Privacy policy

Last updated 25 September 2026.

Stitch Slop is a machine-embroidery digitizer that runs in your web browser. This page says what the website at stitchslop.com collects, why, where it goes, how long it is kept, and how to have it removed.

Who we are

Stitch Slop is run by Mosteyes LLC, based in the United States. Questions about this policy go to contact@stitchslop.com.

The short version

• You can design and export without an account. Signed out, nothing you make is sent to us, unless you choose to send a bug report.
• An account is your email address and nothing else. There is no password.
• Signed in, your designs are saved to your account so you can open them again, and they help teach our image tracer.
• We do not sell data, show ads, or use third-party trackers.
• Accounts are not available in the EU, EEA or UK. You can still use the digitizer there.

Designing without an account

The digitizer runs entirely in your browser. Drawing, stitching and exporting make no network request and send nothing to us.

Signed out, the browser does not keep what you make: close or reload the page and the design is gone. Only the app's settings, such as the light or dark theme, are remembered, in your browser's local storage, not in cookies. To keep a design, use Download Project, or sign in to save it to an account.

Accounts

Signing in uses a link or code sent to your email. We store your email address, a random account id, and the times you signed in. Nothing else about you is asked for.

Signed in, we store what you save: each design (its title, the design data, a preview picture, its size and dates), the folders you sort designs into, and any sharing you set up. While a design is open, we also record which account has it open, so two people don't overwrite each other. Each account can hold 20 MB of designs. Deleted designs go to a trash you can empty; anything left in the trash is deleted for good after 30 days.

Signing in also keeps your session and your work in your browser on that device, so a reload restores the design you were working on. Signing out clears them.

Designs help teach the image tracer

When you save a design to an account, it is also used to teach Stitch Slop's image tracer, so it gets better at turning pictures into stitches. Before a design is used this way, we remove your account details and anything that could identify you.

We do not sell your designs or give them to anyone else to train their tools. What the image tracer has learned stays in it: if you delete a design or your account, it is removed from future teaching, but the tool keeps what it has already learned. Designs you make signed out are never used, because they never reach us.

Fonts you load

You can load your own font file or stitch font into the text tool. Signed in, it is kept in your browser on that device so it survives a reload, and signing out clears it. Signed out, it lasts only while the page is open.

A font never leaves with a copy of your design. A download turns its lettering into fixed stitches, and a share or link names the font without sending it.

Sharing

If you share a design with someone by email, we store the address you typed and show it to them along with your address, so both of you can see who shared what.

A view link (/view) shows a read-only picture of one version of a design: its title, the picture, and the date it was shared. The secret part of the link stays after the # in the address; it is not sent to our web host or kept in its logs, and reaches our database only to fetch the picture. Viewing a shared link requires a Stitch Slop account. We count how many times a link is opened and when, not who opened it. You can turn a link off at any time. A link that has been off for 30 days is deleted.

Join links let others open a design with you. They expire after 14 days unless you choose a different time, up to a year.

Sign-in emails and new accounts

Sign-in emails are generated by Supabase and delivered by Resend, from an address at stitchslop.com. Resend sees your email address and the message.

To slow down automated sign-ups, creating a new account passes a Cloudflare Turnstile check, which is a bot check, not a tracker, and we record the new account's IP address and the outcome for two days, and no longer. Returning sign-ins are not checked.

Bug reports

Report bug is optional and only sends when you press Send. A report contains your description, the design you have open, a picture of the canvas, the last few status messages and errors, and basic details of your browser and screen size. Email addresses and link tokens are removed before the report leaves your browser. If you are signed in, the report is linked to your account; if not, it is anonymous.

To limit floods, the IP address a report came from is kept in a private log for two days. It is never stored on the report itself. Reports are deleted automatically after 90 days. Deleting an account deletes its reports.

AI assistants and voice

Agent Connections let a program on your own computer read and change the open design. The tab talks to that program only on this same computer; nothing about it passes through our servers. The pairing code is kept in your browser. On phones and tablets, the run sheet exposes tools that an AI assistant running in your browser can use in the same way.

The program you connect is usually an AI assistant, and it may send what it reads, including pictures of your design and anything you say to it, to the company that makes it. That is covered by that company's privacy terms, not ours.

The Talk button turns speech into text on your device only: audio never leaves your computer, and it refuses to run in a browser that can only recognise speech by sending audio to someone else's server.

Where it is stored and who processes it

• Cloudflare hosts the site and, like any web host, sees your IP address and the pages you request while serving them. Cloudflare also provides the Turnstile bot check and Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
• Supabase stores accounts, designs, sharing and bug reports, in a database in West US (Oregon). Supabase also keeps its own sign-in and service logs, which normally include IP addresses and browser details.
• Resend delivers sign-in emails.

Those are the only outside services the website uses. No advertising or social-media scripts load on any page, and the only analytics is Cloudflare Web Analytics. We do not sell or rent personal information.

How long we keep things

• Your account and designs: until you delete them.
• Designs in the trash: 30 days, then deleted for good.
• IP addresses from new sign-ups and bug reports: 2 days.
• Bug reports: 90 days, then deleted automatically.
• View links: until you delete them, or 30 days after you turn them off.
• Browser storage on your device: until you sign out or clear it.
• Supabase's own logs: kept by Supabase for a period set by its service.

Your choices and rights

You can see and export everything you made at any time: open a design and use Download Project. You can delete any design yourself, empty the trash, turn off share links, and sign out.

You can delete your account yourself from account settings, which removes your account and all your files. This also removes your designs from future teaching of the image tracer, though the tool keeps what it has already learned. If you have trouble, email contact@stitchslop.com from the address on the account.

If you live in California, you have rights to know what personal information we hold about you, to get a copy, and to have it deleted, and we will not treat you differently for using them. Email the address above. Designing and exporting work without an account, and nothing you make is sent to us unless you save it to an account or send a bug report.

Security

The site is served over HTTPS only. Your designs are reachable only with your own session, or by people you share them with, and the database enforces that per account, not just the app. There are no passwords to leak. Bug reports and sign-up limits are handled by a server key that never reaches the browser. No system is perfectly secure; if you think something has gone wrong, please tell us.

Children

Accounts are for adults: you must be 18 or older to create one. The digitizer itself can be used by anyone, because signed out it collects nothing. We do not knowingly collect personal information from children. If you believe someone under 18 has created an account, email us and we will delete it.

Changes

When this policy changes, the date at the top changes with it. Material changes will be noted in the app or by email to account holders.

Contact

Mosteyes LLC
contact@stitchslop.com

This policy covers the website at stitchslop.com. See also the terms of use, the accessibility statement and about Stitch Slop.