Skip to content
Stitch Toolbox

Legal

Privacy Policy

What we collect, what stays on your device, and who else is involved. Last updated 10 September 2026.

What stays in your browser

Embroidery files you open in the viewer, converter, pre-flight check, hoop checker, thread converter and price calculator are decoded on your device. Nothing is uploaded; close the tab and nothing remains. Lettering and batch previews are also rendered locally.

What we receive

  • Image digitiser: your picture is read and digitised in your browser and is never uploaded. When you download, your browser sends a colour map of the design (a small palette and one number per pixel) with your fabric and thread choices, so the server can build the files; it is processed in memory and discarded.
  • Pro downloads: to build a download, your browser sends the text and settings (lettering, batch names) or the stitch file itself (resize, cleanup) to our server. The file is processed in memory and discarded; we keep a log entry with the time, tool, formats and stitch count so you can see your download history, not the design.
  • Account: your email address and sign-in timestamps. Sign-in is by emailed link, so there is no password to store.
  • Server logs: IP address and user agent for security and rate limiting, retained for 30 days.

Third parties

  • Polar Software Inc. sells the subscription as merchant of record and receives your email and billing details under its own privacy policy. We receive the subscription status, not your card.
  • Google Analytics 4 counts page views and the tool used, with IP anonymisation and advertising features off. In the EU and EEA, the UK, Switzerland and Turkey it runs only if you allow it in the banner, and declining keeps it cookieless. Elsewhere it runs by default; you can switch it off at any time, and a Global Privacy Control signal from your browser switches it off automatically. We look up your country from your IP address only to decide which applies, and do not store it.
  • Our own mail server delivers sign-in emails. Our hosting provider stores the database and serves the site.

We do not run advertising, sell data, or share it with anyone not listed here.

Cookies and local storage

One session cookie keeps you signed in. Local storage remembers your theme, tool settings and your analytics choice. Google Analytics sets its own cookies where analytics is on (after you allow it, in the regions that require that), and never once you switch it off.

Your rights

Write to [email protected] to access, export or delete your data, including under GDPR and CCPA. Deleting your account removes your download history; Polar keeps invoices for as long as tax law requires.