Privacy Policy

1. Overview

Quiltacy is a personal archive tool for quilters. We collect only what is necessary to provide the service, we do not sell your data, and we do not use your content for advertising or AI training. This policy explains what we collect, how we use it, and your rights.

2. Information We Collect

Account information

When you create an account, we collect your email address. We use this to authenticate you, send account-related notifications (password resets, billing receipts), and occasionally send product updates. You can unsubscribe from non-essential emails at any time.

Marketing list signups

If you give us your email address through a signup form on our site, for example to get a free template or to receive our newsletter, we collect that email address (and your first name, if you provide it) so we can send you quilting tips and Quiltacy updates. You don't need an account to sign up, and you can unsubscribe at any time using the link in any email.

Project records and content

Everything you enter into Quiltacy (project names, patterns, fabrics, costs, notes, custom fields, works in progress, and photos) is stored on your behalf so you can access it from any device. This content belongs to you.

Billing information

If you subscribe to a paid plan, payment is processed by our payment provider. We do not store your full card number, CVV, or other raw payment data. We receive a customer ID and subscription status from the payment provider to manage your access.

Usage information

We may collect basic technical information such as browser type and general usage patterns to help diagnose issues and improve the service. We do not use third-party advertising trackers. We also collect limited usage data to operate and improve Quiltacy, including when you generate a PDF record, export your data, or change your subscription plan. This information is used only internally by Quiltacy, is never sold, and is shared only with the service providers listed below who process it on our behalf.

3. How We Use Your Information

• To provide, operate, and maintain the Quiltacy service
• To authenticate you and keep your account secure
• To process payments and manage your subscription
• To respond to support requests and contact form messages
• To send transactional emails (receipts, password resets, important account notices)
• To improve the service based on aggregate, anonymized usage patterns
• To collect limited usage data (such as PDF generation, data exports, and subscription changes) for internal operational analytics only

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

Contract

We process account information, project records, and billing data as necessary to provide the Quiltacy service and fulfill our contract with you.

Legitimate interests

We process limited usage and technical data to:

• maintain and improve the service
• diagnose bugs and performance issues
• ensure platform security

Consent

We rely on your consent to send optional product updates and marketing communications. You can withdraw consent at any time by unsubscribing.

Legal obligation

We may retain certain billing and transaction records where required for tax, accounting, or legal compliance.

5. Third-Party Services

Quiltacy uses the following third-party services to operate:

• Supabase: stores your account data, project records, and photos. Supabase acts as a data processor on our behalf and does not use your data for its own purposes. Data is stored on servers in the United States.
• Polar: processes subscription payments. Polar acts as the Merchant of Record for your subscription, which means they handle payment processing and tax collection. Their privacy policy governs how they handle your payment information.
• Vercel: hosts and serves the application. Vercel may process request data (such as IP addresses) in the normal course of serving web traffic.
• PostHog: provides product analytics that help us understand how the service is used and where to improve it. We use it to collect anonymous pageview and interaction data only; we do not send PostHog your email address or link analytics to your identity, and it is never used for advertising. This data is processed on servers in the United States.
• Resend: delivers account and authentication emails (such as signup confirmations and password resets) on our behalf. It processes your email address and the contents of those messages solely to deliver them. Resend is based in the United States.
• Brevo: manages our marketing email list and sends our newsletter and tips. It processes your email address (and first name, if you provide it) solely to deliver these messages and let you unsubscribe. Brevo is based in France (European Union).

6. International Data Transfers

Some of our service providers are located outside the United Kingdom. Where we transfer your personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or UK-approved data transfer mechanisms to ensure your information remains protected.

7. Public Gallery

The public gallery feature (Premium plan) lets you share a link to your complete archive with anyone. When enabled, the project records and photos you choose to include are accessible without a login. You control what is shown and can disable the gallery at any time. Disabling it immediately removes public access.

8. Data Retention

We retain different types of data for different periods depending on the purpose for which they are collected.

Account and project data

While your account is active, we retain your project records, photos, and related project data so you can access and manage your archive.

If you cancel your subscription or downgrade to the free plan, we retain your full archive for 60 days to allow you time to reactivate your account or export your data. After this 60-day period, we retain up to your 5 most recent project records, which is the amount included with the free tier at no cost. Any remaining data beyond 5 project records is permanently deleted, along with the associated photos, in line with our data minimization and storage limitation practices.

Retaining this limited set ensures that all users receive a consistent baseline level of service, whether they are new or returning from a paid subscription, and allows accounts to remain usable without immediate data loss after a subscription change.

Account deletion

If you request deletion of your account, we will permanently delete your personal data, project records, and photos within 30 days, unless we are required to retain certain information for legal, tax, or accounting purposes.

Billing data

We retain limited billing records for as long as required by law for tax and accounting obligations.

Why we retain data

We apply these retention rules to:

• ensure you can recover your data after accidental cancellation
• limit storage costs for free-tier accounts
• comply with legal obligations
• minimize the amount of personal data we store over time

9. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Export your project records
• Restrict or object to certain types of processing
• Delete your account and all associated data
• Opt out of non-essential communications
• Lodge a complaint with the UK Information Commissioner's Office (ICO)

To exercise any of these rights, use the contact page. We will respond to all valid data requests within 30 days.

10. Cookies

Quiltacy uses cookies only for authentication, to keep you signed in between sessions. We do not use advertising cookies or third-party tracking pixels.

11. Children's Privacy

Quiltacy is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page and notify you by email. Continued use of the service after changes take effect constitutes your acceptance of the revised policy.

13. Contact

Questions about this policy? Use the contact page.