Privacy Policy

• We collect the least we can, and only to run your account.
• The one cookie we set is the one that keeps you signed in.
• Your patterns and your progress are private until you choose to share them. Your files stay private either way.
• We never sell your data, we run no ad trackers, and we do not use what you make to train machine learning models.
• Everything is encrypted, and the few people who can reach the admin area cannot open your files.
• Ask for a copy of everything we hold, or ask us to delete it, and we will.

Needlee is a one-person project. Dexter Marks-Barber, a sole trader in the United Kingdom, runs it and is the data controller for everything on this page. Write to privacy@needl.ee with anything on your mind.

You can read the site without an account, and we will not ask you for anything. There is no sign-up wall and no tracking cookie.

We do count page views through Vercel Analytics, so we know which pages are worth keeping. It records the page, the referrer, a rough country and the kind of device. It sets no cookie, it builds no profile, and it cannot follow you to another site.

Here is everything we keep, and why we keep it.

• Your name, email and avatar. These come from whichever provider you sign in with. We need them to tell your account apart from anyone else's.
• Your patterns and progress. The patterns you add, the grids you map, the stitches you mark off and the goals you set. This is the part of the app you came for.
• Your fabric stash. The cuts of fabric you record, with their colours, their dyers, their counts and their sizes, and which pattern is worked on which cut.
• Files you upload. Your pattern files and a custom avatar, if you upload one. A pattern file is private, and sharing a pattern does not change that.
• A connected cloud drive. If you link Google Drive, Dropbox or OneDrive, we keep the key that lets us open the files you point us at, and nothing more. There is a section below on exactly what we read.
• A record of changes. We log edits to your records so a mistake can be traced and undone.
• A closed-beta email. If you asked for early access, we hold that address only to let you in.

One cookie, set by our sign-in provider, which keeps you signed in between visits. It is first-party, and clearing it signs you out. We set no analytics cookie and no advertising cookie, so there is nothing here to consent to.

The database sits in Ireland, on Amazon Web Services. The site runs on Vercel. Uploaded files go to Cloudflare R2, unless you connect your own cloud drive, in which case they never leave it.

Cloudflare also answers DNS lookups for needl.ee, but our records are set to DNS-only. That means Cloudflare tells your browser where the site is and never sees the page you asked for.

These are the companies we rely on. Each one sees only what it needs to do its job, and none of them may use your data for their own ends.

Your data is encrypted on the way to us, and it stays encrypted while it sits still. That covers everything we hold: your account, your patterns and progress, and the files you upload. A copy of our storage taken by somebody who should not have it would be so much noise.

A connected cloud drive gets a second lock. We encrypt the key to your drive again before we write it down, using a separate key we keep somewhere else entirely. Someone who walked off with a copy of everything we store still could not open your drive.

Whenever the site answers you, it checks that what you asked for is yours before it says a word. That is what keeps one account out of another.

Needlee has a small admin area, open only to people we trust with it. From in there, an admin can see the list of accounts, open the details of a pattern or a cut of fabric, correct something that is wrong, and delete an account that has to go. It exists so somebody can answer you when you write in, and take down anything that should not be on the site.

What an admin cannot do is open your files. A pattern file is fetched with your account and nobody else's, so an admin sees its name and its size and never what is inside it. The key to a connected drive works the same way: it is never shown to anyone, it is left out of every copy we make, and no person here can read it.

Every change an admin makes is written down — who did it, what changed, and when. Nothing happens quietly.

If you connect a cloud drive, this is exactly what happens to what we read.

• What we read. While you browse, we read the names, types, sizes and modified dates of the folders and pattern files in the folder you have open, so we can show you a list to choose from. We hide every file we cannot open as a pattern. We read the content of one file only, the one you choose, and only to show that pattern to you.
• What we store. We do not keep a copy of your files. We note which file you picked, along with its name, its kind and how big it is, and we keep the key to your drive. The file itself never leaves your account: when you open the pattern, it goes straight from your drive to your screen.
• What we never do. We never create, change, move, rename, delete or share anything in your drive. We ask for a read-only permission, and the code has no method that writes.
• Who sees it. What is inside the file is yours alone. We open it with your account, so nobody here can look at it, and it is left out of every copy we make. We can see the name and size of the file you picked, because that is what we noted down. We send none of it to anybody, we do not use it for advertising, and we do not use it to train machine learning models.
• How to stop it. Disconnect the drive on your settings page at any time. We tell the provider to cancel the key, and we delete our copy. Deleting your account does both.

Needlee's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you are in the UK or the EU, the GDPR gives you a set of rights over your data. Two of them are buttons in your settings, under Danger zone, and they work straight away. For the rest, send an email and we will sort it out within 30 days.

• See it. Download a copy of everything we hold about you, from your settings page. You can do this once a day.
• Fix it. Correct anything that is wrong, most of it from your settings page.
• Delete it. Delete your account from your settings page. It goes at once, and it cannot be undone.
• Take it with you. The same download gives you your patterns, your progress and your fabric stash as JSON, one file per table. Each cut names its colour and its dyer, so the file reads on its own.
• Object. Tell us to stop using your data in a particular way.

Our legal grounds are simple. We handle your account data because we need it to give you the service you signed up for. We count page views and keep a change log because we have a legitimate interest in a site that works and can be debugged. We touch your cloud drive only on the consent you give when you connect it, and you can disconnect it whenever you like.

If you think we have got this wrong, you can complain to the UK Information Commissioner's Office at ico.org.uk. We would rather you told us first, at privacy@needl.ee, so we can put it right.

Your account data stays while your account is open. When you delete your account, we remove your profile, your patterns, your progress, your fabrics and the dyers and colours behind them, your uploaded files, your activity, your change log and your connected drives, and we disconnect those drives at the provider. Backups age out on their own within 30 days. A closed-beta email goes with the account.

One record survives, and it names nobody: a dated receipt that an account was deleted. It holds no name and no readable address, only one-way hashes that cannot be turned back into either. If you ask us later whether your account was deleted, we hash the address you write from and look for it, which lets us answer you without keeping you on file. We hold the receipt for 12 months and then drop it.

Needlee is not built for children, and accounts are for people aged 13 and over. If you believe a child has an account here, tell us and we will remove it.

The date at the top of this page is the honest one. If we change something that matters, we will move that date and say what changed before the change takes effect. Small fixes to wording will not move it.

Questions, worries, or a request about your data: privacy@needl.ee. There is also a feedback button inside the app, which goes to the same person. If you would rather start with the product, go back to the home page.