Privacy Policy

The Yarn Nook (“the Service”) is operated by STJ Adriana Dutka (“we”, “us”), a sole proprietorship (jednoosobowa działalność gospodarcza) based in Poland. We are the controller of the personal data described in this policy. It explains what we collect when you visit this website or create an account, why we collect it, and what your rights are.

The short version

• We collect your email address and the yarn information and photos you choose to add, and we use them only to run your account.
• Your stash is private to you. We don’t sell your data, show ads, or build advertising profiles.
• We currently use no analytics or advertising cookies, only the cookies needed to keep you signed in.
• Your data is stored in the European Union (Frankfurt, Germany).
• You can ask us to delete your account and all its data at any time.

Information we collect

When you visit the website

Like any website, the servers that deliver this site process some technical information when you load a page: your IP address, browser and device type, the page requested, and the time. This is needed to deliver the site, keep it secure, and fix problems. We don’t use it to identify you or to build a profile of you.

When you create an account

• Your email address, used to sign you in and to send you the service emails described below.
• Your password, which is stored only as a cryptographic hash. We cannot read it.
• Account and security details: when the account was created and confirmed, when you last signed in, and technical information about your sign-in sessions (such as IP address and browser type), which our authentication provider keeps to protect your account.

Content you add (“Your content”)

• Yarn details: brand, name, fibre content, weight, yardage per skein, and your notes.
• Colors: names, color values, dye lots, how many skeins you have, and your notes.
• Photos you upload.
• Your settings, such as metric or imperial units and how colors are previewed.

The Service is meant for keeping track of yarn. Please don’t put sensitive personal data (such as health information) or personal data about other people into your notes.

Photos are stored exactly as you upload them. If a photo contains embedded information, such as the location where it was taken, that information stays in the file. Only you can access your photos through the Service, but you may want to remove such details before uploading.

Emails

We send only service emails: confirming your email address when you sign up, and helping you reset your password. We don’t send marketing emails. If you write to us, we keep your message and email address so that we can reply.

How we use your information, and why

Under the GDPR we need a legal basis for each use of your personal data:

• To create and run your account and provide the Service: sign you in, store and show your stash and photos, and remember your settings. The basis is performance of a contract with you (Article 6(1)(b)).
• To send service emails such as email confirmation and password reset. The basis is performance of a contract (Article 6(1)(b)).
• To keep the Service secure and working: preventing abuse, investigating errors, and protecting accounts. The basis is our legitimate interests in running a secure and reliable service (Article 6(1)(f)).
• To answer your messages and requests. The basis is legitimate interests (Article 6(1)(f)), or performance of a contract where your request relates to your account.
• To comply with the law where required (Article 6(1)(c)).

We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you by automated means.

Who can see Your content

Only you can see your stash, when you’re signed in. This is enforced by access rules on our database and on file storage, and other users cannot see your data. As the operator, we technically have administrative access to the systems where data is stored. We use that access only where necessary to provide support you ask for, to keep the Service secure, or to comply with the law.

Service providers we use

We rely on a small number of companies to run the Service. They process personal data on our behalf, under data processing agreements, and only as needed to provide their service to us.

• Supabase provides our database, sign-in system, storage for your photos, and sends the service emails. Our project is hosted in the European Union (Frankfurt, Germany). While you’re signed in, your browser also connects directly to Supabase (for example, to upload and display your photos), so Supabase receives technical information such as your IP address too. Supabase Privacy Policy.
• Vercel hosts the website and delivers it to you. Requests, including the information described under “When you visit the website”, pass through its servers. Vercel Privacy Policy.
• Cloudflare manages our domain name and its DNS records (the directory that points our domain to our hosting). Traffic to the website does not pass through Cloudflare. Cloudflare Privacy Policy.

These providers use sub-processors of their own (for example, cloud infrastructure companies); their current lists are published in their own legal documentation. We may also disclose personal data where the law requires it, for example to a court or authority.

International transfers

Your account data and Your content are stored in the European Union. Some of our providers are companies based in the United States, and some processing (for example, by Vercel’s servers when they deliver the website, or by a provider’s support staff) may take place outside the European Economic Area, including in the United States. Where that happens, we rely on legally approved safeguards, such as the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. You can contact us to ask for more information about these safeguards.

Cookies and similar technologies

We use only strictly necessary cookies. When you sign in, our authentication system stores cookies in your browser (their names begin with “sb-”) that keep you signed in and protect your session. They are not used for tracking or advertising, and they’re removed when you log out or when they expire. Because they are strictly necessary to provide the Service you asked for, they don’t require consent.

The website also registers a small technical component (a service worker) that supports adding the site to your device like an app, on browsers that allow it. It doesn’t store your stash or track you.

We currently use no analytics or advertising cookies, and the site doesn’t load advertising or tracking scripts; its fonts are served from the site itself. If we add analytics in the future, we will ask for your consent first and update this policy.

How long we keep your data

• Your account and Your content are kept for as long as your account exists. If you ask us to delete your account (see “Your rights”), we delete your account, your content, and your photos without undue delay and in any case within one month. Copies may remain in our providers’ backups for a limited time until they are overwritten.
• Technical and security logs are kept by our providers for a limited period, according to their own retention settings.
• Emails you send us are kept for as long as needed to deal with your request, and afterwards only as long as the law may require.

Security

The website is served over HTTPS. Passwords are stored only as hashes. Access to the database and to file storage is restricted so that each account can reach only its own data, and photos are kept in private storage and shown through links that expire. No online service can be perfectly secure, but we take reasonable technical and organisational steps to protect your data. If a breach affects your personal data in a way the law requires us to report, we will notify you and the authorities as required.

Your rights under the GDPR

If you are in the European Economic Area (or another region with similar data protection laws), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing, including processing based on legitimate interests
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority. In Poland, this is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO).

To exercise any of these rights, or to have your account and data deleted, email us at ad.apps852@gmail.com, ideally from the address registered on your account so we can confirm it’s you. We’ll reply within one month. Providing your email address is necessary to create an account; without it we can’t offer the Service.

Children’s privacy

The Service is not directed at children, and it is intended for people aged 16 or over. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We’ll post the new version on this page with a revised “Last updated” date, and if a change is significant we’ll also let registered users know, for example by email.

Contact

The Yarn Nook is operated by STJ Adriana Dutka, Poland.
If you have any questions about this Privacy Policy, you can reach us at ad.apps852@gmail.com.