Privacy Policy — Your Photo Stays in Your Browser
Last updated: 15 November 2026
This policy explains what happens to your data when you use thecrossstitchpatternmaker.com (“The Cross Stitch Pattern Maker”, “we”). The short version: the tools run in your browser, and the patterns you make are saved on your device. If you use the optional paid Pro, we also keep your account, your purchases, and the patterns and stitch progress you keep in your account. To improve the tools we collect usage statistics, and in the European Economic Area, the UK and Switzerland only after you agree.
What stays on your device
- Photos and patterns. Photos you convert are read and turned into patterns by your browser. They are not uploaded and not stored after you leave the page. PDFs and PNGs are made on your device. To remember whether your free PDF has been used, your browser stores a short fingerprint of that photo (a hash, from which the photo cannot be rebuilt) and the time, in its local storage (
xs_free_pdf); it is never sent to us. - Saved patterns and stitch progress. Patterns you make from your own photos are saved in your browser’s storage (IndexedDB) so you can open them again on My patterns: a reduced copy of the photo (at most 1,200 pixels on the longer side), your settings, a small picture of the pattern and, if you use the stitch tracker, which stitches you have marked. Your floss box (the DMC numbers you own) and your seller details (shop name, back cover text, logo) are saved the same way. Without Pro they are never sent to us. Delete them on My patterns, or by clearing this site’s data in your browser.
Your account and Pro
You only have an account if you buy Pro or sign in. Then we keep:
- Your email address, which you enter on Stripe’s payment page or use with PayPal (they pass it to us), when you ask for a sign-in link, or which Google gives us when you sign in with Google (together with your name and profile picture, which we only store with your account). We use it to create your account, to send you one-time sign-in links (they expire after 15 minutes) and, if needed, messages about your purchases or your account.
- Sign-in sessions: a record for each device you sign in on, with the time, IP address and browser type, so you stay signed in. A session ends 90 days after you last use it or when you sign out. To stop abuse of the sign-in form we also briefly count requests per IP address.
- Saved patterns and stitch progress (Pro): with Pro, the saved patterns, tracker progress, floss box and seller details described above, including the reduced photo copy, are copied to your account so your other devices can open them. You can delete any of them on My patterns; deleting your account deletes all of them. When Pro ends they stay in your account until you delete them, and you can still open them.
- Purchases: which plan you bought, the amount, currency and date, and Stripe’s or PayPal’s reference numbers. We never receive your card details.
- How you found us: while statistics are allowed (see below), your browser remembers the website that first sent you here, the
utm_sourcetag of that link if it had one, and the first page you opened. When you create an account, this is saved with it, so we can see which pages and websites bring people who use Pro. It is deleted with your account.
We use this data only to provide your account and Pro (the contract between us). If you delete your account on the account page, we delete your email address and sessions at once. Purchase records are kept for as long as tax and accounting law requires (up to 7 years), without being used for anything else.
Services that handle this data for us:
- Cloudflare hosts the site, and the database where accounts, purchase records and Pro members’ saved patterns are stored.
- Stripe processes payments. Some purchases are sold through Link, Stripe’s payment service, as the seller of record; Link then also handles your payment details, receipts and payment support under its own privacy policy. See Stripe’s privacy policy and Link’s privacy policy.
- PayPal processes payments made with PayPal, in some countries. It handles your PayPal account and payment details and gives us your email address and the payment’s status. See PayPal’s privacy statement.
- Resend sends our emails, such as sign-in links. See Resend’s privacy policy.
- Google handles “Continue with Google” if you choose it. See Google’s privacy policy.
Usage statistics
We use two analytics services to learn which tools people use and where they get stuck:
- Google Analytics (Google). It counts page views and the actions we measure — for example converting a photo or downloading a PDF or PNG — together with technical data such as browser, device, approximate location (country or city, derived from your IP address) and the page that sent you here. Google Analytics does not store IP addresses. We keep this data for 14 months. See how Google uses data from sites that use its services.
- Microsoft Clarity (Microsoft). We use Microsoft Clarity, which works with Microsoft Advertising, to capture how you use and interact with the site through behavioral metrics, heatmaps and session replay, so we can improve the tools. Session replay shows mouse movements, clicks and scrolling on our pages; Clarity masks text you type by default. Usage data is captured with first- and third-party cookies and similar technologies. See the Microsoft Privacy Statement.
We do not show ads, and we do not use these services to identify you.
Your choice. If you visit from the European Economic Area, the UK or Switzerland, these services do not set cookies unless you click “Accept” in the cookie banner. Elsewhere they are on by default. Wherever you are, you can change your choice at any time with the “Cookie settings” link at the bottom of every page. See the Cookie Policy for the cookies involved.
Google and Microsoft may process this data in the United States. Both take part in the EU–US Data Privacy Framework.
Other data we receive
- Hosting. The site is served by Cloudflare. Like any web host, Cloudflare processes technical data such as your IP address and browser type to deliver pages and protect the site from abuse. See Cloudflare’s privacy policy.
- Email. If you write to us, we receive your email address and message and use them only to reply.
We do not sell personal data.
Your rights
Depending on where you live (for example under the GDPR or the CCPA), you can ask what personal data we hold about you, and ask us to correct or delete it. You can delete your account yourself on the account page, and withdraw consent to statistics at any time with “Cookie settings”. Write to support@thecrossstitchpatternmaker.com.
Children
The site is not directed at children under 13 and we do not knowingly collect their personal data.
Changes
We will post any changes on this page and update the date above.