LEGAL

PRIVACY POLICY

Last updated: 23 October 2026

1. What we collect

We collect only personal data we reasonably need to run and secure Stitchplot:

• Account data: email address, display name, account identifier, password hash (not your plaintext password), account creation and update details, and failed-login or temporary-lock information.
• Google sign-in data: if you use Google sign-in, your Google account subject identifier, email address and name supplied through Google’s authentication service.
• Session and security data: authentication session identifiers, session-expiry information, OAuth security-state cookies and technical information needed to stop unauthorised access.
• Saved projects and PDF patterns: if you save a project or generate a PDF while signed in — the uploaded source image or file, generated preview, PDF pattern (where applicable), filenames, file types, project settings, palette and chart information, aggregate project counts, and download or save metadata.
• Limited service analytics: event names and small non-identifying technical or feature metadata (for example upload, generate or download events). We do not intentionally attach these event counters to your account identity.
• Communications: information you send us by email or through a support request.
• Purchase data (PDF credits): HK$29 purchases are processed by Stripe. Your card details are entered with Stripe and are not stored on Stitchplot; we receive confirmation that the payment succeeded and the details needed to add credits to your account.

You do not need an account for the basic in-browser editor. Account data is required to save and reopen projects in your library, keep signed-in PDF patterns, and buy PDF credits. If you decline required account data, those features will not be available.

2. Why we use personal data

We use personal data to:

• provide, authenticate and secure accounts and private libraries;
• process your saved images, chart settings and PDF patterns so you can reopen, update, download or delete them;
• record and apply PDF credits (including Google sign-in credits and one-time purchases);
• prevent fraud, misuse, unauthorised access and technical abuse;
• maintain, troubleshoot and improve reliability using limited aggregate event data;
• respond to enquiries and meet legal obligations; and
• enforce the Terms of Use and protect our rights, users and third parties.

We do not currently use personal data for direct marketing. If we later wish to, we will obtain any consent required under the PDPO before doing so.

3. How project images are handled

Ordinary image-to-chart conversion runs in your browser. We only send your image to project storage if you save a project while signed in. A saved project stores the original file, a generated preview and the settings needed to reopen it. When you generate a print-ready PDF while signed in, we store that PDF in your private PDF Patterns library so you can download it again.

We do not sell your uploaded images, private projects or outputs. They are not used for advertising, public display or AI-model training unless you give separate, affirmative permission.

4. Who may receive data

We may disclose data only for the purposes above to:

• Cloudflare, which provides hosting, database and object-storage infrastructure used for accounts and saved projects;
• Google, when you choose Google sign-in;
• Stripe, which processes payments when you buy PDF credits;
• service providers that help us operate, secure or support Stitchplot and are bound to handle data only for authorised purposes;
• authorised administrators, only where necessary to operate, secure, support or investigate Stitchplot; and
• regulators, courts, law-enforcement bodies or other parties where required by law or necessary to establish, exercise or defend legal rights.

We do not sell personal data.

5. International processing

Stitchplot uses Cloudflare, Google and Stripe infrastructure. Account data, saved projects and PDF patterns are stored on Cloudflare servers. Personal data may be processed or stored outside Hong Kong, depending on how those providers’ systems are configured. When a processor handles personal data for us, we take practicable steps so it protects that data and uses it only for authorised purposes.

6. Retention and deletion

We retain personal data only as long as needed for the purposes in this Policy, unless a longer period is required or permitted by law.

• Authentication sessions expire after 30 days, unless renewed through continued use.
• Saved projects and PDF patterns remain available until you delete them or your account is deleted.
• Deleting a saved project removes its database record and the related source and preview assets. We do not keep separate backup copies of deleted projects.
• Account data is retained while your account is active. You may request account deletion at info@massill.uk. We will verify your identity and delete or anonymise account data, subject to lawful retention needs.
• Support communications are retained for 12 months, unless a longer period is needed for a complaint, dispute, fraud investigation or legal obligation.

7. Cookies

We use essential first-party cookies to keep you signed in and to protect the Google sign-in process. These cookies are needed for account features and security. We do not currently use advertising cookies.

8. Security

We take practicable steps to protect personal data from unauthorised or accidental access, processing, erasure, loss or use. Measures include HTTPS transport security, hashed passwords, signed-in access controls for saved project assets, access-limited administration, and security controls supplied by our infrastructure providers.

No online transmission or storage method is completely secure. Protect your account credentials and keep your own backups of important work.

9. Children

Stitchplot is not directed to children under 13. If you believe a child has provided personal data without appropriate consent, contact info@massill.uk so we can review and take appropriate action.

10. Updates to this Policy

We may revise this Policy when Stitchplot, our technology or legal obligations change. We will post the new version here and update the “Last updated” date. For material changes we will give reasonable notice through Stitchplot or by email where appropriate.

11. Contact and complaints

For privacy questions, requests or complaints, contact info@massill.uk. Where appropriate, you can also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.