AbriStitch Privacy Policy
Effective: 31.10.2026 · Version 1.0
Draft. A lawyer reviews this text before release; until then it is not the version in force.
This policy explains what personal data the AbriStitch app (iOS and Android) and its online services process, why, on what legal basis, for how long, who else receives it, and what rights you have. It applies under the EU General Data Protection Regulation (GDPR) and the Law of Ukraine "On Personal Data Protection".
In short
- The app works without an account and without your name. To keep your progress safe it creates an anonymous account on our server automatically.
- Your progress and the pattern files you import are stored on your phone and in your private cloud copy in the EU (Frankfurt, Germany). Nobody else can see your files.
- Posts you write in a pattern's discussion are public to other app users.
- Import statistics, crash reports and usage statistics are sent only if you allow it. An AI analyses your problem report only if you tick the box for that.
- No ads, no selling of data, no tracking across other apps or websites.
- You can delete your account and server data in the app: Settings → Account → Delete account.
1. Who is responsible
Controller: DREAM CAR, LTD LLC, 142-a, of. 11, vul. Shevchenka, Kharkiv 61013, Ukraine ("we"). We publish AbriStitch on the App Store and Google Play. AbriStitch is an app of the Abris Art brand; Abris Art is a trademark of Vadym Gryshyn. The Abris Art online shop is run separately by its own seller and has its own privacy policy; this policy covers only the app and its services.
Contact for privacy questions: art@abrisart.com (subject "AbriStitch privacy").
Our representative in the EU (GDPR Art. 27): to be announced. You can contact the representative instead of us on any matter of this policy.
We have not appointed a data protection officer because the law does not require one for our processing. The contact above handles all privacy requests.
2. What we process, why and on what legal basis
| What | Data | Why | Legal basis |
|---|---|---|---|
| Anonymous account | a random account ID, sign-in tokens, technical logs of server requests (IP address, time, app version) | to keep your progress apart from everyone else's and to protect the service | performance of the contract with you (GDPR Art. 6(1)(b)); for logs our legitimate interest in security (Art. 6(1)(f)) |
| Sign-in (optional) | email address; the account ID from Apple or Google; from Google also your name and profile picture if Google sends them | to let you restore your progress and files on a new phone | contract (Art. 6(1)(b)) |
| Progress and library | which cells you marked and when, parking markers, a random ID of each of your devices, the Abris Art kits you opened | to save and sync your progress | contract (Art. 6(1)(b)) |
| Your imported files (cloud copy) | the original file, its name, format, size, dimensions, title | to back up your patterns and restore them on a new phone | contract (Art. 6(1)(b)). You can turn the cloud copy off in Settings |
| Backup copy on our server | the same files | to keep your files available if the cloud provider fails | legitimate interest in availability and security of the service (Art. 6(1)(f)) |
| Converting Pattern Maker (.xsd) files | the file, while it is converted | the app sends .xsd files to our converter because the format cannot be read on the phone | contract (Art. 6(1)(b)). The converter does not keep the file; its log keeps only a checksum, the size and the result |
| Import statistics (if you allow) | per import: a quality score, counts of colours and stitches, error codes, app version, linked to your account ID; no file and no stitch data | to find and fix importer errors | your consent (Art. 6(1)(a)) |
| Files that do not import correctly (if you allow automatic sending, or when you tap "Send the file") | the file and a technical description of the error | so we can fix the importer and keep the file to check that the fix stays working | consent (Art. 6(1)(a)) for automatic sending; contract (Art. 6(1)(b)) when you send it yourself; afterwards our legitimate interest in reliable importers (Art. 6(1)(f)), see section 4 |
| "Report a problem" | your text and the import record | to answer you and fix the problem | contract (Art. 6(1)(b)) |
| AI analysis of a problem report (only if you tick the box) | your report text and the technical import facts; never the file, never your account ID | to find the cause faster | your explicit consent (Art. 6(1)(a)) |
| Pattern discussion | your post, its type (comment, information, question, proposal), time, your account ID (stored, not shown to others), an optional display name | to publish what you write to other users of the same pattern, and to moderate | contract (Art. 6(1)(b)); moderation and handling of reports: legitimate interest and legal obligations under the EU Digital Services Act (Art. 6(1)(f) and (c)) |
| Crash reports (if you allow, or when you tap "Send") | app version, system and its version, error type, error message and technical stack; no account ID | to fix crashes | consent (Art. 6(1)(a)) |
| Usage statistics (if you allow) | which screens and functions are used, app version, platform; no account ID | to understand what to improve | consent (Art. 6(1)(a)) |
| Support, rights requests, complaints | your name, email address and what you write | to answer you and to defend legal claims | contract, legal obligation, legitimate interest (Art. 6(1)(b), (c), (f)) |
Camera. The camera is used only to scan a kit QR code. The image is processed on your phone and is not sent to us.
What we do not do. We show no ads, do not sell or rent personal data, do not share it for advertising, do not track you across other companies' apps or websites, and do not make decisions about you by automated means that have legal or similarly significant effects. The import score and any AI analysis only help us fix our importers.
Do you have to give us data? No law requires it. Without the anonymous account the app cannot save progress on the server or sync; it still works on the phone. Everything marked "if you allow" is optional and the app works the same without it.
3. Your choices in the app
Settings → Privacy contains:
- Cloud copy of imported files (on by default). Turning it off deletes the server copies of your files; the files stay on your phone.
- Send import statistics, Send files that do not import correctly, Send crash reports, Send usage statistics (all off until you choose).
- Your account ID, to quote in requests to us if you have not signed in.
- Links to this policy, the Terms of Use and the copyright complaints page.
You can change these choices at any time. Withdrawing consent does not affect processing that already happened.
4. Your imported files in detail
Files you import can exist in up to four places:
- On your phone, as long as you keep the pattern or the app.
- In your private cloud copy (Supabase, Frankfurt, Germany), only reachable with your account. Not visible to other users.
- In a backup copy on our server (Hetzner, Germany), with the same lifetime as the cloud copy.
- In our importer test collection, only for files that did not import correctly, scored low, or that you sent us. We keep them so that every future version of the app is checked against them.
When you delete your account, copies 2 and 3 are deleted. A file in the test collection is then separated from you: it is kept under a checksum of its content only, without your account ID, the file name or any record of who sent it. If a file itself contains personal data (for example a buyer's name printed on a purchased PDF), or if you simply want it removed, write to us and we delete it. We also remove a file when a rights holder sends a justified notice (see the copyright complaints page).
Please import only files you have the right to use, for example patterns you bought.
5. Public discussion
Posts in a pattern's discussion can be read by every app user who opens that pattern. Do not write personal data you would not want to share. Other users do not see your account ID; they see your display name or "Stitcher". You can delete your own posts at any time. We may hide posts that break the Terms of Use or the law; you will see the reason in the app.
6. Who receives your data
We use service providers that process data only on our instructions under a data processing agreement (GDPR Art. 28):
| Provider | What for | Where the data is |
|---|---|---|
| Supabase Inc. (USA) | database, accounts, file storage, server functions | EU, Frankfurt (Amazon Web Services) |
| Hetzner Online GmbH (Germany) | file converter, backup copy | Germany |
| Cloudflare, Inc. (USA) | secure network connection to our converter and website; encrypted backups of our server | worldwide network; storage in the EU |
| Anthropic PBC (USA) | AI analysis of a problem report, only with your consent | USA; deleted by Anthropic within 30 days |
| Google (Google Workspace) | sending sign-in codes by email | Ireland / EU |
Apple and Google act as independent controllers when you use Sign in with Apple or Google Sign-In, and when you download the app from their stores; their own privacy policies apply.
We disclose data to authorities only where the law obliges us to.
7. Transfers outside the EU
Your data is stored in the EU. Supabase, Cloudflare and Anthropic are US companies; where their staff or systems access data from outside the EU, the transfer is protected by the European Commission's Standard Contractual Clauses in our agreements with them and, where the company is certified, by the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards.
We are based in Ukraine. Ukrainian law permits the transfer of personal data to EU countries. Transfers to the USA for the AI analysis take place only with your consent.
8. How long we keep data
| Data | Kept |
|---|---|
| Anonymous account with its progress and files | until you delete it; an account with no activity for 24 months is deleted automatically |
| Signed-in account with its progress and files | until you delete it; after 5 years without activity we email you and delete it 60 days later unless you sign in |
| Cloud copy and backup copy of a file | until you delete the pattern, turn the cloud copy off or delete your account; backups roll over within 30 days |
| Files in the importer test collection | as long as needed to test our importers, reviewed every 2 years; separated from you when you delete your account (section 4) |
| Import statistics | 3 years linked to your account ID, then without it |
| Problem reports | with the import record |
| Discussion posts | until you or we delete them, or until your account is deleted; hidden posts 6 months, for complaints |
| Crash reports and usage statistics | 12 months |
| Server request logs | up to 30 days |
| Support emails, requests, complaints | 3 years after the last contact |
| Data sent to Anthropic | deleted by Anthropic within 30 days |
9. Your rights
You have the right to: access your data and get a copy (GDPR Art. 15); correct it (Art. 16); erase it (Art. 17); restrict processing (Art. 18); receive your data in a portable format (Art. 20); object at any time to processing based on our legitimate interest (Art. 21); withdraw consent at any time (Art. 7(3)).
How:
- Delete everything on the server: Settings → Account → Delete account. This deletes your account, progress, library, cloud and backup copies, import records, discussion posts and every linked sign-in. Data kept only on the phone stays there until you delete the app. Without the app: see stitch.abrisart.com/delete
- Everything else: email art@abrisart.com. If you have not signed in, include your account ID from Settings → Privacy so we can find your data. We answer within one month.
Under the Law of Ukraine "On Personal Data Protection" (Art. 8) you also have the right to know the source, purpose and recipients of your data, to object to processing, and to protection against unlawful processing.
Complaints. You can complain to the data protection authority of your country, for example: Poland, UODO (uodo.gov.pl); Germany, the authority of your federal state (list at bfdi.bund.de); France, CNIL (cnil.fr); Spain, AEPD (aepd.es); Italy, Garante (garanteprivacy.it); Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua). We would appreciate the chance to solve the issue first.
10. Children
AbriStitch is not directed at children under 13, and you must be at least 13 to use it. If you are under 16 (or the age of digital consent in your country), ask a parent before writing in discussions or turning on the optional "Send ..." switches. If you believe a child under 13 uses the app, write to us and we will delete the data.
11. Security
Data is transmitted over encrypted connections (HTTPS) and stored with access control so that each account sees only its own data. Abris Art kit patterns are delivered encrypted. Only a small number of authorised people can access the servers. If a breach puts your rights at high risk, we will tell you without undue delay.
12. Changes
We will publish any change here with a new date and version. We will tell you about important changes in the app before they apply. Where a change needs your consent, we will ask for it.
Previous versions: on request.