located in the European Economic Area, United Kingdom, Switzerland, or another region with similar privacy laws, we process personal information only when we have a recognized legal basis to do so.
| Processing Purpose | Types of Information | Legal Basis |
|---|---|---|
| Creating and managing your account | Gamertag, password hash, account date, login session | Performance of a contract (Article 6(1)(b)) |
| Saving Sprite Tracker progress | Sprite collection data, anonymous visitor ID, account ID | Performance of a contract or legitimate interests (Article 6(1)(b)/(f)) |
| Age verification / date of birth | Date of birth, verification timestamp | Legal obligation — COPPA compliance (Article 6(1)(c)) |
| Displaying optional profile information | Display name, avatar, bio, social links | Consent — you choose to make each field public (Article 6(1)(a)) |
| Functional cookies (sprite_uid) | Browser-linked anonymous visitor ID | Consent — via the cookie preference dialog (Article 6(1)(a)) |
| Community features (comments, messages, clips, trades) | Content you submit, associated gamertag and timestamp | Performance of a contract / legitimate interests (Article 6(1)(b)/(f)) |
| Twitch live-status check | Twitch username (if provided); no viewer data collected | Legitimate interests — displaying live status to the community (Article 6(1)(f)) |
| Security, fraud prevention, and abuse prevention | Technical logs, session data, account activity | Legitimate interests and legal compliance (Article 6(1)(c)/(f)) |
| Responding to privacy, child-safety, legal, or support requests | Information you provide in your request | Legal obligation / legitimate interests (Article 6(1)(c)/(f)) |
Where processing is based on consent, you may withdraw your consent at any time. Withdrawing consent does not affect processing that occurred before withdrawal.
Some Site features are public or semi-public by design. When you create a profile, your gamertag and display name appear on your public profile page. Your avatar, bio, Sprite collection, gaming IDs, social handles, and wishlist are only displayed if you explicitly enable them using the per-field “Show on profile” toggles in account settings.
Per-field visibility controls: Each gaming ID (Epic Games, Xbox, PlayStation, etc.) and each social handle (TikTok, Instagram, Discord, YouTube, Twitter/X, Twitch) has its own checkbox in your account settings. When the checkbox is unchecked, the field is stored in your account but never shown on your public profile or directory listing. You can change these settings at any time.
Directory listing: By default, logged-in members appear in the Community directory. You can opt out of the directory entirely using the “Hide me from the Community directory” toggle in account settings. Your profile can still be viewed via direct link even when directory-hidden.
Member messaging: Other logged-in members can send you messages by default. You can disable this using the “Allow messages from other members” toggle in account settings. When disabled, only administrators can message you.
Sprite collection sharing: The Sprite Tracker includes a “Share” feature that generates a read-only URL for your collection. Anyone with the URL can view your collection in read-only mode. Treat share links as semi-private: do not post them publicly unless you want others to see the collection.
Wishlist sharing: Your Item Shop wishlist is private by default. You can make it publicly visible on your profile by enabling the “Share my wishlist” toggle in account settings.
If you want to remove publicly visible information, update your account settings or edit your profile directly. For deletion assistance, use the Privacy Request form or the self-service account deletion in your account settings.
We use cookies and similar browser storage only as needed to operate the Site, maintain login sessions, save Sprite Tracker progress, and protect the Site. We do not use advertising cookies, targeted advertising cookies, third-party analytics cookies, or social media tracking pixels.
| Cookie or Storage Item | Purpose | Duration | Type |
|---|---|---|---|
PHPSESSID |
Keeps you logged in and maintains your session
between page loads. Set with HttpOnly,
Secure, and SameSite=Lax flags.
Sessions expire after 2 hours of inactivity
or 24 hours absolute, whichever comes first.
|
Session; cleared on logout, 2-hour inactivity, or 24-hour absolute expiry. | Strictly necessary |
sprite_uid |
Links your browser to Sprite Tracker progress,
including before account creation. Set with
HttpOnly, Secure,
and SameSite=Lax flags.
|
Up to 365 days, unless deleted earlier. | Functional / strictly necessary for tracker persistence |
cookie_notice_dismissed (localStorage) |
Records that you dismissed the cookie notice banner.
Stored in browser localStorage,
not transmitted to our server.
|
Persists until browser storage is cleared. | Functional / user preference |
You can disable or delete cookies in your browser settings. If you do, login features may not work, and Sprite Tracker progress may be lost if it is not connected to an account.
If we later add analytics, advertising, embedded social widgets, or other non-essential cookies, we will update this policy and, where required, request consent before using those technologies.
The Site uses a limited number of third-party services to host the Site and display game-related content. These third parties may process technical information according to their own policies.
We are not responsible for the privacy, security, or content practices of third-party websites or services that we do not control.
Account data is stored in JSON files on our web hosting server (Hostinger). Avatar images are stored as files on the server. The data directory is blocked from direct web access. Server logs and backups may also be created by our hosting environment.
We implement the following technical and organizational security controls:
max-age, includeSubDomains,
and preload directives.
password_hash()
(bcrypt, cost 12). We do not store plain-text passwords.
Passwords are accepted up to 1,024 characters in length.
HttpOnly,
Secure, and SameSite=Lax flags.
Session strict mode and cookie-only session IDs are enforced.
Session IDs are regenerated on login to prevent session fixation.
Sessions expire after 2 hours of inactivity
or 24 hours absolute, whichever comes first.
libmagic),
dimension, and file size. GIF uploads are rejected.
All accepted images are re-encoded through PHP GD, which strips EXIF
metadata and any embedded content, resizes to a maximum of 512×512 pixels,
and saves as JPEG at 85% quality. The file is stored using
a server-generated random filename; the original uploaded filename
is discarded.
avatars/
and clips/ directories via .htaccess rules.
Direct web access to the data directory is blocked entirely.
javascript:,
data:, vbscript:)
are detected and rejected.
No website or internet transmission is completely secure. We cannot guarantee absolute security. You are responsible for using a strong, unique password and keeping your login credentials safe.
10.1 Retention
We run automatic retention enforcement nightly. The following periods apply:
| Data Type | Retention Period |
|---|---|
| Account information, profile, and Sprite Tracker data | Until you delete your account or we receive a verified deletion request. Self-service deletion is available in account settings. |
| Anonymous Sprite Tracker data (no associated account) | 90 days after the last browser session that modified the data. |
| Activity signals (live-visitor pings) | Individual entries: 7 days. Files with no recent activity: 30 days. |
| Rate-limit records | 7 days. |
| Contact-form messages (read) | 90 days after being marked as read. |
| Admin audit logs | 12 months. |
| Privacy request records | 12 months after the request is marked completed or denied. |
| PHP session data | 2 hours of inactivity or 24 hours absolute; controlled by server session configuration. |
| Server access and error logs | Controlled by our hosting provider (Hostinger). Verify current retention in their documentation. |
| Hosting backups | Controlled by our hosting provider. Deleted account data may persist in backups for a limited backup cycle before being overwritten. We will not intentionally restore deleted personal data except for security, legal, or disaster-recovery purposes. |
The Site may be accessed from the United States, Canada, Europe, and other regions. The Site and its service providers may process information in countries other than where you live. Privacy laws in those countries may differ from the laws in your location.
If you access the Site from the European Economic Area, United Kingdom, Switzerland, Canada, or another region with data-transfer requirements, you understand that your information may be transferred to and processed in the United States or other countries where our hosting provider, service providers, or technical infrastructure operate.
Where required, we rely on appropriate safeguards, service-provider commitments, contractual protections, or other lawful transfer mechanisms for international processing.
Depending on where you live, you may have privacy rights under laws such as the GDPR/UK GDPR, Canadian privacy laws, California privacy law, Virginia privacy law, or other U.S. state privacy laws. Even where a specific law does not legally apply to us, we will make reasonable efforts to honor basic privacy requests.
Your rights may include:
doNotSell flag applied to their account immediately.
California Shine the Light (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their direct marketing purposes. California residents do not need to submit a request to opt out of such sharing because we do not engage in it.
How to exercise your rights: The fastest way is to use the Site's built-in tools:
We aim to respond to privacy requests within 30 days. If more time is needed, we may notify you where required by law.
Supervisory authority (EEA / UK / Switzerland): If you are in the European Economic Area, United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection authority (DPA) if you believe we have processed your personal information unlawfully. A directory of EU DPAs is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk. We encourage you to contact us first so we can address your concern directly.
Data breach notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by applicable law. Where the breach is likely to result in a high risk to you, we will also notify affected users directly without undue delay, using the contact information associated with your account or a prominent site notice.
The Site is not directed to children under 13, and users under 13 may not create accounts or submit personal information. We do not knowingly collect personal information from children under 13.
During registration, users are required to provide their full date of birth. We use this to verify that you meet the minimum age of 13. Accounts found to belong to users under 13 are immediately locked and all associated personal information is deleted as promptly as reasonably possible. Providing a false date of birth to bypass the age requirement violates these Terms of Use.
If we learn that we have collected personal information from a child under 13, we will take reasonable steps to:
Parents or legal guardians who believe a child under 13 has created an account should contact us immediately using the information in Section 20 and include “COPPA Request” in the subject line or message.
These Terms of Use govern your access to and use of the Site. By using the Site, you agree to follow these Terms and all applicable laws.
14.1 Account Responsibility
14.2 Site Availability
We may modify, pause, restrict, or discontinue any part of the Site at any time. We are not required to keep any feature, collection tracker, profile, news feed, image, external integration, or account system available permanently.
14.3 Account Suspension or Deletion
We may suspend, restrict, or delete accounts that violate these Terms, create security risks, abuse the Site, infringe intellectual property rights, harass others, attempt to bypass age restrictions, or otherwise create legal or safety concerns.
The Site’s original layout, code, text, design elements, community features, and non-Epic branding are owned by the Site operator or used with permission, unless otherwise stated.
Fortnite-related names, images, icons, characters, cosmetics, items, game references, trademarks, and other game assets are owned by Epic Games, Inc. or their respective owners. They are used for fan commentary, reference, identification, collection tracking, and community discussion.
Nothing on this Site gives you ownership of Fortnite, Epic Games trademarks, third-party trademarks, third-party images, or other intellectual property owned by others.
If you are a rights holder and believe content on the Site infringes your rights, contact us using the information in Section 20 and include enough detail for us to identify and review the content.
User content may include gamertags, display names, avatars, bios, social links, Sprite Tracker data, and any other information or material submitted to the Site.
You are responsible for the content you submit. You represent that you have the rights needed to submit your content and that your content does not violate the rights of others or these Terms.
By submitting user content, you grant us a non-exclusive, worldwide, royalty-free license to host, store, display, reproduce, resize, format, and use that content only as needed to operate, display, protect, and improve the Site and its features.
You may remove optional profile content by editing your account, where those tools are available, or by contacting us for deletion assistance.
You agree not to use the Site to:
We may remove content, restrict features, or delete accounts that violate this section.
The Site is provided on an “as is” and “as available” basis. We do not guarantee that the Site will be uninterrupted, error-free, secure, accurate, or available at all times.
Fortnite news, item information, Sprite information, images, and related content may be incomplete, outdated, inaccurate, delayed, or dependent on third-party sources. The Site is for fan, entertainment, and community purposes only.
To the maximum extent permitted by law, we are not liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for loss of data, account access, collection progress, reputation, goodwill, profits, or other losses arising from use of the Site.
Some jurisdictions do not allow certain limitations of liability, so some of these limitations may not apply to you. Nothing in these Terms limits rights that cannot be limited under applicable law.
We may update this Privacy Policy, Cookie Notice, Children’s Privacy Notice, and Terms of Use from time to time. When we make changes, we will update the effective date at the top of this page.
If changes are material, we may provide additional notice through the Site where reasonably practical. Continued use of the Site after changes are posted means you accept the updated terms. If you do not agree, stop using the Site and request deletion of your account if desired.
We will not intentionally apply material privacy changes retroactively in a way that significantly reduces your rights over previously collected personal information without taking steps required by law.
If you have questions, want to exercise privacy rights, need to report a child-safety concern, want to request account deletion, or believe content on the Site violates your rights, contact us:
For child-safety or COPPA-related requests, include “COPPA Request” in your message. For account deletion requests, include your gamertag or username so we can identify the account. We may ask for additional information if needed to verify that you control the account or are the parent/legal guardian of a minor account holder.
We aim to respond to privacy-related requests within 30 days. Child-safety requests will be prioritized and handled as promptly as reasonably possible.
We use cookies to keep you logged in and remember your Sprite Tracker collection between visits. Choose which cookies you allow below. Cookie Policy
Required for the site to function. These cannot be disabled.
PHPSESSID — keeps you logged in during your session (2 hr / 24 hr max)Remembers your Sprite Tracker data between visits so you don’t lose your collection when you close the browser.
sprite_uid — links your browser to your Sprite Tracker data (365 days)