Privacy Policy

This policy explains what Crochet 3D does with personal information: what we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it. It covers the website at crochet3d.com and everything you can reach from it — the pattern editor, the gallery and your account — and the Crochet 3D app for iPhone and iPad, which works with the same account. Where the app collects something the website does not, this policy says so in the same place.

1. Who we are

• Legal name: Individual Entrepreneur George Papashvili (sole proprietor under Georgian law), trading as Crochet 3D
• Identification number: 01015001988
• Registered address: Angisa II Lane, N 8, Building B, Flat 1002a, Batumi, Georgia
• Contact: hello@crochet3d.com

We are the controller of the personal information described here. The business is registered in Georgia (the country) as an individual entrepreneur — a sole proprietorship, so the controller is the owner in person — and you can verify it independently at the National Agency of Public Registry.

2. What we collect

Only what the product actually needs. In the language of the US state privacy laws:

• Identifiers — your email address, and the display name you choose. If you sign in with Google, we receive your email address, name and profile picture from Google; we never receive your Google password. If you sign in with Apple, we receive your email address — or, if you choose to hide it, an address Apple forwards to yours — and, the first time only, the name you choose to share; Apple gives us no picture, and we never receive your Apple Account password. A pattern you share to the gallery is signed with your display name; if you have not chosen one, it is signed with your first name and the initial of your surname as Google or Apple gave them to us (for example “Anna K.”). Your email address is never shown on a pattern. You can set a different name at any time under Settings → Profile, and the patterns you have already shared follow the change. The picture is copied once into our own storage so that your browser never has to request it from Google, it is shown only to you, and you can remove it at any time under Settings → Profile. If you choose one of our built-in profile pictures instead, that choice replaces it — and unlike the Google picture, the drawing you pick is public: it appears beside your name on any pattern you share in the gallery. It is one of our own illustrations, not a photograph of you.
• Account credentials — your password, stored only as a salted hash by our authentication provider. We cannot read it.
• Your choices — whether you asked for marketing email and when you told us, whether you switched off our tips emails, and which version of these documents you accepted when the account was created. A consent nobody can evidence is worth nothing to either of us, which is why the answer is dated rather than merely stored.
• Content you create — the crochet patterns you write, their names and settings, the 3D preview images generated from them, and anything you choose to publish to the gallery.
• Commercial information — if you buy a paid plan: which plan, its status, the currency and amount agreed, the renewal date, and the order, payment and invoice records the law requires us to keep.
• Billing details — the name, billing country and, if you give one, the tax id you enter at checkout. You enter them on our payment partner’s page, not ours: the partner is the merchant of record and needs them for the receipt and the tax. What comes back to us is your billing country and the currency of your plan.
• Payment data — we never receive or store your card number. You type it on our payment provider’s own page. What comes back to us is the outcome of the payment, the last details needed to identify it, and a token that stands in for the card so that a renewal or a refund can be made against it. The token is useless anywhere else and cannot be turned back into a card number.
• The trial record — if you start a free trial, a one-way fingerprint (a hash) of your email address, the plan, the dates and how the trial ended. It exists for one purpose: a trial is offered once per person, and this is how a second account under the same address is recognised. It cannot be turned back into the address.
• Internet activity and device data — IP address, browser type and pages requested, recorded in server logs for security, abuse prevention and diagnosing faults.
• Activity on your account — a short, recent record of what you did here: opening the planner, viewing or opening a shared pattern, liking one, renaming, sharing or unsharing your own, changing your display name or profile picture, using one of the free tools, opening the pricing page, sending a bug report, and reaching the payment page. It holds the event and the name of the thing it was about — never what you wrote in a pattern, and nothing read from your browser or connection. It is how we can answer “I pressed Share and nothing happened” instead of guessing, and it is limited on purpose: the last 500 events, and nothing older than 180 days, whichever comes first. You can read it too — ask us and we will send you your own, exactly as we see it.
• How far you have got with the product — a short list of first-time marks on your account: that you opened the planner, worked your first stitch, reached ten rounds, saved a pattern, asked for an export or were refused one, filled your plan’s pattern shelf, saw an upgrade prompt, reached the payment page, subscribed, and whether you came back a day and a week after signing up. Each is recorded once, the first time it happens, with the date and nothing else — never a pattern, never a page address, never anything read from your browser or your connection, and never a second entry however often you do the same thing again. It is how we can see where people get stuck instead of guessing. You can read yours too — ask us, or it comes with the copy of your information.
• Anonymous product counts — how many times a day something happened here: a pricing page opened, a plan card pressed, an export asked for, a survey answered. These are totals and nothing else. They carry no account, no identifier of any kind, no address and nothing that could be traced back to you or to your device — which is why they are also counted for visitors who never sign in, and why there is nothing in them for us to show you, correct or delete.
• The emails we send you — for each product email (a tip, or news and offers if you asked for them): which one it was, when it went out, and what happened to it afterwards — whether it was delivered or bounced, whether our email provider saw it opened (it does so with a small image, which your mail app may block or load on its own), which of its links you followed, and whether you unsubscribed or reported it as spam. The links pass through our own address for a moment so that we can count a click; they carry no identifier beyond the email they came in. Account email (sign-in links, password resets, subscription notices) is not part of this record.
• Things stored in your browser — preferences, locally saved patterns and the sign-in session. These stay on your device; the full list, including how long each one lasts, is in the cookie notice.
• Correspondence — what you write to us, so we can answer.
• In the iPhone and iPad app — everything above that applies to the website applies to the app too, and the app adds:
  • Purchases through the App Store. If you subscribe in the app, Apple sells you the subscription and takes the payment; we never see your card or your Apple Account details. Apple sends us a signed record of the purchase — which plan, its dates, whether it renews, whether it was cancelled or refunded, and Apple’s identifiers for the transaction — together with your account’s id, which the app attaches so that the plan reaches your account, in the app and on the website alike. Apple also tells us when a renewal, a cancellation or a refund happens.
  • The notification token. If you allow notifications, Apple gives the app an address for your device. We keep it with your account, together with the app version and whether it came from a test build, so that a notification meant for you reaches your devices — at most ten of them. It identifies the device to Apple’s notification service and to nothing else.
  • Bug reports sent from the app carry the details the report form shows you before it is sent — the iOS version, the screen size and the graphics chip — so that the fault can be reproduced, and a screenshot or a photo if you add one.
  • Photos. The app asks for the camera only when you take a photo for a bug report, and for permission to add to your photo library only when you save a picture or video of a pattern there. It cannot read your library.
  • On the device — your sign-in session, kept in the iPhone’s or iPad’s Keychain; a pattern saved while there is no connection, kept until it can be uploaded; and your preferences. The app uses no cookies, and runs no analytics or advertising technology at all.
• Reports and blocks — if you report a gallery pattern, we keep the report (the pattern, the reason you chose, any note you wrote, and that it came from your account) so that we can review it and act on it; the person you reported is never told who reported them. If you block a member, we keep that choice on your account so that their patterns stay out of your gallery; they are not told either. You can lift a block at any time in Profile.

We do not collect special-category data (health, biometrics, political or religious views, and so on), and we ask you not to put such information into pattern names or descriptions.

3. Why we use it, and on what legal basis

• To provide the service — creating your account, saving and rendering your patterns, running the gallery, and delivering a paid plan you bought — including one bought through the App Store, which is why Apple’s record of it is kept with your account. Legal basis: performance of a contract.
• To send you notifications in the app — only if you allowed them on your device, and you can switch them off at any time in the iPhone’s or iPad’s Settings. Legal basis: consent, given in the system’s own permission prompt.
• To keep it working and safe — preventing bots, abuse and fraud, keeping backups, and fixing faults. Legal basis: legitimate interests.
• To keep the gallery safe — reviewing reports, removing content that breaks the community rules in the Terms, and keeping the blocks you set. Legal basis: legitimate interests (a gallery others can use without abuse), and, for your own blocks, performance of a contract.
• To support you — the recent activity record described above, so that a question about your own account can be answered from what actually happened. It is kept per account and read by us only to help you or to look into a problem; it is never used to profile you, to decide anything about you automatically, or for advertising. Legal basis: legitimate interests, balanced against the limits in section 7.
• To see where the product falls short — the first-time marks and the anonymous counts described above, so that “most people stop before they have saved anything” is something we can know rather than suspect, and so that what we build and what we charge for follow from it. Read only as totals, never to profile you, never to decide anything about you automatically, and never for advertising. Legal basis: legitimate interests, balanced against the limits in section 7.
• To communicate — sign-in links, password resets, and notices about your account or material changes to this policy. Legal basis: contract and legal obligation.
• To help you get started — a few emails in your first days with the product, with tips on using the planner. They sell nothing, every one of them has a link to switch them off, and switching them off changes nothing else. Legal basis: legitimate interests (helping the people who signed up use what they signed up for), and your right to object, which the link exercises.
• To send you news about the product — occasional email about new features, patterns and offers, only if you opted in. It is a separate choice from the account itself, you can change it whenever you like under Preferences in your account settings, and every such message carries an unsubscribe link. Legal basis: consent.
• To know whether our emails work — the delivery, bounce, open, click and unsubscribe record described above, read as totals per email (“did the tutorial help anybody save a pattern?”) and, one account at a time, only to answer a question about that account. It is never used to profile you, to decide anything about you automatically, or for advertising. An address that bounces or reports our email as spam is not mailed again. Legal basis: legitimate interests.
• To understand how the product is used — aggregate statistics, only if you allow analytics. Legal basis: consent (EU/UK), or your opt-out right (US).
• To meet our obligations — accounting and tax records for paid orders. Legal basis: legal obligation under Georgian law.

4. Who else processes it

We use the service providers below. Each acts on our instructions under a data processing agreement, and none of them may use your information for their own purposes.

• Supabase, Inc. — Accounts and authentication, and the database holding your profile, pattern metadata and subscription status. (United States (company); our database instance is hosted in Canada (Montréal). privacy policy)
• Cloudflare, Inc. — Hosting, content delivery, DNS, storage of your pattern files and preview images (R2), bot protection on the sign-in forms (Turnstile), and delivery of account email — sign-in links, email confirmations, password resets and account notices. (United States, with delivery from data centres worldwide. privacy policy)
• Google LLC (Google Analytics) — Aggregated statistics about how the site is used — which pages are opened, which features are reached, and how people find us. IP addresses are shortened by Google before storage and are not used to identify you. If you decline analytics, it runs in a cookieless mode that stores nothing on your device and creates no identifier for you. (United States and Ireland; certified under the EU–US Data Privacy Framework, with standard contractual clauses for other transfers. privacy policy)
• Meta Platforms, Inc. — Measuring our ads and showing Crochet 3D to people with similar interests on Facebook and Instagram. Only with your consent to advertising cookies; purchases are also reported from our server, under the same consent. (United States and Ireland; certified under the EU–US Data Privacy Framework. privacy policy)
• Reddit, Inc. — Measuring our Reddit ads and showing Crochet 3D to people with similar interests on Reddit. Only with your consent to advertising cookies. (United States; standard contractual clauses for transfers. privacy policy)
• Pinterest, Inc. — Measuring our Pinterest ads and showing Crochet 3D to people who save similar crochet ideas. Only with your consent to advertising cookies. (United States and Ireland; standard contractual clauses for transfers. privacy policy)
• TikTok Pte. Ltd. / TikTok Technology Limited — Measuring our TikTok ads and showing Crochet 3D to people with similar interests on TikTok. Only with your consent to advertising cookies; sign-ups, trials and purchases are also reported from our server, under the same consent. (Singapore, Ireland and the United States; standard contractual clauses for transfers. privacy policy)
• Creem (Armitage Labs OÜ) — Selling the paid plans as merchant of record: taking the card payment on its own checkout page, charging renewals, collecting and remitting any tax due on the sale, issuing the receipt for each payment, and paying refunds back. Your card details are entered on their page and never reach us; what comes back to us is the outcome of each payment, the subscription's status and your billing country. Their name appears on your card statement. (Estonia (European Union); card processing by its payment partners in the EU and the United States. privacy policy)
• Apple Inc. (and Apple Distribution International Ltd. in the EU) — Selling the paid plans in the iPhone and iPad app through the App Store: Apple takes the payment, charges renewals, handles tax and refunds, and tells us which plan you bought and when it renews, ends or is refunded — never your card or your Apple Account. Apple also delivers the app's notifications to your devices, and runs Sign in with Apple if you choose it. (United States, and Ireland for customers in the European Union. privacy policy)
• Brevo (Sendinblue SAS) — Sending our product emails (a few tips to help you get started and, if you opted in, news and offers) and telling us whether each one was delivered, bounced or reported as spam. (France (European Union). privacy policy)

Anything that runs in your browser — analytics or advertising technology, present or future — is listed in the cookie notice, which is generated from the same configuration the site loads from and is therefore always current.

5. Do we sell or share your personal information?

Yes, in the specific sense those words carry under California law. Some advertising technology on this site shares identifiers with advertising partners for cross-context behavioural advertising, which the CCPA/CPRA treats as “sharing” even though no money changes hands. You can switch this off at any time using the Your Privacy Choices link in the footer, and we honour Global Privacy Control signals automatically. We do not sell your information for money, and we do not knowingly sell or share the information of anyone under 16.

6. Where your information goes

We are established in Georgia, our database instance is hosted in Canada, and the providers listed above are established in the United States, the European Union, Georgia and India. Personal information therefore crosses borders. For transfers out of the EEA or the UK we rely on the European Commission’s adequacy decision for Canada, and on Standard Contractual Clauses (with the UK Addendum where relevant) for the rest — you can ask us for a copy of the safeguard that applies to a given provider.

7. How long we keep it

• Account and content — for as long as your account exists. Delete your account and it goes with it, as described below.
• Patterns published to the gallery — removed with your account, except that copies other users have already saved to their own devices are outside our reach.
• Reports — kept as the record of what was reported and what we did about it. Deleting your account removes your blocks and detaches you from the reports you filed; the report itself stays, without your name.
• Orders and invoices — for the retention period Georgian accounting law requires, even after the account is deleted. The billing name and address you gave are part of the invoice and stay on it, because an invoice cannot be rewritten after it is issued. This is an obligation we cannot waive, and it is the one thing deleting your account does not reach.
• An App Store purchase — the plan record goes with the account. The notices Apple sent us about the purchase are kept as our record of the sale, like an order above. The purchase itself — its receipt, its renewals and any refund — is held by Apple, under Apple’s own retention rules.
• The notification token — until you sign out of the app on that device, until Apple tells us it no longer works (for example because the app was removed), or until the account is deleted, whichever comes first.
• The card token — kept on your subscription record while the account exists, and deleted with the account. Once a subscription is cancelled the token is not used again: the agreement behind it is revoked at the payment provider, so there is nothing left for it to authorise.
• The trial record — kept after the account is deleted, because deleting an account and creating another under the same address is exactly the case it exists for. What remains is the hash and the dates: nothing in it names you or can be traced back to the address.
• Your marketing choice, and the dated record behind it — for as long as the account exists. Withdrawing stops the email and is itself recorded; deleting the account removes the choice and the record together.
• The activity record — the last 500 events on your account, and nothing older than 180 days, whichever limit comes first. Older entries are deleted as new ones arrive, not on a schedule we might forget to run, and the whole record goes when the account does.
• The first-time marks — for as long as the account exists, one row per mark, and the whole set goes when the account does. There is no history behind them to expire: a mark is written once and never again.
• The anonymous counts — kept as daily totals. They contain no account and nothing that identifies anybody, so there is nothing in them that could be deleted with one.
• The record of the emails we sent you — for as long as the account exists, and it goes when the account does.
• The do-not-send list — an address that bounced as non-existent, or whose owner reported our email as spam or asked us never to write, stays on it, even after the account is deleted: that is the only way to make sure it is never mailed again. It holds the address, the reason and the date, nothing else, and you can ask us to remove yours.
• Server logs — up to 90 days, then discarded.
• Support email — up to 24 months after the conversation ends.

8. Your rights and how to use them

Wherever you live, you can ask us to give you a copy of your information, correct it, or delete it, and we will not treat you worse for asking. If you are in the EEA or the UK you also have the rights to restrict or object to processing, to portability, and to withdraw consent at any time without affecting what was lawful before. If you are in California, Colorado, Connecticut, Texas, Virginia or another US state with a privacy law, you have the equivalent rights to know, delete, correct, opt out and — where the law provides it — appeal a refusal.

The practical routes:

• Delete everything yourself — the account menu has “Delete account”. It removes your profile, your patterns, your uploaded files, your gallery entries, your activity record, your first-time marks, the record of the emails we sent you and your billing details. It is immediate and cannot be undone. If a paid subscription is still running, cancel it on the billing page first — that stops the payment provider before the account it belongs to goes, so nothing can be charged afterwards. Invoices already issued stay, for the reason given in section 7. In the app the same button is under Profile. A subscription bought in the app is Apple’s to end, not ours: deleting the account does not cancel it, and Apple goes on charging it until you cancel it in your device’s Settings → your name → Subscriptions.
• Marketing email — the switch under Preferences in your account settings, at any time. Every message we send carries an unsubscribe link too, and either route is the same decision: we hold one record of it, and the switch is what it reads. Withdrawing has no effect on anything else — your account, your patterns and any paid plan are untouched.
• Tips emails — the link at the bottom of any of them opens a page where you can switch the tips off (and the news and offers too, separately). Your mail app’s own “unsubscribe” button does the same for the kind of email it is on.
• Cookies and trackers — the “Cookie settings” link in the footer, at any time. We honour Global Privacy Control automatically.
• Everything else — email hello@crochet3d.com. We answer within 30 days, and will tell you if we need longer. We may ask you to confirm control of the email address on the account before acting, so that nobody can use these rights against you. You may use an authorised agent where the law allows it.

If you think we have got it wrong, tell us first — but you can also complain to a regulator: the data protection authority of your country of residence in the EEA or the UK, the Personal Data Protection Service of Georgia, or your state attorney general in the US.

9. Children

Crochet 3D is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, write to us and we will delete it. Where the GDPR applies, users under 16 need a parent’s or guardian’s permission before consenting to optional cookies.

10. Security

Traffic is encrypted in transit (TLS), passwords are stored only as hashes, and access to the database is restricted by row-level security so one account cannot reach another’s data. Administrative access inside our team is limited to who needs it and is logged. No system is perfectly secure; if a breach affects your personal information we will notify you and the relevant authorities as required by law.

11. Changes

When this policy changes materially we will update the date at the top and, where it matters to you, tell you by email. The cookie notice tracks its own date automatically, because it is generated from what the site actually loads.

12. Contact

hello@crochet3d.com, or by post to Individual Entrepreneur George Papashvili, Angisa II Lane, N 8, Building B, Flat 1002a, Batumi, Georgia.

See also our Terms of Service and the cookie notice.