Privacy

Effective October 28, 2026.

Not Enough Lumber, SpruceShed and sparelumber.com are made by Spare Lumber Studios. Write to us at hello@sparelumber.com. This page covers Not Enough Lumber (notenoughlumber.com and the desktop app), SpruceShed (spruceshed.com, app.spruceshed.com, mcp.spruceshed.com and the SpruceShed desktop app) and sparelumber.com. We run them from the United States.

The short version. We never sell your data and never show ads. We use it only to run, protect and improve our games and apps, and to send our newsletter to people who ask for it. We do not follow you across other websites, and no machine makes decisions about you. We never keep chat, except the lines you send us when you report a player.

What we collect, and why

We’re a very small studio, and the numbers below are how we find out what is broken. Here is each thing, and the reason for it.

How you play, and what your browser tells us. In every country: your country and region; your browser, device and connection (screen size, language, time zone, network provider); the page or link that brought you here; how long you play, which screens and settings you use, and how matches end; errors and crashes; the name you type for online play; and each match’s orders. Why: so we can see what people enjoy and where they get stuck, fix crashes, and replay a match when something goes wrong.

A random ID, kept in a cookie (nel_id) and a copy in your browser’s local storage, and a carry code. Outside the EU, the EEA and the UK only. The cookie lasts 400 days. The copy lasts until you clear your browser’s storage, and it puts the cookie back if it has run out. The carry code is a second random code, shown on the game’s stats screen, that you can type on another device to bring your record with you. Why: so we can count how many people come back, and tell one visit from the next. We may also join visits that look like the same person (the same name on the same network, for example). Why: so one player is not counted twice.

Your IP address and approximate location (city, postal code and a rough map position, as Cloudflare works them out from your address). Outside the EU, the EEA and the UK only. Why: to see roughly where our players are, to chase bugs that depend on the network, and to keep bots from hammering the server.

Device checks. Outside the EU, the EEA and the UK only. The game reads your graphics card and browser details and, on some browsers, draws hidden test images and sounds (Safari-based browsers and Brave skip some of these). Why: some bugs only happen on certain computers, and this is how we find them. It also helps us tell one device from another when we’re counting players.

A visit counter and a small queue of measurements, kept in your browser. Outside the EU, the EEA and the UK only. It holds no ID: just how many times the game has opened here, when you last came, the first race you played, the visit in progress, and measurements waiting to be sent. Why: so we can see how often the game gets played, and so a measurement is not lost if your tab closes or your connection drops.

In the EU, the EEA and the UK (with the Channel Islands, the Isle of Man and Gibraltar, and whenever we cannot tell where you are), the game sets no ID cookie, makes no carry code, runs none of the device checks, keeps nothing about your visits on your device, and keeps no IP address and no city. We still keep what is listed under the first heading above, with nothing that ties one visit to the next.

Newsletter. Your email, when you signed up and your country; outside the EU, EEA and UK also your IP address and game ID. beehiiv sends the emails and handles the confirmation and unsubscribe link. Why: so we can tell you when something new ships.

Feedback and reports. What you type, the game version, your screen size, whether you use touch or a mouse, and the match if you attach it. Outside the EU, the EEA and the UK it is filed with your game ID. A Report on a player sends us the room code, that player’s name and up to the last 10 of their chat lines that you saw. That is the only way chat reaches us, and the player is not told. Why: so we can fix what you tell us about, and look into a player who is spoiling a match.

SpruceShed is invite-only. We keep your invited email and name; what you make there (pictures, picks, marks, notes); when and how long you use it, with your screen size and browser type; and, if you connect an AI app through mcp.spruceshed.com, which app it is and when it last signed in. You sign in through Cloudflare Access with Google or an emailed code. Why: your work has to be saved for you to use it; the usage minutes tell us which parts of SpruceShed help and where it gets in your way.

Buying. If you buy something from us, Paddle is the merchant of record: it sells to you, takes payment and answers for your checkout data under its own notice (paddle.com/legal/privacy). It gives us your name, email and purchase details so we can deliver and support what you bought; we use them for nothing else without asking.

We do this either to give you what you asked for (the game, SpruceShed, the newsletter, a purchase) or because we have a real interest in keeping our games working, safe and getting better. The newsletter is sent only because you signed up, and you can stop it at any time.

Browser storage

We use your browser’s storage (cookies, local storage, IndexedDB, the cache) to keep you signed in to SpruceShed, to remember your saves, settings and name, to recover a match if your tab closes, to finish sending a report if your connection drops, and to load the game faster. Outside the EU, the EEA and the UK we also keep the ID, the carry code, the visit counter and the device-check answers described above. In the EU, the EEA and the UK we keep none of those: nothing about your visits stays on your device. We use no advertising cookies, no social buttons and no third-party analytics, and nothing here follows you to other sites. Clear it in your browser at any time.

Who else gets your data

Cloudflare (hosting, storage, sign-in), Paddle, beehiiv, and Google if you sign in with it. Other players in a match see your name and chat, and anyone you send a replay link to can watch that match. We do not sell your data or share it for advertising. We are in the United States, so what you send us is handled there.

How long we keep it

Your rights

Write to hello@sparelumber.com; we answer within 30 days. You can ask what we hold about you, to correct, delete, limit or object to its use, or to receive a copy, and you can unsubscribe at any time. The game has no accounts, so to find your game data we need your carry code (on the game’s stats screen) or your newsletter email. If you play from the EU, the EEA or the UK, the game keeps nothing tied to you, so unless you gave us your email there is nothing we could find. In the EU, the EEA or the UK you can also complain to your data protection authority (the ICO in the UK). An email is needed only for the newsletter and SpruceShed. The same rights and address apply if you are in California, Canada, Australia or Brazil.

Children

Our games and SpruceShed are not for children under 13 and we do not knowingly collect their data. If you think a child gave us data, write to us and we will delete it.

Do Not Track

We do not follow you across other websites, so a Do Not Track or Global Privacy Control signal changes nothing about what we collect. No other company collects data about your visits to our pages across sites.

Changes

If we change this in a way that matters, we change the date above and say so on the news page.