Privacy policy

Last updated: 24 October 2026

Short and honest

StitchPencil collects, processes and transmits no personal data. The app runs entirely on your iPad. No tracking, no analytics, no accounts, no cloud sync, no telemetry. Your designs stay on the device unless you export or share them yourself. The one thing the app fetches is a small catalogue of font naming rules from our own server, and that can be switched off (section 6).

1. What the app does not collect

• No device identifiers; no IP addresses — the only one the app ever leaves behind is in the host's server log of the rule-catalogue request (section 6)
• No usage statistics or crash reports
• No content from your designs, imports or exports
• No profile or login data
• No advertising IDs or trackers

2. This website

When you visit this site, the web host processes technically necessary data such as your IP address, browser and request timestamp (server logs). These are not analysed, not linked to anything else, and deleted after at most seven days. No cookies are set, no tracking is used, no analytics tools are loaded, and no fonts, scripts or images are fetched from third-party servers.

The site stores two values in your browser's local storage — your chosen language and light/dark preference. They never leave the browser and you can clear them at any time via your browser settings.

3. Bug-report form

When you submit a report at /support, we process the data you enter: your email address (required, so we can reply), optionally your name and iPad model, the app and iPadOS version, your description, and up to three attachments (PNG, JPG, PDF, ZIP, .hoop, PES, DST, EXP, MP4 or MOV, together at most 200 MB).

Please note that a .hoop project file can contain a reference image you used in that project, and a screen recording shows whatever was on your screen — check before you attach one whether you want to send it along.

Additionally, and automatically, your IP address (truncated by the last octet) and the time of submission are recorded — solely to prevent abuse (rate limiting).

Purpose: handling your report. Legal basis: Art. 6(1)(a) GDPR (consent, via the checkbox) and Art. 6(1)(f) GDPR (legitimate interest in spam prevention). Retention: attachments are deleted from the server after 30 days at the latest; the email correspondence stays in the mailbox until the matter is settled. Recipients: the operator (see the imprint) and, for drafting the reply, Anthropic as a processor — see section 8. No other transfer to third parties.

4. In-app purchases

The Export Unlock is sold through Apple's App Store. Apple processes the payment data; we receive only an anonymous confirmation that a purchase is valid, with no link to your identity. See Apple's privacy policy.

5. Your rights

You have the right to access, rectification, erasure and restriction of processing (Art. 15–18 GDPR), the right to data portability (Art. 20 GDPR) and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For any request, write to us by email — see the imprint.

6. The one request the app makes: the catalogue of font naming rules

StitchPencil reads purchased letter fonts by the names of their files. So that a new shop's way of naming them can be understood without a new app version, the app fetches a small catalogue of naming rules from docs.stitchpencil.app — one public JSON file, at most once a day, and only while you are adding a font. This is the app's only network request of its own.

The request carries nothing but the request itself: no identifier, no content of your fonts or designs, no settings. As with any web request, the host (All-Inkl, Germany) sees your IP address, the time and the file asked for in its server logs; these are not analysed, not linked to anything else, and deleted after at most seven days. No cookies, no tracking. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in keeping the font import working without app updates). You can switch the fetch off in the app settings under “Letter fonts”; the app then uses the catalogue it came with and your own rules.

7. Support messages — email, bug reports, Instagram

Messages you send me — by email to support@stitchpencil.app, through the bug-report form, or on Instagram (direct message, comment, mention) — I store on my own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centre in Germany, data processing agreement in place), so that I can answer them and keep track of open questions. Legal basis: Art. 6(1)(b) GDPR (answering your request) and Art. 6(1)(f) GDPR (legitimate interest in orderly support). Instagram messages reach me through the official interface of Meta Platforms Ireland Ltd.

To translate messages and to prepare replies, I use the AI assistant Claude by Anthropic PBC, San Francisco, USA. For that, the text of your message is transmitted to Anthropic. Anthropic processes it on my behalf under a data processing agreement with the EU standard contractual clauses and does not use it to train its models. I read every message myself, and every reply is checked and sent by me. Messages are deleted at the latest 24 months after the last contact.

8. Deleting your data

You can ask at any time that I delete your messages and data. Email support@stitchpencil.app with your Instagram name or the email address you wrote from. I delete your data within 30 days and confirm it to you.

9. Changes

If something fundamental changes about how data is handled — a further feature with a server connection, for instance — this policy is updated. The date above shows the last change.