1. Who we are
CraftCanvas is a pattern design studio for bead weaving and related crafts. It is run by Cub Lake Capital LLC, an Ohio company. When this policy says "we" or "us", it means that company. When it says "the service", it means the CraftCanvas web app at https://www.craftcanvas.app, the CraftCanvas iOS app, and the accounts behind them.
This policy explains what information we collect, why, who we share it with, and the choices you have. It applies to everyone who uses the service, whether or not they have an account.
2. What we collect
In plain termsYour account details, the patterns and images you put into the studio, billing records from Stripe, and technical information that keeps the service running. We only collect usage analytics if you say yes to the cookie notice.
Information you give us
- Account. Your name, email address, a username, a password (stored only as a one-way hash), and an optional avatar image.
- Sign in with Google or Apple. If you use one of these, the provider sends us your name, email address, and an identifier for your account with them. We never see your Google or Apple password.
- Your work. The patterns, projects, palettes, color choices, bead stash, Restock lists, and version history you create. Images you upload to convert into a pattern. Comments, favorites, follows, and anything you choose to publish to the community.
- Messages to us. Anything you send to support, including feedback submitted from inside the app.
Information we collect automatically
- Technical logs. When your browser or the app talks to our servers we record the request, your IP address, browser or device type, and timestamps. We use these to keep the service secure and to diagnose problems.
- Error reports. If something goes wrong, an error report is sent to Sentry. It contains the technical details of the failure and may include your account identifier so we can find and fix the problem for you.
- Usage analytics, only with your consent. If you accept the cookie notice, we use PostHog and Google Analytics to see which parts of CraftCanvas people use and where they get stuck. If you decline, no analytics cookie is set: PostHog is never loaded, and Google Analytics keeps only anonymous page counts that are not tied to your browser. You can change your answer at any time from "Cookie preferences" in the footer.
- Visits to published pages, counted but not tracked. When someone opens a pattern a maker has published, or a creator profile, we add one to that day’s count so the maker can see how their work is doing. To avoid counting the same person twice in a day we make a scrambled, one-way code from the visitor’s IP address and browser, keep only that code, and delete it the same day. The address itself is never stored, the code cannot be turned back into it, and nothing links a visit to a person or follows anyone between pages. What is kept is a number per day, and which site the visit came from as a broad category such as “Pinterest” or “direct”. This sets no cookie, so it is not part of the cookie notice.
- Collaboration presence. When you work on a shared project, other collaborators can see that you are present and where your cursor is. This is not stored after the session ends.
Billing information
Payments on the web are handled by Stripe. Your card number goes directly to Stripe and never touches our servers. We keep the Stripe customer and subscription identifiers, your plan, its status, the billing interval, and the amount charged, so we can give you the features you paid for and answer billing questions. Purchases in the iOS app are handled by Apple, and we receive a transaction identifier, not your payment details.
3. How we use it
In plain termsTo run the studio, bill you correctly, keep your account safe, fix what breaks, and improve the product. We do not sell your information and we do not show ads.
- Providing the service: storing your projects, syncing them between devices, and rendering shared and published patterns.
- Accounts and security: signing you in, verifying your email, resetting passwords, detecting abuse, and protecting against fraud.
- Billing: charging subscriptions, applying the right plan to your account, handling failed payments, refunds, and disputes, and keeping the records tax law requires.
- Support: answering your messages and investigating problems you report.
- Improving CraftCanvas: understanding, in aggregate, which features are used and which are not, when you have consented to analytics.
- Communication: sending the emails the service needs (verification, password reset, receipts, notices about your subscription, changes to these terms, and a notice if something you published is hidden and why), a small number of emails about getting started and what is new in CraftCanvas, and, only if you turn it on, a weekly email listing the patterns published by the makers you follow. Every email that is not needed to run your account has an unsubscribe link, and you can turn them off in Settings.
- Keeping the community usable: checking what you publish, and your profile picture and logo, against the rules in the terms, with an automated image check at upload and once a night, and, when something is flagged or reported, a person.
- Legal: complying with the law and enforcing our Terms of Service.
Where the law requires a legal basis (for example in the European Economic Area or the United Kingdom), we rely on the contract we have with you to provide the service, on our legitimate interests in running and securing it and in telling you about the product you signed up for, on your consent for analytics, and on our legal obligations for billing records.
6. How long we keep it
In plain termsAs long as you have an account, plus a 30 day window to change your mind after you delete it. Billing records stay longer because tax law says they must.
| Data | Kept for |
|---|---|
| Account and projects | Until you delete your account. Deleting it hides your account and your work immediately. Signing in again within 30 days restores everything; after 30 days the account and its projects are permanently deleted. |
| Published patterns | Until you unpublish them or delete your account. |
| Billing records | Seven years after the transaction, as required for tax and accounting. These records do not include your card number. |
| Technical logs and error reports | A short period, typically no more than 90 days, for security and debugging. |
| Analytics | Aggregated after collection; per-browser data is kept by PostHog for up to one year and by Google Analytics for up to fourteen months. |
7. Your choices and rights
In plain termsYou can see, change, export, and delete your information yourself from the app. If you want something we have not built a button for, email us.
- Access and correction. Your profile and settings are editable in the app. Your projects are yours to open, change, and export at any time.
- Deletion. Delete your account from Settings. Any subscription stops at the end of the current billing period. See "How long we keep it" for what happens to your data.
- Analytics. Accept or decline at the cookie notice, and change your answer any time from the footer.
- Email. Account emails (verification, receipts, security notices, changes to these terms) come with the service and cannot be turned off. Emails about getting started, tips, and news, and the weekly email about makers you follow (off unless you turn it on), can be turned off in Settings under Notifications, or with the unsubscribe link in any of them.
- Portability, objection, and restriction. If you are in the European Economic Area, the United Kingdom, or another place with similar rights, you can ask us for a copy of your information in a portable form, ask us to restrict or stop processing it, or complain to your local data protection authority.
- California and other US states. You have the right to know what we collect and why, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context advertising, so there is nothing to opt out of.
To exercise any of these, email craftcanvas.support@gmail.com from the address on your account. We will respond within 30 days.
8. Security
Everything between your device and our servers is encrypted in transit. Passwords are stored only as salted hashes. Access to production systems is limited to the people who operate the service. Card details are handled by Stripe and Apple, both of which are certified to the payment card industry's security standard, and never reach us.
No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and the relevant authorities as the law requires.
9. Where your information lives
We are based in the United States and our servers and service providers are located there. If you use CraftCanvas from elsewhere, your information is transferred to and processed in the United States. Where a transfer mechanism is required, we rely on standard contractual clauses with our providers.
10. Children
CraftCanvas is not directed at children under 13, and we do not knowingly collect information from them. If you are between 13 and 18, use the service with a parent or guardian's permission. If you believe a child under 13 has given us information, email us and we will delete it.
11. Changes to this policy
When we change this policy we will update the effective date at the top. If a change meaningfully reduces your rights or expands what we collect, we will tell you by email or with a notice in the app before it takes effect.
12. Contact
Questions, requests, or complaints about privacy go to:
Cub Lake Capital LLC (operating as CraftCanvas), Ohio, United Statescraftcanvas.support@gmail.com