Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Your email address
• Your name (if provided through your login provider)
• Authentication credentials managed by our authentication service provider

Stash and Project Data

When you use My Yarn Stash, we store:

• Yarn details you enter (brand, color, weight, yardage, notes)
• Project information (name, type, status, notes)
• Photos you upload of your yarn labels and projects
• AI extraction suggestions, until you approve or reject them (we don't keep a separate record of that decision)
• The text the AI read from a label photo, which stays with that photo until the photo is deleted
• Spreadsheets you import (CSV/XLSX): the parsed contents are kept in a temporary file while you review the import. The file is deleted when the import finishes, or within about a day if you abandon the import

Payment Information

We do not store your credit card or payment details. All payment processing is handled securely by our payment processor. We receive your subscription status and purchase history from our payment processor through webhook notifications. We keep a copy of each notification (which can include your email address, name, and order and subscription details, but not card numbers) as an audit log for troubleshooting; these records are not deleted on a fixed schedule.

Analytics Data

We collect usage data through Microsoft Clarity to understand how people use My Yarn Stash and improve the service. Clarity may set cookies or similar identifiers in your browser to recognize repeat visits and group page views into sessions. This includes:

• Pages you visit
• Features you use
• Browser and device type
• General location (country or region, not precise location)
• Session recordings: Clarity records how you interact with pages (clicks, scrolling, and what is shown on screen). Because Clarity runs on signed-in pages too, recordings can include stash and project text displayed on those pages

Account Settings

Settings you choose in the app (such as your preferred tab and timezone) are stored on your login profile with our authentication provider (Auth0) for as long as your account exists.

Cookies and Similar Identifiers

We use cookies to keep the app working. We do not use them for advertising. They include:

• Login cookies (set through Auth0): a short-lived cookie (about 5 minutes) that secures the sign-in process, and encrypted session cookies that keep you signed in for up to 3 days
• Preference cookies: a cookie that temporarily caches settings you just saved (up to 7 days), and a cookie that remembers when you dismiss a seasonal banner (up to 90 days)
• App session cookie: a signed cookie that remembers onboarding and import progress (up to 14 days)
• Analytics cookies (Microsoft Clarity): identifiers used to measure usage as described above, kept according to Microsoft Clarity's own retention policy

You can clear or block cookies in your browser settings. Blocking login cookies will prevent you from signing in.

2. How We Use Your Information

We use your information to:

• Provide and maintain the My Yarn Stash service
• Process your yarn and project data
• Run AI extraction on label photos when you request it
• Process payments and manage subscriptions
• Send important service updates and account notifications
• Improve the service and develop new features
• Respond to your support requests

3. Third-Party Services

We use trusted third-party services to operate My Yarn Stash. Your data may be processed by:

• Auth0: Handles user authentication and login
• Polar: Processes payments and manages subscriptions
• Supabase: Stores your stash data, project data, and photos
• Microsoft Clarity: Provides usage analytics and session recordings (using cookies or similar identifiers) to help us improve the service
• Replicate and OpenAI: Process label photos when you use AI extraction. Photos are sent only when you request extraction. We do not delete them from these services afterward, so they are kept according to Replicate's and OpenAI's own retention policies
• Google (Gemini): If the primary OpenAI model fails during an extraction you requested, the same label photos are automatically sent through Replicate to Google's Gemini model as a fallback, only to complete that extraction. Those photos are kept according to Replicate's and Google's own retention policies
• Google Fonts, unpkg, and html2canvas: Our pages load fonts from Google Fonts, signed-in pages load a script library from unpkg.com, and the Wrapped page loads a script from html2canvas.hertzen.com. Your browser contacts these services directly, so they receive your IP address and browser information

Each of these services has their own privacy policies and security measures. We only share the minimum information necessary for each service to function.

4. How Long We Keep Your Data

We retain your data for as long as your account is active. When you delete items, or ask us to delete your account:

• Yarn and projects you delete are soft-deleted (hidden but recoverable) for 15 days
• After 15 days, deleted items are permanently removed from our database. This automatic cleanup does not delete photo files stored in Supabase; those files remain until we remove them separately. Email hi@myyarnstash.app and we will remove them
• Account deletion requests sent to hi@myyarnstash.app are handled by us directly: we delete your stash and project data, and we remove your photo files from Supabase as a separate step, because automatic cleanup does not delete them
• Some records are not removed automatically: your login account (Auth0), your subscription with our payment processor (Polar), your plan and credit record, and payment webhook logs. Tell us in your deletion request if you want these removed too; we may need to keep some billing records where required by law
• Copies of deleted data may remain in database backups, which are kept for up to 7 days before being rotated out

We may retain certain information longer if required by law or for legitimate business purposes (such as resolving disputes or preventing fraud).

5. Your Rights

You have the following rights regarding your data:

• Access: You can view all your stash and project data within your account at any time
• Export: You can export your data (contact us at hi@myyarnstash.app for a full data export)
• Correction: You can edit your yarn and project information at any time through the app
• Deletion: You can delete individual yarn and project items in the app. To delete your entire account, contact us at hi@myyarnstash.app

If you're in the EU, UK, or California, you may have additional rights under GDPR, UK GDPR, or CCPA. Contact us to exercise these rights.

6. Security

We take reasonable measures to protect your data from unauthorized access, loss, or misuse. This includes:

• Encrypted connections (HTTPS)
• Secure authentication through Auth0
• Private storage with access controls
• Regular security updates

However, no system is completely secure. We cannot guarantee absolute security, but we work hard to protect your information.

7. Children's Privacy

My Yarn Stash is not intended for children under 13. We do not knowingly collect information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy occasionally. Significant changes will be announced via email or in-app notice. Continued use after changes means you accept the updated policy.

9. Contact

Questions about your privacy or this policy? Contact us at hi@myyarnstash.app.