Privacy Policy for The Stitch Tracker

About This Policy

The Stitch Tracker ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our mobile application and web service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Password (hashed using bcrypt with per-user salt; plain-text passwords are never stored)
• Shopify Customer ID (if you purchase premium patterns through our Shopify store)

1.2 Pattern Activity Data

To provide personalized features, we collect:

• Pattern views: Which patterns you view and when
• Favorites: Patterns you mark as favorites
• Project tracking: Patterns you start working on and complete
• Source tracking: How you discovered patterns (search, browse, etc.)

This data is linked to your user account to enable features like project history and recommendations.

1.3 Anonymous Search Analytics

We collect search queries WITHOUT linking them to your identity:

• Search query text
• Number of results returned
• Platform (iOS, Android, or web)
• Timestamp of search

1.4 Session Analytics

To understand app usage and improve performance, we collect:

• Session duration (how long you use the app)
• Platform type (iOS, Android, web)
• App open/close times

1.5 Technical Data

We automatically collect:

• Device platform (iOS, Android, web browser)
• IP addresses (stored in Redis for up to 1 hour for rate limiting and abuse prevention only; not retained in our database or backups)

2. How We Use Your Information

2.1 To Provide App Features

• Display your favorite patterns
• Track your project progress
• Show pattern recommendations based on your views
• Remember your preferences

2.2 To Improve Our Service

• Anonymous search analytics: Identify popular patterns and missing content
• Session analytics: Understand how people use the app
• Pattern view analytics: See which patterns are most popular
• Error tracking: Fix bugs and crashes

2.3 Communications

• Send important account notifications (password reset, account changes)
• Respond to your support requests

We do NOT send marketing emails unless you explicitly opt in. If you opt in to marketing communications, you can unsubscribe at any time using the "Unsubscribe" link in any marketing email or by contacting us at the.stitch.patterns.studio@gmail.com.

3. How We Share Your Information

3.1 We Do NOT Sell Your Data

We will never sell, rent, or trade your personal information to third parties for marketing purposes.

3.2 Service Providers

We share data with trusted service providers who help us operate the app:

• Cloud Storage (Cloudflare R2): Pattern images and thumbnails are stored on Cloudflare R2 (S3-compatible cloud storage)
• Database Hosting: User accounts and analytics stored on secure PostgreSQL database
• Email Service (Resend): Sends verification codes and account notifications
• Redis: Temporarily stores IP addresses for rate limiting (typically 1 hour retention)
• Error Tracking: Anonymous crash reports may be sent to error monitoring services

These service providers maintain their own privacy policies and security measures to protect your data.

3.3 Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights and safety.

4. Data Security

We take security seriously and implement industry-standard protections:

• Password encryption: Passwords are hashed using bcrypt (one-way encryption)
• Secure transmission: All data transmitted using HTTPS encryption
• Database security: Production database requires authentication and encryption
• Access controls: Access to user data is restricted to authorized personnel only
• Regular updates: Security patches applied promptly

No system is 100% secure. While we use reasonable security measures, we cannot guarantee absolute security.

5. Data Retention and Deletion

5.1 How Long We Keep Your Data

• Account data: Kept until you delete your account
• Pattern activity: Kept until you delete your account
• Search queries: Retained for up to 2 years for analytics (anonymous, not linked to you)
• Session analytics: Retained for up to 1 year
• Error logs: Retained for up to 90 days

5.2 Account Deletion

You have the right to delete your account at any time.

To delete your account:

1. In-app: Go to Settings → Account → Delete Account → Confirm deletion
2. Via email: Contact the.stitch.patterns.studio@gmail.com with the subject "Account Deletion Request" and we will process it within 48 hours

What happens when you delete your account:

• Your username, email, and password are permanently deleted
• Your favorites, project tracking, and pattern views are deleted
• Your anonymous search queries remain (they're not linked to you anyway)
• Deletion is permanent and cannot be undone

Processing time: Account deletion is immediate. Data is removed from active systems within 24 hours and from backups within 30 days.

6. Your Privacy Rights

Depending on your location, you may have additional rights:

GDPR Legal Basis for Processing (EU/EEA Users)

We process your personal data based on the following legal grounds:

• Performance of a contract: Account creation, authentication, and pattern access
• Legitimate interests: Analytics, fraud prevention, service improvements, and security
• Consent: Marketing communications (where you have opted in)

EU/EEA users have the right to lodge a complaint with their local data protection authority.

6.1 Access Your Data

Request a copy of the personal data we have about you.

6.2 Correct Your Data

Update your email or username in app settings.

6.3 Delete Your Data

Delete your account as described in Section 5.2.

6.4 Object to Processing

Contact us to object to certain data processing activities.

6.5 Data Portability

Request your data in a machine-readable format.

To exercise these rights, contact us at: the.stitch.patterns.studio@gmail.com

California Privacy Rights (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, and share
• Access their personal data
• Request deletion of their personal data
• Opt-out of the sale or sharing of personal information for targeted advertising

We do not sell or share personal information for targeted advertising purposes.

To exercise your CCPA rights, contact us at the.stitch.patterns.studio@gmail.com with the subject "CCPA Rights Request." We will respond within 45 days and verify your identity before processing your request.

7. Children's Privacy

Our app is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18.

If you believe we have collected information from someone under 18, please contact us immediately at the.stitch.patterns.studio@gmail.com and we will promptly delete it.

8. International Users

Our servers are located in the United States. If you access the app from outside this region, your data will be transferred to and processed in the United States.

EU/EEA Users: We rely on our service providers' standard data protection measures, terms of service, and appropriate technical and organizational security measures to protect data transferred from the European Union to the United States. By using the app, you consent to this transfer and processing in accordance with this Privacy Policy.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last Updated" date at the top
• Showing an in-app notification
• Sending an email (if we have your email address)

Your continued use of the app after changes constitutes acceptance of the updated policy.

10. Third-Party Services

Our app may contain links to third-party websites or services. This Privacy Policy does not cover those services. Please review their privacy policies separately.

Third-Party SDKs/Services We Use:

• Capacitor: Mobile app framework (does not collect user data)
• PouchDB/IndexedDB: Local offline storage (data stays on your device)
• Cloudflare R2: Pattern image hosting

11. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or your personal data:

This privacy policy complies with:

• Google Play Store requirements
• GDPR (European Union)
• CCPA (California Consumer Privacy Act)
• General privacy best practices