Privacy Policy

1. Introduction

StitchCraft (crossstitchpatternmaker.app, the data controller, operating under the trade name "StitchCraft") is an online cross-stitch pattern creation platform built for craft lovers and makers. Our core mission is to convert photos into stitchable charts with authentic DMC floss color codes, accurate grid layouts, skein estimates, and printable exports, while providing optional AI assistance for authenticated creators to generate or refine source artwork.

We believe creator privacy and original materials demand genuine respect and protection. This Privacy Policy transparently explains what data we collect, where it is processed, how long it is kept, and how you can exercise your data rights. We adhere to strict data minimisation: whatever can run locally in your browser stays strictly on your device; whatever is uploaded to our servers is limited strictly to what is required to perform the service you request.

2. Information We Collect and Process

We group the data we handle into the following categories:

• Local browser creation data (never uploaded to servers). Our core photo-to-chart pattern conversion runs entirely locally inside your web browser. During direct conversion and editing, your original images, pixel processing calculations, DMC palette matching, and pattern drafts are stored strictly in your browser's local IndexedDB database. During direct pattern conversion, your source photos and chart drafts are never uploaded to our servers.
• Account information. Collected only when you register or sign in: your email address; your display name and avatar if you authenticate via Google or GitHub; or a cryptographically salted and hashed password if you register with email. We never store plaintext passwords.
• AI task data (authenticated users only). AI tools are provided exclusively to signed-in users; we do not offer anonymous guest trials for AI. When you explicitly invoke an AI creation or editing action, your submitted photo, prompt, and style parameters are sent to our server and forwarded to our AI inference partners to generate a single image (costing a fixed 8 credits per run).
• Task and credit ledger records. For every authenticated AI generation, our system maintains a task log: selected tool parameters, execution duration, status, output image URL, and the corresponding ledger entry deducting or refunding 8 credits.
• Billing and payment records. When purchasing a subscription plan or a one-time credit pack, our payment providers (Stripe, Creem, Waffo Pancake, or PayPal) securely process payment details and provide us with a transaction identifier, amount, currency, and timestamp. Sensitive payment card numbers and security codes never touch or reside on our servers.
• Technical logs and aggregated analytics. To maintain availability and guard against security threats, our servers log standard request metadata (IP address, browser User-Agent, and timestamps). We use Google Analytics to monitor aggregated usage events to improve user experience. We do not construct commercial advertising profiles.

We use only essential first-party cookies (session authentication, locale preference PARAGLIDE_LOCALE, theme preference, and marketing attribution utm_source). We do not use third-party advertising cookies or cross-site tracking trackers.

3. How We Use Information

The data we collect is used strictly for legitimate and specified purposes:

• Executing requested AI image generation or modification when you are signed in, deducting the fixed 8 credits per run;
• Creating and authenticating your account and maintaining secure sessions;
• Managing credit ledger balances, processing order records, and automatically refunding credits when a generation experiences technical failures or timeouts;
• Responding to support inquiries and tickets submitted through the in-app portal or support email;
• Defending against security attacks, automated scraping, rate limit violations, and payment fraud;
• Assessing aggregated performance metrics to improve pattern conversion speed and quality.

Our Genuine Commitments:

1. We never use your personal photos or generated cross-stitch patterns to train, fine-tune, or evaluate any public or private AI models.
2. We never sell, rent, lease, or monetize your photos or personal identifiable information.
3. We never use your personal photos for marketing campaigns, public sample galleries, or product demos without explicit written authorization.

4. How Data Is Shared

We share data only with the essential service providers required to operate StitchCraft:

• AI inference providers (Kie.ai, APIMart): Process submitted images and text prompts exclusively when an authenticated user initiates an AI task to produce the requested image.
• Cloudflare: Provides global edge routing, DDoS mitigation, and secure cloud object storage (R2) for temporary storage of AI inputs and outputs.
• Payment providers (Stripe, Creem, Waffo Pancake, PayPal): Handle encrypted payment processing, invoicing, and refunds.
• Resend: Delivers transactional emails, sign-in verification links, and billing receipts.
• Google Analytics: Collects anonymous aggregated traffic analytics.

All third-party vendors are bound by stringent data confidentiality agreements and applicable data protection regulations. We never share data with data brokers or ad networks.

5. Data Retention and Local Storage

We enforce clear lifecycle boundaries for all data:

• AI generation outputs retained on server for 30 days: Images and files generated by authenticated AI tasks are retained on our servers for 30 days so you can review, retrieve, and download them from your generation history. After 30 days, the server automatically purges and permanently deletes these files. Creators should promptly download satisfactory outputs or import them into the studio as local patterns.
• Local pattern drafts: Direct conversion charts and saved projects reside in your browser's local IndexedDB. They remain on your device unless you clear browser storage, browse in private/incognito mode, or switch devices. Because local drafts are not backed up to our servers, please regularly use "Export PDF" or "Export PNG" to store copies on your local drive.
• Account and sign-out policy: Clicking "Sign out" only terminates your active browser session; it does NOT delete or cancel your account or data. Signing out does not delete local drafts, cancel active subscriptions, forfeit credits, or alter task history.
• Account deletion and data requests: Please note that there is no self-service one-click account deletion button in account settings. If you wish to delete your account, remove server-side task logs, or request a complete export of your personal data, please contact our team via an in-app ticket or email support@crossstitchpatternmaker.app.
• Financial records: Billing transactions and invoicing data are retained for statutory periods mandated by applicable tax and accounting laws.

6. Security Measures

We implement multi-layered defenses to safeguard your data:

• All communication is encrypted in transit using modern TLS 1.3/HTTPS protocols.
• Passwords are encrypted one-way using salted hashing algorithms. Server-side API keys and storage credentials reside in secure environment variables and are never transmitted to the browser.
• Cloud object storage assets are protected by cryptographically signed, restricted URLs that prevent unauthorized scanning.
• If a security incident impacting personal data should ever occur, we will notify affected users and regulatory authorities within 72 hours where required by law.

7. Children’s Privacy

StitchCraft is not directed to individuals under 13 years of age (or the minimum legal age in your jurisdiction). We do not knowingly collect personal information from minors. If we learn that personal data of a minor has been inadvertently gathered, we will take prompt reasonable steps to delete it from our servers.

8. Changes to This Privacy Policy

We may update this Privacy Policy to reflect service enhancements or legal requirements. The "Last updated" date at the top of this page indicates the effective date of the current version.

For material changes affecting data collection practices, processing purposes, or creator rights, we will provide at least 14 days advance notice through prominent on-site announcements or email notifications to your registered address, rather than making silent local edits to avoid disclosure duties. Continued use of StitchCraft after changes take effect constitutes acceptance of the revised policy.

9. Your Rights

Under applicable privacy regulations (including the GDPR and CCPA), you hold the following statutory rights regarding your personal information:

• Access and Portability: The right to obtain confirmation of processing and receive a machine-readable copy of your personal data.
• Rectification: The right to correct inaccurate or incomplete personal records.
• Erasure ("Right to be Forgotten"): The right to request deletion of your account and associated server task history (except where retention is legally mandated for tax compliance).
• Restriction and Objection: The right to object to or restrict specific processing operations.
• Withdrawal of Consent: The right to revoke previously granted authorizations at any time.

To exercise any of these rights, email support@crossstitchpatternmaker.app from your registered account address. We typically respond within 3 business days and process verified requests within statutory timeframes.

10. Contact Us

For questions, feedback, content reports, or data privacy requests, contact our privacy team at:

• Email: support@crossstitchpatternmaker.app
• Support Tickets: Available through your account portal when signed in.

11. Legal Basis

Where GDPR or equivalent data protection regimes apply, our legal bases for processing include:

• Performance of Contract: Managing user accounts, maintaining credit ledgers, processing orders, and executing requested AI runs;
• Legitimate Interests: Ensuring network security, preventing fraud, and optimizing conversion performance while respecting creator rights;
• Legal Obligations: Complying with mandatory accounting, tax, and statutory retention standards.