Privacy Policy
We collect only what we need to run Stitch and Threads: your account details, the artwork you upload, the designs we make, and basic usage and security data. We don't sell your personal data, we don't use advertising cookies, and we don't use your artwork or designs to train AI models. You can ask to see, fix, export or delete your data at any time by emailing hello@designmusketeer.com.
1. Who we are
Stitch and Threads (stitchandthreads.com) is run by Design Musketeer LLC, 26517 Danti Court, Hayward, California 94545, United States ("we", "us" or "our"). We decide how and why your personal data is used. Under EU and UK law, that makes us the "controller" of your data.
This policy covers our website, our app and the emails we send. It doesn't cover other companies' sites or services, such as your Google account.
Questions? Email hello@designmusketeer.com.
2. What we collect
Information you give us
- Account details. Your name, email address and password. Our sign-in system stores your password in a scrambled (hashed) form, so we can't read it. If you sign in with Google, Apple or Microsoft, that company shares basic profile details with us, such as your name and email address. Google may also share your profile picture, and Apple may give us a private relay address that forwards to you. We never see your password with them.
- Artwork and designs. The images you upload, the designs, previews and embroidery files we create from them, and the choices you make, such as style, size and file format. Your artwork may include personal data, such as a photo of a person, a name or a signature.
- Messages. What you send us when you email us, for example about support, refunds or privacy.
- Payment details (when payments go live). A third-party payment processor will handle your card. We'll receive only limited details, such as your name, billing country, card type, the last four digits of your card, and what you bought. We won't store full card numbers.
Information we collect automatically
- Usage information. Pages you visit, features you use, designs you create and download, free designs used, and errors.
- Device and connection information. Your IP address, browser type, operating system, device type, and the date and time of your requests. We use this to keep the service secure, apply limits (such as the free-design limit and the limit on new accounts per network) and stop abuse.
- Session information. An identifier that keeps you signed in.
- Basic analytics. Our hosting platform gives us basic, privacy-friendly analytics: visit counts, pages viewed, the sites that sent you to us, and device type. We use it to understand how the site is used overall.
Information from other companies
- Google, Apple or Microsoft, if you choose to sign in with them.
- Our payment processor, when payments go live, to confirm your payments.
We don't buy personal data from data brokers.
3. How we use your information
| What we do | Information used | Legal basis (EU and UK) |
|---|---|---|
| Create your account, sign you in and confirm your email | Account details, session information | Contract (providing the service you asked for) |
| Digitize your artwork, show previews and deliver your files | Artwork and designs | Contract |
| Count, use and give back free designs, and later credits and Pro | Usage information; payment details when live | Contract |
| Send service emails, such as email confirmation and its reminders, password resets and important notices about your account or our policies | Email address | Contract; legitimate interests (keeping you informed about the service) |
| Answer your support, refund and privacy requests | Messages, account details | Contract; legal obligation |
| Keep the service secure, apply sign-up and usage limits, and prevent fraud and abuse | Device and connection information, usage, session information | Legitimate interests (keeping the service safe and fair) |
| Understand and improve the service | Basic analytics, usage information | Legitimate interests (making the service better) |
| Handle copyright complaints, enforce our terms, follow the law and defend legal claims | Any relevant information | Legal obligation; legitimate interests |
| Process payments and keep tax records (when payments go live) | Payment details | Contract; legal obligation |
When we rely on legitimate interests, we've weighed our interests against your rights. You can object to this use (see section 9).
Emails. We send the service emails listed above. We also send news and offers when the box for them is ticked at sign-up. In the US it starts ticked; elsewhere it starts unticked. You can change it any time in your account, and every news email includes an unsubscribe link.
Automated processing. AI helps plan the stitches in your designs. We don't use automated processing to make decisions about you that have legal or similarly significant effects. Our automatic limits, like the free-design limit, only control how much of the service you can use.
No ads. We don't use your information for advertising, and we don't build profiles about you.
4. Your artwork and AI
- We don't use your uploaded artwork or your designs to train AI models.
- To plan stitches, we send your artwork to AI models offered by cloud providers, such as Google Cloud Vertex AI. They process it only to return results to us for your design.
- Sample mode. While the site shows sample designs (it says so on screen), we check that your file is a PNG or JPG within the size limit and then discard it. We don't keep it, and nothing is digitized from it.
- No person reviews your files as part of normal processing. Our team looks at your artwork only when you ask us for help, to investigate abuse or a legal complaint, or to fix a technical problem.
5. Cookies and local storage
We use cookies and your browser's local storage only for things the site needs:
- keeping you signed in;
- keeping your design on this device between visits: a small preview of your artwork, your design's change history (including what you type about it) and which sample it shows;
- remembering your preferences;
- security, such as applying limits and stopping abuse.
We don't use advertising cookies, and we don't track you across other websites. Our hosting platform's basic analytics are used only to count visits and pages overall.
If you clear your cookies or local storage, you'll be signed out. Deleting your account doesn't clear your browser: to remove the copies kept there, clear this site's data in your browser settings.
Do Not Track and Global Privacy Control. We don't track you across sites, so the service works the same whether or not your browser sends a Do Not Track signal. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal data. We don't sell or share it anyway.
6. Who we share it with
We don't sell your personal data. We also don't share it for cross-context behavioral advertising, which means ads based on your activity across other sites.
We share personal data only in these cases.
Service providers. These companies process data for us so we can run the service. They may use it only to provide their services to us.
| Provider | What they do for us | Data involved |
|---|---|---|
| Lovable Cloud (built on Supabase) | Hosts our website and runs our database, sign-in, file storage, emails and basic analytics | Account details, artwork and designs, usage, device and connection information |
| Google Cloud | Runs the servers that digitize your artwork | Artwork, design choices, designs |
| AI model providers on cloud platforms, such as Google Cloud Vertex AI | Help plan the stitches in your design | Artwork and design information |
| A third-party payment processor (when payments go live) | Processes payments | Payment details |
Sign-in with Google, Apple or Microsoft. If you use one of them, that company confirms who you are and shares basic profile details with us. It handles your account with them under its own privacy policy.
Legal reasons. We may share information if the law requires it, such as to answer a valid court order. We may also share it to protect the rights, safety or property of our users, the public or us, including to deal with fraud, abuse or copyright complaints.
Business changes. If we're involved in a merger, acquisition or sale of assets, your information may move to the new owner. This policy will keep applying to it, and we'll tell you before that changes.
Professional advisers. Our lawyers, accountants and auditors, who must keep it confidential.
With your permission. In any other case, only if you ask us to or agree.
7. International transfers
We're based in the United States, and our providers may process data in the United States and other countries. If you live in the EU, the UK or Switzerland, your data will be transferred to the United States, where privacy laws may differ from yours. We protect these transfers with legal safeguards. These include the Standard Contractual Clauses approved by the European Commission (and the UK's equivalent) in our providers' data processing terms, or the EU-US Data Privacy Framework where a provider is certified. Email us to learn more about these safeguards.
8. How long we keep it
| Information | How long we keep it |
|---|---|
| Account details | While your account is open. After you delete your account, we delete them within 30 days. Backups cycle out within a further 30 days. |
| Uploads, previews, designs and files | While your account is open, so you can download them again, or until you ask us to delete them. Then we delete them within 30 days, and backups cycle out within a further 30 days. |
| Download links | Each link works only once. |
| Security and limit records, such as IP addresses | Only as long as needed to apply limits, protect the service and look into abuse. Then deleted or anonymized. |
| Basic analytics | Kept as summary statistics about overall site use. |
| Emails you send us | As long as needed to help you and keep a record of what we agreed. |
| Payment and tax records (when payments go live) | As long as tax and accounting laws require, even after you delete your account. |
We may keep specific information longer if we need it for a legal claim or a copyright complaint, or to follow the law. We keep it only as long as that reason lasts.
9. Your rights
Wherever you live, you can ask us to:
- Access: give you a copy of the personal data we hold about you;
- Correct: fix information that's wrong or incomplete;
- Export: give you your data, including your artwork and designs, in a common, machine-readable format;
- Delete: delete specific uploads or designs, or your whole account and data.
How to ask. Email hello@designmusketeer.com from the email address on your account, and tell us what you'd like us to do. To protect your data, we may ask you to confirm your identity before we act. There's no charge. We'll respond within 30 days. If a request is complex, the law may let us take longer. If so, we'll tell you why within those 30 days.
More rights in the EU and UK. You can also:
- object to our use of your data based on legitimate interests;
- ask us to restrict how we use your data;
- withdraw any consent you've given, at any time;
- complain to a data protection authority. In the EU, that's the authority in your country. In the UK, it's the Information Commissioner's Office (ico.org.uk). We'd like the chance to help first, so please contact us.
10. Your California privacy rights
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you extra rights.
What we collect. This table shows the categories of personal information we collect, using the names in California law.
| Category | Examples | Where it comes from | Why we use it |
|---|---|---|---|
| Identifiers | Name, email address, account ID, IP address | You, your device, and Google, Apple or Microsoft if you sign in with them | Running your account and the service; security and limits |
| Customer records | Name and email address; billing details when payments go live | You, our payment processor | Accounts, payments and support |
| Commercial information | Free designs used; credits and plans bought, when payments go live | Your use of the service | Running free designs, credits, plans and refunds |
| Internet or other network activity | Pages visited, features used, referring sites, device type, errors | Your device | Security, analytics and improving the service |
| Visual information | Artwork you upload, and previews of your designs | You | Creating your designs |
| Sensitive personal information | Your account log-in (email address and password) | You | Signing you in |
We disclose each category only to the service providers listed in section 6, for the purposes above. We keep each category for the periods in section 8. We don't collect precise geolocation.
No sale or sharing. We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We haven't done either in the past 12 months. We don't sell or share the personal information of anyone under 16.
Sensitive personal information. We use your log-in details only to sign you in and keep your account secure. We don't use them to infer anything about you. Because we use them only for these allowed purposes, there is nothing for you to limit.
Your rights. You have the right to:
- know what personal information we collect, use and disclose, and get a copy of it;
- correct personal information that's wrong;
- delete your personal information;
- opt out of the sale or sharing of your personal information (we don't do either);
- not be treated differently for using your rights. We won't deny you service, charge you a different price or give you worse service because you used them.
How to use your rights. Email hello@designmusketeer.com. We'll confirm we got your request within 10 business days and respond within 30 days. We'll verify your identity by matching your request to the email address on your account. You can also have an authorized agent make a request for you. We'll need your signed permission for the agent, and we may ask you to confirm your identity with us directly.
Direct marketing ("Shine the Light"). We don't share personal information with other companies for their own direct marketing.
11. Rights in other US states
If you live in another US state with a privacy law, such as Colorado, Connecticut, Texas or Virginia, you have similar rights to access, correct, delete and get a copy of your data. Use them the same way, as described in section 9. If we turn down your request, you can appeal by replying to our answer with "Appeal" in the subject line. We'll answer your appeal within 45 days. If you're still unhappy, you can contact your state's attorney general.
12. How we protect your data
- All traffic to the site uses encrypted connections (HTTPS).
- Passwords are stored hashed, never as plain text.
- Our providers encrypt the data they store for us.
- Only people who need access to do their job can see your data.
- Download links work only once.
- We limit requests to protect the service from abuse.
No system is perfectly secure. Use a strong password that you don't use anywhere else. If a data breach affects your personal data, we'll tell you and the authorities as the law requires.
13. Children
The service isn't directed to children under 13, and we don't knowingly collect personal data from them. You must be at least 13 to use it, or 16 where local law requires. If you're under 18, you need a parent or guardian's permission. If we learn that a child under 13 has given us personal data, we'll delete it. If you think this has happened, email hello@designmusketeer.com.
14. Changes to this policy
We may update this policy as the service grows, for example to name our payment processor when payments go live. We'll change the date at the top. If a change is significant, we'll tell you by email or with a notice on the site before it takes effect.
15. Contact us
Design Musketeer LLC 26517 Danti Court Hayward, California 94545 United States Email: hello@designmusketeer.com (please put "Privacy" in the subject line)