Your source stays yours.

Images and pattern generation

JPEG, PNG and WebP files are read by your browser using Canvas. Pixels are not uploaded, stored in a database or visible to StitchMosaic. Object URLs are released when you remove the image or leave the page.

Text charts, blank canvases and QR charts are also constructed in your browser. The raw text or QR value is not sent as a product event. If you explicitly save to cloud or begin checkout, the resulting editable chart document—not a separate copy of the raw input—is stored for that requested feature.

Local drafts and export access

A generated chart can be saved in your browser's local storage so a refresh can restore it. Browser storage is optional for checkout. After payment, the download page verifies the order and reads the chart saved for that checkout from our server. Clear your site data or use the Clear draft control to remove the local draft; this does not delete an active purchased chart.

StitchMosaic has three explicit data modes: Local (browser-only drafts), Project file (a manual .stitchmosaic backup) and Sync (a signed-in, user-triggered cloud copy). The data modes guide describes the boundary between them.

Checkout

When Creem checkout is enabled, Creem processes payment details under its own privacy terms. StitchMosaic sends an opaque pattern reference, paper choice and product identifier, then uses the returned checkout identifier to verify payment on the server. A validated copy of the chart document is saved for order delivery; your source photo is never sent to Creem or saved with the chart.

First-party product events

To understand whether previews, checkout, recovery, exports and tracker tools work, the browser sends a small allowlisted event name with coarse settings such as product option or export format. A random first-party journey identifier is kept in local storage and HMAC-hashed before database storage. We do not store the raw identifier, IP address, source photo, chart pixels, checkout reference, recovery code or free-form event text. Events are deleted after 13 months and are not sent to an advertising network.

Optional account sign-in

If you choose to sign in, we store your normalized email after you verify a one-time magic link. The link expires after 15 minutes and is stored only as a hash. A random session identifier is stored in an HttpOnly, Secure cookie and the server stores only its hash for up to 30 days. Sign-in does not upload your source photo or automatically claim an anonymous purchase.

The account page provides a JSON export of your verified email, saved pattern documents, immutable version history, tags, version-bound stitch tracker progress and timestamps. Tracker progress contains completion flags, not source photo pixels. Deleting an account revokes sessions, invalidates sign-in links, removes chart versions, tracker progress and linked download activity, and irreversibly redacts retained chart records in the primary store. Necessary financial order and entitlement rows may be retained for legal, refund or dispute handling without the deleted chart content. Backups created before deletion expire within 30 days.

Questions

For privacy questions, email [email protected] or visit the support page.