Privacy, mapped clearly

1. The short version

Most of the pattern maker runs entirely in your browser. Image decoding, color matching, editing, bead counts, PNG export, and print/PDF preparation happen on your device.

Browser storage keeps your language preference, build-along progress, and dismissed tips. If you allow anonymous metrics, it also keeps delivery markers and one coarse UTC visit day. These values stay on your device and can be cleared in your browser.

When you allow anonymous product metrics, we count fixed workflow milestones, new or returning browser-day buckets, and the first, second, fifth, and tenth successful generation in a tab. We do not create user identifiers, send the stored visit day, keep event-level histories, or include your image, pattern contents, file name, title, or author.

When you allow metrics, Google Analytics loads and may use analytics cookies or similar identifiers to measure page views, traffic sources, device and browser categories, tool-entry clicks, content-depth milestones, fixed workflow events, and engagement time. Google Signals and ad-personalization signals are disabled in our site configuration. We do not send source photos, pattern contents, file names, titles, authors, support messages, or free text to Google Analytics.

With your metrics consent, fixed Google Analytics events also cover bead-maker actions, pattern-detail brand changes and exports, and Alpha chart generation and exports. Repeated actions may be counted separately. Export events mean a file or print sheet was prepared, not that you saved a file or finished printing. Image and text inputs stay on your device.

The site loads Google AdSense code for site review and ad serving. Third-party vendors, including Google, may use cookies, web beacons, IP addresses, or other identifiers to serve, personalize, and measure ads, subject to applicable consent controls and your settings.

Google uses advertising cookies to enable Google and its partners to serve ads based on your prior visits to this site or other websites. Depending on your location and consent choices, those ads may be personalized. You can manage or opt out of personalized advertising in Google Ads Settings and read how Google uses information from partner sites.

Our current advertising provider is Google AdSense. We do not directly integrate another advertising network in the site code. Google may use participating ad technology partners for ad delivery and measurement; the applicable partners depend on location, consent choices, and the ad request. Review Google's published ad technology partners and their privacy links. You can also use YourAdChoices to opt out of participating third-party vendors.

Optional analytics cookies

Optional analytics stay off until you save a choice. The saved consent record expires after 180 days, then the site asks again.

Essential preference Always on

Stores this choice, its schema version, and the saved and expiry times for 180 days. It does not run analytics.

Google Analytics

Measures page views, traffic sources, device and browser categories, engagement, and fixed product actions.

Purpose and storage: page and fixed interaction measurement. After consent, Google Analytics may set first-party _ga and _ga_* cookies; Google documents a default expiry of up to two years. We attempt to delete accessible _ga* cookies when you withdraw.

Anonymous product metrics

Counts allowlisted workflow milestones through our same-origin aggregate metrics service. It sends no free text or user identifier.

Purpose and storage: aggregate product-flow measurement through a same-origin API. It uses no analytics cookie. One coarse UTC visit day may remain in localStorage for up to 120 days and is deleted on withdrawal; server counters are retained for up to 120 days.

Microsoft Clarity

Provides masked session replays, clicks, scrolls, and device analytics on eligible pages. Images, charts, and text stay masked.

Purpose and storage: masked usability analytics and session replay on eligible pages. Clarity may set first- and third-party cookies described in Microsoft's cookie list. We stop recording and remove accessible _clck and _clsk first-party cookies when you withdraw.

Plausible Analytics

Measures page views and referral sites without analytics cookies. It does not track forms, downloads, outbound clicks, or editor actions.

Purpose and storage: cookieless traffic statistics. We send the canonical page URL and referring site's origin, without query parameters, hashes, custom properties, images, patterns, or free text. Plausible derives device and approximate location statistics from requests; see its data policy. Our site stores only your consent choice for this service.

Analytics events never include form text, email addresses, phone numbers, names, addresses, search text, user-entered amounts, sensitive URL parameters, serialized editor state, source images, patterns, file names, titles, authors, support messages, or other free text.

Use Manage cookies at any time to change or withdraw your choice. Withdrawal stops future collection in this browser; it does not automatically delete historical data already processed by a provider.

Advertising: eligible pages include Google AdSense. Advertising consent is separate from these analytics choices. This dialog never enables advertising storage or ad personalization: ad_storage, ad_user_data, and ad_personalization remain denied in the Google analytics tag, and Google Signals and ad-personalization signals stay disabled.

Manage cookies

2. What information goes where

The homepage keeps one editable draft in browser localStorage: the bead grid, brand, owned colors, display settings, and any export title or author you enter. Nothing is uploaded or synced to an account. The original photo and undo history are not saved. A new pattern replaces the draft. Use Clear saved draft or clear site data to remove it. Others using the same browser profile may see it. Browser cleanup or private browsing may remove it; export important work.

The homepage draft also keeps up to 12 recently selected color codes per bead brand, used only to restore your drawing color panel on this device. Clearing the saved draft removes this saved color list too.

After you allow metrics, the stored UTC visit day stays on your device. The site sends only fixed first-seen or returning, recency, and page-family buckets, never the date itself.

3. Retired online sharing

Online QR sharing was retired on July 31, 2026. New links cannot be created, opened, or deleted through the site.

Legacy share records remain in private Vercel Blob storage with public API access disabled. They are not used for new links and will be handled separately before any permanent deletion.

4. Technical requests and service providers

When you request a page or API, Vercel may process standard technical data such as IP address, user agent, requested URL, time, status, and security signals.

The metrics API accepts only documented event names and fixed enum values, then immediately increments daily aggregate counters in Upstash Redis. It rejects extra fields and does not log event payloads.

We use Vercel to host the site and disabled share API, Vercel Blob for access-restricted legacy share records, Upstash for anonymous aggregate counters, and—with your permission—Google Analytics for website usage measurement. Support email is forwarded by Namecheap and then handled by the destination mailbox provider. Google and its advertising partners may process analytics and advertising request data under their own terms and your consent choices.

We use information to provide and improve requested features, understand website use after consent, keep the service secure and reliable, respond to messages, and meet legal obligations. We do not make decisions with legal or similarly significant effects based on Analytics data.

Where applicable, we rely on legitimate interests to operate and secure the service, on consent for Google Analytics, anonymous product metrics, or advertising where required, on your request for support, and on legal obligations when required.

5. Children and families

The core editor works without an account and without transmitting a source photo. If you are under 13 or the digital-consent age where you live, ask a parent or guardian before emailing support or making advertising consent choices.

You never need to attach the image you uploaded. Source photos stay in your browser, and support requests should not contain them.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, and to complain to a local authority.

Send requests to support@mybeadpattern.com. We may need enough information to verify and respond to a request, but we will not ask for your source photo.

You can clear language, build information, and Analytics cookies through browser site-data settings. You can also use Google's Analytics opt-out browser add-on and use the site without sending email.

Google Analytics, anonymous product metrics, Microsoft Clarity, and Plausible Analytics stay off unless you save permission for each service. You can change or withdraw each choice at any time on this device.

Manage cookies

You can manage or opt out of personalized advertising in Google Ads Settings. If a consent message is shown, use its controls to review participating ad partners and manage your choices.

7. Security, changes, and contact

We use data minimization, browser-local image processing, same-origin checks, security headers, and provider security controls. No online system is perfectly secure.

We may update this policy if features, providers, or legal requirements change. We will change the date above and provide additional notice if a change materially affects how information is handled.

8. Pinterest App integration

MyBeadPattern Content Manager is an owner-only local tool. Pinterest OAuth connects only our business account; website visitors are not enrolled. When connected, it uses account, board and Pin identifiers, public Pin metadata, our marketing assets and links, and aggregate performance reports. We do not request private-board, messaging, advertising or billing access, or collect passwords, session cookies or visitors' uploaded photos. Publishing awaits the required access and workflow.

App credentials and OAuth tokens are stored in a user-restricted local file, separate from the website and repository. Permissions do not imply encryption. Local assets, queues, logs and reports remain until deleted, without automatic expiry. Pinterest receives API requests; Google supplies separately authorized aggregate analytics. Codex/OpenAI may process selected creative references, prompts, copy and aggregate reporting context.

Stop scheduled jobs, revoke the App in Pinterest's connected-app settings, and delete local credentials and records to end the integration. Revocation does not delete existing Pins, local files or provider records. Privacy contact: support@mybeadpattern.com.