Privacy Policy

When you use Studio without an account, your uploaded photo and draft are processed on your device and may be stored in that browser’s IndexedDB so the draft can survive a reload.

When you sign in and save, your email address, account credential record, project settings, generated pattern, and source photo are stored in our PostgreSQL database so the same project URL can open on your other devices.

If you choose Google sign-in, Google provides an immutable account subject, your verified email address, and basic profile information so we can create or link your Stitch Craft Master account. We request only openid, email, and profile; we do not receive your Google password or store Google access or refresh tokens.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google identity information is used only for authentication, account security, and the account controls described here.

First-party aggregate product counters record totals such as patterns generated, stitches mapped, cloud projects saved, Pro exports created, and animation playback starts. These totals contain no user ID, email, IP address, project ID, project name, filename, image, or pattern content. Random idempotency receipts prevent duplicate counting and are retained for up to 30 days.

Google Analytics is optional. Its script does not load and no analytics data is sent until you explicitly allow analytics. If enabled, we send sanitized page categories without account, Google, project, image, filename, or pattern identifiers. Advertising storage, Google Signals, advertising user data, and ad personalization remain disabled. You can change or revoke this choice from Cookie preferences in the footer.

Resend processes your email address and transactional message content to deliver verification and password-reset emails. Paddle processes checkout, tax, payment, invoice, and subscription information as our Merchant of Record. Google processes identity information when you choose Google sign-in and analytics information only after analytics consent.

Stitch Craft Master receives subscription identifiers and status from Paddle, but does not receive or store your full payment-card number.

We use essential session and CSRF cookies for account security. Theme, language, anonymous drafts, consent choice, and resume instructions may be kept in browser storage. The application does not require advertising cookies. If analytics is allowed, Google Analytics may set measurement cookies for up to 13 months; revoking consent disables collection and removes accessible Google Analytics cookies from this site.

Cloud projects remain available until you delete them or request account deletion. Security credentials expire according to their stated lifetimes: reset links after one hour, verification links after one day, idle sessions after seven days, and sessions after no more than 30 days. Billing and security records may be retained when required for fraud prevention, accounting, tax, dispute resolution, or legal obligations.

You may request access, correction, export, unlinking of Google identity, or deletion of your account data by contacting support. We aim to complete verified deletion requests within 30 days unless a legal exception requires limited retention. Deleting browser data removes anonymous drafts and preferences only from that browser.

Production browser traffic uses HTTPS, passwords are protected with Argon2id, and project access is restricted to the signed-in owner. No system can promise absolute security, so please use a unique password.

The service is not directed to children under 16. A parent or guardian should contact us if they believe a child supplied personal data.