Privacy policy
Who is responsible
Samuel Makin, trading as Stitched Off, United Kingdom, is the controller of the personal data described here. Contact: support@stitchedoff.com.
In short
- Without an account, your patterns and progress stay on your device. Nothing is sent to us.
- If you sign in to sync, we keep your patterns, progress and chart PDFs in your account so your devices can share them. Only you can see them.
- We don't track you, show ads, or sell or share your data for marketing.
What we hold, and why
| Data | When | Why (lawful basis) |
|---|---|---|
| Your email address | When you sign in (with email, or as given by Apple or Google) | To run your account and send sign-in codes (contract) |
| Your user id | When you sign in | To keep your data apart from everyone else's (contract) |
| Device names (e.g. "Sam's iPad") and when each last synced | When a device syncs | To show your devices in Account & sync (contract) |
| Purchase status (whether you have Pro, until when, and whether it is lifetime) | When you buy, renew, cancel or are refunded | To provide Pro on every device (contract) |
| Your patterns' setup, progress (each stitch, with the time and the device), notes, finish-by dates and library settings | When you sync | To sync them between your devices (contract) |
| Your chart PDFs (up to 100 MB each, 5 GB in all) | When you sync | So each pattern opens on your other devices (contract) |
We don't collect your location, contacts, photos, advertising identifiers or usage analytics.
Settings that are about one device (toolbar side, haptics, keep screen awake, marking with finger or Pencil, app icon, reduce transparency, accessibility and reminders) stay on that device.
Who processes it for us
| Processor | What it does | Where |
|---|---|---|
| Supabase | Hosts the database, file storage and sign-in for sync | London (UK), region eu-west-2 |
| RevenueCat | Keeps track of your App Store purchase so Pro works on every device | United States (under the UK International Data Transfer Addendum / standard contractual clauses) |
| Apple (Sign in with Apple, App Store) | Sign-in and payment | Under Apple's own privacy policy |
| Google (Sign in with Google) | Sign-in, if you choose it | Under Google's own privacy policy |
| Resend | Sends the six-digit sign-in codes by email | United States (under appropriate safeguards) |
How long we keep it
- Until you delete your account. Then it is removed from our live systems straight away.
- Copies in backups are overwritten within 30 days.
- Purchase records that Apple and RevenueCat keep for tax and accounting are kept under their own policies.
Deleting your data
In the app: Settings ▸ Account & sync ▸ Delete account. This removes your rows, your PDFs and your sign-in from our servers. The patterns on your devices stay there. You can also email support@stitchedoff.com and ask us to do it.
Your rights
Under the UK GDPR you have the right to:
- see the personal data we hold about you;
- correct it;
- have it deleted;
- restrict or object to how we use it; and
- receive it in a portable form.
Patterns can also be exported from the app at any time. To use these rights, email support@stitchedoff.com. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Children
Stitched Off is not aimed at children under 13, and we don't knowingly hold their data.
Security
Data travels encrypted (HTTPS). Each user's rows and files are kept apart by the database's row-level security, so one account can't read another's. Access tokens are never written to logs.
Changes
If this policy changes in a way that matters, we'll tell you in the app before it applies.
This website
This section covers stitchedoff.com, the website. The rest of this policy covers the app.
Visit counts. We count visits with Umami, a privacy-focused analytics service, run for us by Umami Software on servers in the European Union. It sets no cookies and doesn't track you across other websites. It records the page you visit, the page that sent you, your browser, device type and country, worked out from your IP address, which Umami doesn't store. We can't identify you from it. If your browser sends a "Do Not Track" signal, nothing is counted.
No cookies. The website sets no cookies, so there's no cookie banner. It remembers the help sidebar's scroll position in your browser for the visit only.
Server logs. Our web server keeps no record of visits. Its error log can hold an IP address for a short time when something goes wrong.
The support form. When you send a message, we receive your name, email address, device, app version and message by email through Resend, so we can reply. We keep messages for 12 months after the conversation ends. To stop spam, the form holds your IP address in memory for up to an hour; it is never written down.