Spare Lumber Studios

Privacy

Effective November 1, 2026.

Not Enough Lumber, SpruceShed and sparelumber.com are made by Spare Lumber Studios, which is responsible for the personal data described here (in EU and UK law, the “controller”). Write to us at hello@sparelumber.com. This page covers Not Enough Lumber (notenoughlumber.com and the desktop app), SpruceShed (spruceshed.com, app.spruceshed.com, mcp.spruceshed.com and the SpruceShed desktop app) and sparelumber.com. We run them from the United States.

The short version. We never sell your data and never show ads. We use it only to run, protect and improve our games and apps, and to send our newsletter to people who ask for it. We do not follow you across other websites, and no machine makes decisions about you. We never keep chat, except the lines you send us when you report a player.

We do this for one of three reasons. To give you what you asked for: online play, saving your SpruceShed work and signing you in to it, and delivering and supporting a purchase. Because you said yes: the game’s newsletter and SpruceShed news, which you can stop at any time. Because we have a real interest in keeping our games and apps working, safe and getting better: everything else on this page, such as statistics, error and crash reports, match records, feedback and reports on players. You can object to that at any time (see “Your rights”).

sparelumber.com and spruceshed.com set nothing on your device except the appearance choice under “Browser storage”. Apart from an email you leave for SpruceShed news, all we keep of your visits to them is Cloudflare’s daily count of page requests, by page, country and type of device, which names no one.

Not Enough Lumber

We’re a very small studio, and the numbers below are how we find out what is broken. Here is each thing, and the reason for it.

How you play, and what your browser tells us. In every country: your country and region; your browser, device and connection (language, time zone, network provider); the page or link that brought you to the game; how long you play, which screens you use, and how matches end; errors and crashes; the name you type for online play; and each match’s orders. Outside the EU, the EEA and the UK, also your screen size and which settings you use. Why: so we can see what people enjoy and where they get stuck, fix crashes, and replay a match when something goes wrong.

A random ID, kept in a cookie (nel_id) and a copy in your browser’s local storage, and a carry code. Outside the EU, the EEA and the UK only. The cookie lasts 400 days. The copy lasts until you clear your browser’s storage, and it puts the cookie back if it has run out. The carry code is a second random code, shown on the game’s stats screen, that you can type on another device to bring your record with you. Why: so we can count how many people come back, and tell one visit from the next. We may also join visits that look like the same person: the same name on the same network, the same newsletter email, or the same network on several different days with a similar way of playing. Why: so one player is not counted twice.

Your IP address and approximate location (city, postal code and a rough map position, as Cloudflare works them out from your address). Outside the EU, the EEA and the UK only. Why: to see roughly where our players are, to chase bugs that depend on the network, and to keep bots from hammering the server.

Device checks. Outside the EU, the EEA and the UK only. The game reads your graphics card and browser details and, on some browsers, draws hidden test images and sounds (Safari-based browsers and Brave skip some of these). Why: some bugs only happen on certain computers, and this is how we find them. It also helps us tell one device from another when we’re counting players.

A visit counter and a small queue of measurements, kept in your browser. Outside the EU, the EEA and the UK only. It holds no ID: just how many times the game has opened here, when you last came, the first race you played, the visit in progress, and measurements waiting to be sent. Why: so we can see how often the game gets played, and so a measurement is not lost if your tab closes or your connection drops.

In the EU, the EEA and the UK (with the Channel Islands, the Isle of Man and Gibraltar, and whenever we cannot tell where you are), the game sets no ID cookie, makes no carry code, runs none of the device checks, keeps nothing about your visits on your device, and keeps no IP address and no city. We still keep what is listed under “How you play, and what your browser tells us” above, with nothing that ties one visit to the next.

Statistics. While you play, the game sends us counts and measurements, so we can fix problems and make the game better. For example: how long a visit lasts, which screens and match types are used, how a match ends, errors and crashes, the page or link that brought you to the game, the type of browser and device you use, and roughly where you are: your country and region, your time zone and your network provider. If you are in the EU, the EEA or the UK, the game sets no ID cookie and makes no carry code, runs none of its device checks, keeps nothing about your visits on your device, and we keep neither your IP address nor your city or exact location.

Your choice. In Settings, open Advanced and set Statistics to Off. The game then sends no statistics from that device, and it remembers your choice until you clear notenoughlumber.com’s stored data in your browser. Off does not stop what playing online needs: your moves go to the other players, and our server still notes that an online match happened (the name you typed, your race, roughly where you are, and when and how your connection ended), and counts the connection’s messages, reconnects and timing. Anything you choose to send us, such as a report, still arrives. You will see the switch if you are in the EU, the EEA or the UK, or if we cannot tell where you are.

Newsletter. Your email, when you signed up, where on our site you did it, the game version and your country; outside the EU, EEA and UK also your IP address and game ID (signing up gives your browser a game ID if it has none). beehiiv sends the emails and handles the confirmation and unsubscribe link. beehiiv tells us whether an email was opened and which links were clicked. Why: so we can tell you when something new ships.

Feedback and reports. What you type, the game version, your screen size, whether you use touch or a mouse, and the match if you attach it. Outside the EU, the EEA and the UK it is filed with your game ID. A Report on a player sends us the room code, that player’s name and up to the last 10 of their chat lines that you saw. That is the only way chat reaches us, and the player is not told. Why: so we can fix what you tell us about, and look into a player who is spoiling a match.

The sections after SpruceShed’s, from Buying to Changes, are about Not Enough Lumber too.

SpruceShed

SpruceShed is invite-only. We keep the email and name you were invited with; what you make there (pictures, picks, marks, notes); when and how long you use it, with your screen size and the browser and system you use; and, if you connect an AI app through mcp.spruceshed.com, which app it is and when it last signed in. You sign in through Cloudflare Access with Google or an emailed code. Why: your work has to be saved for you to use it; what you make and how long you spend tell us which parts of SpruceShed help and where it gets in your way.

To load faster, SpruceShed keeps the pictures it has already made from your characters while your account exists. Delete a character and its pictures go with it; delete your account and they all go.

SpruceShed news. If you leave your email on spruceshed.com: that email and the day you gave it, and nothing else. It is kept apart from the game’s newsletter. Why: so we can write when there is news about SpruceShed.

Buying

If you buy something from us, Paddle is the merchant of record: it sells to you, takes payment and answers for your checkout data under its own notice (paddle.com/legal/privacy). It gives us your name, email and purchase details so we can deliver and support what you bought; we use them for nothing else without asking.

Browser storage

We use your browser’s storage (cookies, local storage, IndexedDB, the cache) to keep you signed in to SpruceShed, to remember your saves, settings and name, to recover a match if your tab closes, to finish sending a report if your connection drops, and to load the game faster. Outside the EU, the EEA and the UK the game also keeps the ID, the carry code, the visit counter and the device-check answers described under Not Enough Lumber above. In the EU, the EEA and the UK it keeps none of those: nothing about your visits to the game stays on your device. Where our pages offer a choice of System, Light or Dark (at the foot of the page on our websites, never inside the game itself, and in SpruceShed’s Help), choosing Light or Dark makes your browser keep that one word on your device, under the name “appearance” in that site’s local storage, so that site’s pages open the way you chose. It is never sent to us. Choosing System on that site deletes it there, and so does clearing that site’s storage in your browser. A link from one of our sites to another can carry that choice after the “#” in its address, a part your browser never sends to any server. If the site you arrive on offers the choice, it then keeps it the same way. This works for any link to such a site whose address ends in “#appearance=light” or “#appearance=dark”, wherever you found the link. We use no advertising cookies, no social buttons and no third-party analytics, and nothing here follows you to other companies’ sites. Clear it in your browser at any time.

Who else gets your data

Cloudflare runs our sites, servers and storage, and SpruceShed’s sign-in. beehiiv sends the game’s newsletter. Paddle sells to you when you buy, under its own notice. Google signs you in to SpruceShed if you choose it, and hosts our mailbox, so email you send us is kept there. If you connect an AI app to SpruceShed, the app can read your SpruceShed work and add to it while it is connected, under its maker’s own policy. Other players in a match see your name and chat, and anyone you send a replay link to can watch that match. We do not sell your data or share it for advertising. We are in the United States, so what you send us is handled there.

How long we keep it

Your rights

Write to hello@sparelumber.com; we answer within 30 days. Any of our addresses reaches us; for SpruceShed, write from the email you were invited with, so we know the account is yours. You can ask what we hold about you, to correct, delete, limit or object to its use, or to receive a copy, and you can unsubscribe at any time. The game has no accounts. Outside the EU, the EEA and the UK, we find your game data by your carry code (on the game’s stats screen) or your newsletter email. Inside them, the game sets no ID cookie and makes no carry code, so tell us the name you typed and roughly when you played (and the room code, if you played online and still have it), and we will look for your matches; anything tied to your email we find by your email. In the EU, the EEA or the UK you can also complain to your data protection authority (the ICO in the UK). An email is needed only for the newsletter and SpruceShed. The same rights and address apply if you are in Switzerland, California, Canada, Australia or Brazil, and asking never changes how we treat you.

Children

Our games and SpruceShed are not for children under 13 and we do not knowingly collect their data. If you are under 16, ask a parent or guardian before you sign up for a newsletter. If you think a child gave us data, write to us (what to send is under “Your rights”) and we will delete it.

Do Not Track

We do not follow you across other websites, so a Do Not Track or Global Privacy Control signal changes nothing about what we collect. No other company collects data about your visits to our pages across sites.

Changes

If we change this in a way that matters, we change the date above and say so on Not Enough Lumber’s news page. If the change is about SpruceShed, we also email everyone who has a SpruceShed account.