Privacy Policy

Last updated: July 7, 2026

This policy explains what Stitchist collects, why, and what we deliberately don't.

The short version: we store your account, the projects you choose to save to it, and your subscription status. We don't sell data and we don't run third-party ad trackers.

What we collect

Account data — your email, display name and (if you use password sign-in) a salted PBKDF2 hash of your password. If you sign in with Google or GitHub we store the provider's account identifier, your name and avatar URL.
Projects — designs you explicitly save to your account, plus a small thumbnail for the gallery. Designs you don't save to the cloud are not uploaded.
Working data — while you actively use the web studio, design geometry you're editing is processed on our server to generate previews and stitch files, held in a temporary session and deleted when it expires.
Billing — payments are processed by Stripe; your card details never touch our servers. We store your Stripe customer ID and subscription status.
Technical logs — standard server logs (IP address, request path, timestamp) used for security and rate limiting, retained briefly.

What we don't collect

No third-party advertising or cross-site tracking scripts.
No selling or sharing of personal data with data brokers.
Designs you never save to your account are not kept — they exist only in your browser and in the temporary editing session that expires after you leave.

Cookies

We use one first-party session cookie to keep you signed in, and a short-lived cookie during third-party sign-in to protect the OAuth handshake. No advertising cookies.

Where data lives & how long

Account and project data are stored on our servers until you delete them or your account. Temporary editing sessions are evicted automatically. Backups age out on a rolling basis.

Your rights

You can access, correct, export or delete your data. Deleting a project removes it immediately; to delete your whole account, email support@stitchist.app and we'll remove the account, its projects and its identities. Depending on where you live (e.g. GDPR/CCPA regions) you may have additional statutory rights — the same address handles those requests.

Third parties we rely on

Stripe — payment processing (their privacy policy applies to checkout).
Google / GitHub — only if you choose them for sign-in.
Our hosting provider, which processes data on our behalf.

Changes & contact

We'll note material changes on this page. Questions: support@stitchist.app.