Privacy Policy

Last updated: 27 September 2026

This policy explains what personal information Cross Stitch Pattern Creator ("we", "us") collects when you use crossstitchpatterncreator.com (the "Service"), why we collect it, how long we keep it, and the rights you have.

1. Who we are

Cross Stitch Pattern Creator is run by an independent developer. For anything about your personal information, email support@crossstitchpatterncreator.com. We reply within 2 business days.

2. Personal information we collect

We collect only the information below. Your photos and patterns are not collected: photo conversion runs in your browser, and patterns are saved in your browser unless you buy one (see "Purchase records").

Account information. If you sign in, your email address and name. With Google sign-in, Google also shares your profile picture. There are no passwords: you sign in with Google or with a link sent to your email.
Purchase records. When you buy a printable pattern, your email address, the order and checkout ids, the amount and currency, and the pattern id. We also keep a copy of the pattern file you bought, so the link in your purchase email can download it again on any device. Full card numbers are not stored by us — card data is processed by our payment processor.
Communications. Emails you send to support, and the replies.
Information collected automatically. When you sign in, the IP address and browser (user agent) of that session. Our hosting provider records server request logs (IP address, browser, operating system, page requested and time). We record anonymous product events, such as "a pattern was generated" or "a PDF was downloaded", with the pattern size; these contain no name, email, IP address or user id.

3. How we use information

Purpose	Legal basis
Providing the Service: converting, saving and exporting patterns, keeping you signed in	Contract
Billing and payment, and restoring a purchase	Contract
Customer support	Contract / Legitimate interests
Service notifications, such as the email with your download link	Legitimate interests
Security and fraud prevention	Legitimate interests
Product analytics from anonymous events, to improve the tools	Legitimate interests
Keeping records required by tax and accounting law	Legal obligation

We do not send marketing email. If we ever do, it will be only with your consent (legal basis: your consent).

4. Cookies and similar storage

Strictly necessary (cannot be switched off): a sign-in session cookie, and a short-lived cookie that protects the Google sign-in step. They are set only when you sign in.
Functional (in your browser only, never sent to us): your saved patterns, a small copy of the photo used for the editor's photo overlay, and a record of patterns you unlocked. Clearing this site's data in your browser removes them.
Analytics and marketing: none. There are no advertising cookies and no third-party analytics scripts.

See the cookie policy. You can remove cookies and stored data at any time in your browser settings.

We do not sell your personal information, including as defined under applicable laws such as the CCPA.

We share information only with the service providers that run the Service, and only what each one needs:

Waffo Pancake — payment processing. Payment card data is processed exclusively by our PCI-DSS certified payment processor, Waffo Pancake, and is not stored on our servers.
Cloudflare — hosting, database and server logs.
Resend — sending sign-in and purchase emails.
Google — sign-in, if you choose "Sign in with Google".

We may disclose information when the law requires it, or to protect the Service and its users from fraud or abuse.

6. Data security

All traffic is encrypted in transit with TLS (HTTPS).
Sign-in sessions are signed, and email sign-in links expire after 5 minutes. We store no passwords.
Access to the database and service accounts is limited to the operator of the Service.
We review access, dependencies and security settings regularly.
If a data breach affects your personal information, we will notify you and the relevant authority within 72 hours of becoming aware of it, where the law requires.

7. Data retention

Data	How long we keep it	How it ends
Account information	Until you delete your account	Deleted immediately when you delete the account in Settings, or within 30 days of an email request
Sign-in sessions (IP address, browser)	7 days after the session was last used	Session expires and is removed
Purchase records (email, order, amount, pattern id)	7 years after the purchase	Kept for tax and accounting law, then deleted
Pattern file kept with a purchase	As long as the purchase record, so re-download keeps working	Deleted with the record, or earlier on request
Pattern copy for a checkout that was not paid	7 days	Deleted automatically
Support emails	2 years after the last message	Deleted
Server request logs	Up to 7 days	Deleted automatically by our hosting provider
Anonymous product events	24 months	Deleted

8. Your data rights, and how to use them

You can see, correct, download and delete your personal information, and close your account, at any time.

See your data. Sign in and open Your account: it shows the email you are signed in with and every pattern you bought. Your name is in Settings → Profile. For a full copy of everything we hold about you, email us and we will send it as a JSON file.

Correct your data. Change your name in Settings → Profile. To change the email on your account or on a purchase, email us from the old address.

Delete your data. Email us to delete any of it, for example the pattern file kept with a purchase. We delete everything we are not required by law to keep (see section 7).

Close your account. Go to Settings → Security and choose Delete account. Your account information and sign-in sessions are deleted at once. Purchase records are kept for the period required by tax law (section 7) but are no longer linked to a sign-in. You can also ask us by email to close the account for you.

Patterns saved in your browser. These never reach us. Delete them in Your patterns, or clear this site's data in your browser settings.

Under data protection laws such as the GDPR and the CCPA you also have the right to be informed about how your data is used (this policy), to restrict or object to processing based on legitimate interests, to receive your data in a portable format, and to withdraw consent at any time where processing is based on consent.

How we respond. Email support@crossstitchpatterncreator.com from the address you used with us, so we can confirm it is you. We reply within 30 calendar days, and there is no charge. If you are not satisfied with our answer, you can complain to your local data protection authority.

9. Marketing and opt-out

We do not send marketing email. Emails you receive from us are sign-in links and purchase emails, which are needed to provide the Service. If we add marketing email in the future, it will be opt-in, and you will be able to opt out: click "Unsubscribe" in any email, turn marketing off in your account settings, or contact us. Opting out does not affect essential service notifications (e.g., billing, security alerts).

10. International data transfers

Our service providers process data in the United States, the European Union and other countries where they operate. When information is transferred out of your country, we rely on the providers' data processing agreements incorporating EU Standard Contractual Clauses (SCCs), or on adequacy decisions, to protect it.