POLICY // PRIVACY
Privacy Policy
Threadworks — Effective date: 31 July 2026
Overview
Threadworks is a cross-stitch pattern editor for Android, iOS and the web. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
We are the data controller for the personal data described here. This policy is written to meet our obligations under the UK GDPR and the EU GDPR.
You can use most of Threadworks without giving us your name or email address. Those are only needed if you create an account.
The data we collect
DATA YOU GIVE US
| Data | When | Why |
|---|---|---|
| Email address | When you create an account or sign in | To create and secure your account, and to send you the one-time sign-in code |
| First and last name | When you create an account | To personalise the app and identify you on patterns you publish |
| Marketing preference | At sign-up, changeable any time in Settings | To know whether you want promotional email |
| Your designs, patterns and stitch progress | While you use the app | To save your work and, if you have Threadworks+, sync it between your devices |
| Reference photographs | If you import a photo to convert into a pattern | To generate your pattern. If you have sync enabled, these images are uploaded to our cloud storage |
| Published patterns | If you choose to publish or share a pattern | To make the pattern available to whoever you share the link with |
AUTOMATICALLY COLLECTED
| Data | Why |
|---|---|
| Device identifier and device model | To enforce the Threadworks+ two-device limit and to let you see which devices are signed in |
| Session identifier | To keep you signed in and let you revoke access on a lost device |
| Purchase and subscription records, including store transaction identifiers | To deliver what you paid for, restore purchases, and prevent fraudulent or duplicate claims |
| App activity: screens viewed, time spent, patterns completed, purchases made, ratings given | To understand how the app is used and improve it. You can turn this off — see Analytics below |
| Crash reports and error diagnostics | To find and fix faults |
| Advertising identifier | To show ads, if you have not removed them and you consented to personalised advertising |
| Approximate location, inferred from IP address by our providers | An unavoidable by-product of connecting to any internet service. We do not collect GPS or precise location |
ANONYMOUS ACCOUNTS
Every installation is given an anonymous account automatically when the app first runs. This has no name or email attached to it and exists so that uploads can be attributed securely. If you never create a full account, the anonymous account is deleted automatically after 30 days of inactivity.
Why we process your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account; syncing and storing your designs; delivering Threadworks+ and other purchases | Performance of a contract (Art. 6(1)(b)) |
| Sending marketing email about new patterns, tips and offers | Consent (Art. 6(1)(a)). Never pre-ticked; withdrawable at any time |
| Personalised advertising and the advertising identifier | Consent (Art. 6(1)(a)), collected through the consent prompt shown before ads load |
| Analytics and usage measurement | Consent (Art. 6(1)(a)), withdrawable in Settings → Privacy and Legal |
| Crash reporting and diagnostics | Legitimate interests (Art. 6(1)(f)) — keeping the app working |
| Preventing fraud, duplicate subscription claims and invalid ad traffic | Legitimate interests (Art. 6(1)(f)) — protecting the service and our advertising partners |
| Meeting tax, accounting and legal obligations relating to purchases | Legal obligation (Art. 6(1)(c)) |
We do not carry out any automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles ourselves.
We do not collect special category data, and you should not put such data into pattern names or images.
Who we share data with
We do not sell your personal data. We share it with the following processors and partners, each only to the extent needed to run the service.
| Provider | What they receive | Purpose |
|---|---|---|
| Supabase | Email, name, marketing preference, designs, reference images, device records, subscription state | Database, authentication, file storage, and sending your sign-in codes |
| PostHog | Analytics events and a randomly generated analytics identifier | Usage analytics. Not collected if you opt out |
| Sentry | Crash reports, error messages and technical diagnostics | Fault diagnosis |
| RevenueCat | Your account identifier, email address, display name, account age, language, and counts of your designs and completed patterns | Subscription and purchase management |
| Unity LevelPlay / ironSource, and mediated ad partners | Advertising identifier and ad request data | Serving ads. Only if you have not removed ads and have consented |
| Google Play and Apple App Store | Purchase and receipt data | Processing payments and validating purchases |
Ad mediation means an ad request may be passed to further advertising networks. The consent prompt shown before ads load lists the partners involved, and you can change or withdraw that choice at any time in Settings → Privacy and Legal.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
International transfers
Some of our providers process data outside the UK and EEA, including in the United States. PostHog analytics data is currently processed in the United States.
Where data leaves the UK or EEA, we rely on the UK International Data Transfer Agreement or Addendum, and the European Commission's Standard Contractual Clauses, as incorporated into our agreements with those providers.
How long we keep data
| Data | Retention |
|---|---|
| Account data (email, name, preferences) | Until you delete your account |
| Synced designs and images | While your subscription is active, plus a 30-day grace period after it lapses, after which cloud copies are deleted. Local copies on your device are unaffected |
| Anonymous accounts | 30 days |
| Subscription event records from our payment provider | 90 days |
| Records of subscription transfers between accounts | Kept as long as needed to prevent duplicate claims on the same purchase |
| Analytics events | Per our provider's retention settings, and deleted on request |
| Crash reports | Up to 90 days |
Deleting your account removes your account record, your synced designs, your uploaded images, your device records and your subscription record, and withdraws any patterns you published. We also ask our analytics, crash reporting and subscription providers to delete the data they hold about you.
We may keep a minimal, non-identifying record of a purchase where we need it to stop the same store receipt being claimed twice, and records we are legally required to keep for tax purposes.
Your rights
Under the UK and EU GDPR you have the right to:
- Access your data — Settings → Privacy and Legal → Download my data gives you a machine-readable copy
- Rectify inaccurate data — you can edit your name in Settings → Account, and email us to correct anything else
- Erase your data — Settings → Account → Delete account permanently deletes your account and data. See How to delete your account for the steps, what is deleted, and what we have to keep
- Portability — the download above is provided in JSON, a structured, commonly used, machine-readable format
- Object to processing based on legitimate interests
- Restrict processing in certain circumstances
- Withdraw consent at any time, for marketing email (Settings → Account), analytics and advertising (Settings → Privacy and Legal). Withdrawing consent does not affect processing carried out before you withdrew it
To exercise any right not available in the app, email [email protected]. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.
Children
Threadworks is not directed at children and is not intended for use by anyone under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, email us and we will delete it.
Because the app is funded partly by advertising, we do not present it as a children's app.
Security
Your session is stored securely on your device. Data in transit is encrypted with TLS. Access to your synced designs and uploaded images is restricted at the database level so that only your own account can read them. Files are stored in a private bucket that is not publicly accessible.
No system is perfectly secure, but we will notify you and the relevant regulator of any breach affecting your data where the law requires it.
Local data on your device
Your patterns, stitch progress and app preferences are stored on your device. Uninstalling the app removes them. If you have sync enabled, deleting the app does not delete your cloud copies — use Delete account for that.
Changes to this policy
If this policy changes materially we will update the effective date above and, where the change is significant, tell you in the app. Continued use after a change means you accept the updated policy.
Contact
Email: [email protected]
Company: Northern Pixel