Privacy policy

PatternHoop turns a photo into a cross-stitch pattern. We built it to collect as little data as possible: the photo never leaves your device, there are no accounts or ads, and we count statistics without cookies and without tracking individuals. Below is what is processed, why and for how long.

Who is responsible

The data controller is Vladyslav Korotkov, a private individual who owns patternhoop.com.

Questions, requests and complaints about your data: privacy@patternhoop.com.

Your photo

Your photo is processed right in your browser and is never sent anywhere — not to our server, not to anyone else. We never see or keep it. It is gone when you close the tab.

Making the PDF

The PDF is built right in your browser as well. When you press "Download PDF", nothing is sent to our server.

Sending the pattern by email

When you press "Send by email", your browser sends our server the finished PDF and your email address, and we process the address, your IP address and the file to send you the email. Legal bases: doing what you asked for (Art. 6(1)(b) GDPR) and protecting the form from abuse (legitimate interest, Art. 6(1)(f) GDPR).

Unless you separately ask for it, we do not store the address in a database or add it to a mailing list (see "Newsletter"), and we do not keep the file: it goes into the email and is dropped right away. To limit how often emails are sent, we keep the IP address and a hash of the address (not the address itself) with a send counter while the limit applies — from a few minutes up to an hour; then the record is deleted.

The email is delivered by Resend, which keeps the message and the delivery log under the Resend privacy policy.

Newsletter

You can subscribe to new lessons and ideas with the box in the "Send by email" form or with the form in the blog. The subscription is double opt-in: first we send an email with a link, and only after you open it does the address join the mailing list. The link works for 7 days; if you do not open it, the address is not kept anywhere.

For the newsletter we keep your email with Resend until you unsubscribe. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email or by writing to privacy@patternhoop.com; after that we send nothing more.

Bot protection

The email form is protected by Cloudflare Turnstile, an invisible check that runs when you press the button. To tell people from bots it receives your IP address and technical browser signals; Cloudflare commits not to use them for advertising or tracking. See the Cloudflare Turnstile terms.

Visit statistics

To know how many people use the service and what works in it, we count anonymous statistics, without cookies or identifiers:

• Cloudflare Web Analytics counts page views: the page address, the referrer, the country, the browser and device type, and loading speed. It sets no cookies, does not fingerprint the browser and does not track individual visitors. See the Cloudflare privacy policy.
• Our server counts actions in the editor: a pattern was built, a PDF downloaded, an email sent, an error happened. Each event records only the language, the pattern size, the number of colours, the fabric, the PDF mode and the country; no IP address, email or photo.

The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

Cookies and browser storage

Without your consent the site sets no analytics cookies and loads no ad pixels or third-party trackers. Fonts are served from our own server.

Microsoft Clarity — only with consent. On your first visit we ask whether we may turn on Microsoft Clarity. If you press "Accept", Clarity records how you use the site — page changes, clicks, scrolling and pointer movement — so we can see where the site is awkward and build heatmaps. Your photo, the pattern, form fields and your email are masked in recordings. Clarity sets the cookies _clck (up to 1 year) and _clsk (1 day), and Microsoft sets its MUID cookie (up to 1 year). Microsoft keeps recordings for up to 30 days and aggregated statistics for up to 13 months; see the Microsoft privacy statement. The legal basis is your consent (Art. 6(1)(a) GDPR). If you press "Necessary only" or close the banner, Clarity is not loaded at all. You can change your mind at any time: the "Cookie settings" link at the bottom of every page deletes Clarity's cookies and asks again.

Cloudflare. If Cloudflare's bot protection finds a request suspicious, it may set its cf_clearance cookie (up to 1 year) so it does not check you again. It serves security only and needs no consent.

Browser storage (localStorage) keeps your cookie choice and your "At home" thread list, so they survive between visits. It stays on your device and never reaches us. Clear it by unticking the threads or by clearing the site data in your browser.

Server logs

Like any web server, the site's hosting receives technical request data — IP address, browser type, page address and time — and may keep it in logs for a limited time to run the site and protect it from attacks.

Who receives data

We do not sell data or share it with third parties, except the providers the service cannot work without:

• Cloudflare, Inc. (USA) — hosting the site, bot protection and visit statistics;
• Resend, Inc. (USA) — email delivery and the mailing list;
• Microsoft Corporation (USA) — Microsoft Clarity, only if you consented.

They process data on our behalf. Transfers to the USA rely on the mechanisms they provide: the EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

How long data is kept

• the photo — never leaves your device;
• the PDF — built in your browser; for an email — not stored, dropped right after sending;
• your email — not stored by us; the address hash and IP address — while the rate limit applies (up to an hour);
• the email and its delivery log — at Resend, under its policy;
• a subscriber's email — at Resend, until you unsubscribe;
• Microsoft Clarity recordings — up to 30 days, aggregated statistics — up to 13 months (only with consent);
• hosting logs — for a limited time, under the provider's rules.

Your rights

You can ask to access, correct or delete your data, restrict or object to its processing, and complain to the data protection authority in your country.

We keep almost nothing, so usually there is nothing to show or delete, but we answer every request to privacy@patternhoop.com within 30 days.

Children

The service is not meant to collect children's data. If you are under 16, send a pattern by email only with a parent's permission.

Changes

If this policy changes, we will update this page and the date at the top, and announce significant changes on the site.