Privacy Policy

Controller and scope

Bead Pattern App is the data controller for this service. Contact chaoqiang.tian@gmail.com with privacy questions. We do not currently appoint a separate Data Protection Officer.

Images and patterns processed locally

Your original photo is read, cropped and converted by your browser on the current device. Our servers do not receive or retain the original image. Grid data, edits and some preferences may remain in browser storage until you clear it.

A file leaves the page only when you choose to download, share or use a third-party feature. Do not upload material you lack permission to use or that contains unnecessary sensitive information.

Account, purchase and usage data

Anonymous editing does not require an account. To deduplicate visitor counts, the browser creates a random device identifier; the server keeps only its irreversible hash plus first and latest visit times. The public window publishes counts only, labels visitor counts as estimates, and rounds them upward to the nearest ten. To buy or restore Pro, we may process a verified email, basic Google or GitHub profile data, an internal user ID, hashed session tokens, a device recovery identifier, trial and export counts, plan and expiry. Resend delivers email codes; only a keyed code digest is stored briefly.

Waffo Pancake or Paddle acts as Merchant of Record and PCI-DSS payment processor for payment methods, billing address, taxes, orders and transactions. We do not receive or store full card numbers or security codes. We receive only minimal order metadata needed to grant access, reconcile and handle refunds. The public statistics window never displays orders or personal information.

Technical, hosting and advertising data

Cloudflare provides networking, security, hosting and database services and may process IP address, device and browser details, access time, requested URL, errors and security logs.

When Google AdSense is enabled, Google and its partners may use cookies, local storage, IP address or advertising identifiers, depending on region and consent, to serve and measure ads, limit frequency and prevent invalid traffic.

Purposes and legal bases

We process account, order and entitlement data to perform our contract; security, abuse prevention, diagnostics and aggregate measurement for legitimate interests; records where law requires them; and non-essential cookies, personalized ads or third-party sign-in based on consent where required. Consent can be withdrawn without affecting earlier lawful processing.

Sharing, sale and international transfers

We disclose the minimum necessary data to Cloudflare, Waffo Pancake or Paddle, Google AdSense / Google sign-in, GitHub sign-in and Resend, and when legally required, to protect rights, or during a business reorganization.

We do not sell original photos or payment-card data. Some laws may treat personalized-advertising transfers as 'sharing'; manage them through the consent panel and Google Ad Settings. Providers may process data internationally under reasonable contractual, access-control and encryption safeguards required by applicable law.

Retention

Server retention for original photos is zero; you control browser-local data. Account and entitlement data is kept during access and normally for no more than 90 days after account deletion, except where tax, fraud, dispute or legal duties require longer. Support correspondence is generally kept up to 24 months and technical/security logs up to 12 months. Waffo Pancake or Paddle and applicable law determine transaction-record retention.

Security and your rights

We use HTTPS/TLS, separated permissions and access controls, and store session tokens only as hashes. Depending on your location, you may request access, correction, deletion, restriction, portability, objection or withdrawal of consent, and complain to a regulator. Email chaoqiang.tian@gmail.com; after identity verification, we normally respond within 30 days.

Children and changes

We do not knowingly collect personal data from children under 13. A paid purchase must be made by a person who is at least 18 or has reached the local age of majority, or by a parent or guardian.

Where practical, we will give at least 14 days' notice of material policy changes by site notice or account email. The date on this page identifies the current version.

Material CSV export

When you request a material CSV, the browser sends only the palette version, per-color counts and assumed cell pitch to this site to verify membership and generate the file. Original photos are not sent and material request contents are not persisted. Session and security logs remain subject to this policy.