Privacy Policy

Introduction & Scope

Welcome to Knitify ("we", "us", "our"). Knitify is a mobile application for iOS and Android that generates knitting patterns from user-uploaded photographs. This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use the Knitify application ("the App") and our website at knitify-app.com ("the Website").

By using the App or the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the App and Website.

This policy is designed to comply with applicable data protection regulations, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the Children's Online Privacy Protection Act (COPPA), and the requirements of the Apple App Store and Google Play Store.

Data Controller

The data controller responsible for your personal data under the GDPR, the UK GDPR, and equivalent laws is:

• Entity: Roman Karankevych — individual entrepreneur (sole developer)
• Country of establishment: Poland
• Postal contact: available on written request to the email below
• Privacy contact email: support@knitify-app.com
• Website: https://knitify-app.com

We are not required to appoint a Data Protection Officer under GDPR Art. 37, because our processing activities do not meet the thresholds set out in that article (no large-scale processing of special categories, no large-scale systematic monitoring of data subjects). All privacy-related inquiries are handled directly by the controller at the address above.

The competent lead supervisory authority for the controller is the Polish Personal Data Protection Office — Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). EU residents may also lodge complaints with the supervisory authority in their EU Member State of residence.

EU / UK Representative

Because the data controller is established in Poland (an EU/EEA Member State), Article 27 of the GDPR — which requires controllers established outside the EEA to designate a representative in the Union — does not apply. EU residents may exercise their rights directly with the controller above.

• EU Representative: Not required — the controller is established within the EEA.
• UK Representative: Not appointed — Knitify relies on the UK GDPR Art. 27(2) exemption (occasional processing, no large-scale processing of special categories, low risk to data subjects). UK residents may exercise their rights directly with the controller above or lodge complaints with the UK Information Commissioner's Office (ico.org.uk).

Information We Collect

We collect the minimum amount of data necessary to provide and improve the App. The categories below describe what we collect and how:

A. Information You Provide Directly

• Account data — when you sign in via Google, Apple, or email/password, we receive your email address and display name. We do not access your password; authentication is handled by Firebase Authentication. If you choose Sign in with Apple with Hide My Email, we only receive Apple's private relay address; you remain in full control of forwarding through your Apple ID settings.
• Profile data — an optional display name and (if you upload one) a profile photo, stored in Firebase Firestore / Firebase Storage and visible only to you.
• Project content you create — see section B below for the source photo, the generated pattern image, and project metadata.
• Support communications — if you contact us via email, we collect your email address and message content to respond to your inquiry.
• Feedback — if you submit feedback through the App, we receive the text of your feedback and your account identifier.

B. Information Collected Automatically

• Project metadata — pattern settings (stitch count, color palette, complexity), project names, creation dates, and progress state. This data is synced to Firebase Firestore when you are signed in.
• Project images (source photo and generated pattern) — when you are signed in, the photo you select for a project and the pattern image generated from it are uploaded to Firebase Storage under users/{your-uid}/projects/{projectId}/source.jpg and .../pattern.png. They are stored encrypted at rest, are accessible only to you (enforced by Storage Security Rules), are never used for AI training, advertising, profiling, or any purpose other than re-displaying your projects across your devices, and are permanently deleted when you delete the project or your account. Pattern computation and PDF export themselves run entirely on your device — we do not perform any image analysis on our servers.
• Analytics data — usage events such as feature usage frequency, screen views, and session durations, collected via Firebase Analytics. We do not call setUserId, so events are not directly associated with your account; however, Firebase Analytics uses pseudonymous device-level identifiers (e.g. Firebase Installation ID, Instance ID, IDFV on iOS / Android ID on Android) which Apple and Google classify as identifiers that can be linked to a device. We never combine these identifiers with advertising IDs.
• Crash reports — technical diagnostics including device model, OS version, stack traces, and crash logs, collected via Firebase Crashlytics to diagnose and fix bugs. When you are signed in, crash reports are tagged with your account user ID so we can debug issues you specifically report; on sign-out the user identifier is cleared. The user ID is the only identity field included — no email, name, address, or your project content is sent in crash reports.
• Device identifiers — Firebase may use pseudonymous device identifiers (Firebase Installation ID, Instance ID, vendor identifiers) for crash and analytics attribution. We do not collect Apple's IDFA or Google's Advertising ID and do not perform cross-app tracking.
• Purchase data — subscription status and entitlement information are managed through RevenueCat and your platform's app store (Apple App Store or Google Play). We receive a confirmation of your entitlement status but do not receive or store your payment method details (credit card numbers, billing address, etc.). Server-side validation of entitlements is performed via Firebase Cloud Functions (callables unlockProjectAccess and claimFreeProjectAccess), which receive your authentication token and the project ID.

C. Information We Do NOT Collect

• Precise location — We do not request or collect GPS, Wi-Fi, or cell-tower location data.
• Contacts — We do not access your address book or contacts.
• Microphone or background camera — we only access your photo library through the system photo picker (or, where you explicitly grant camera access, a single foreground capture). We do not use the microphone and we do not access the camera in the background.
• Push notifications — the App does not currently send push notifications and does not include the Firebase Cloud Messaging SDK. If this changes, this policy will be updated.
• Health, fitness, or biometric data — Not collected.
• Advertising identifiers (IDFA/GAID) — We do not collect advertising identifiers and do not use any advertising SDKs.
• AI training on your content — your photos, generated patterns, and project metadata are never used to train any machine-learning model, ours or a third party's.

How We Use Your Information

We use your data strictly for the following purposes:

• Providing core functionality — syncing your projects across devices, managing your account, and processing subscription/purchase entitlements.
• Improving the App — analyzing pseudonymized usage patterns and crash data to fix bugs, improve performance, and prioritize feature development.
• Customer support — responding to your questions, feedback, and bug reports.
• Service communications — sending critical service updates (e.g., security notifications, terms changes). We do not send marketing or promotional emails.
• Legal compliance — fulfilling legal obligations and responding to lawful requests from authorities.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data under the following legal bases:

Processing activity	Legal basis
Account creation and project sync	Contractual necessity — required to deliver the service you requested
Subscription/purchase management	Contractual necessity
Crash reports and diagnostics	Legitimate interest — maintaining app stability and security
Anonymized analytics	Legitimate interest — understanding product usage to improve the service
Customer support	Contractual necessity / Legitimate interest
Legal compliance	Legal obligation

You have the right to object to processing based on legitimate interest at any time by contacting us at support@knitify-app.com.

Third-Party Services & Data Sharing

We do not sell, rent, or trade your personal data to any third party. We share data only with the following service providers, solely for the purposes described:

Service provider	Data shared	Purpose	Privacy policy
Firebase Authentication (Google)	Email, display name, auth tokens	User sign-in and account management	Firebase Privacy
Firebase Firestore (Google)	Project metadata, profile data	Cloud sync of project data and user profile	Firebase Privacy
Firebase Storage (Google)	Source photos, generated pattern images, optional profile photo	Cloud sync of user-generated images across devices	Firebase Privacy
Firebase Cloud Functions (Google)	Authentication token, project ID	Server-side validation of in-app purchases and one-time free unlocks	Firebase Privacy
Firebase App Check & Remote Config (Google)	Pseudonymous device attestation token, app config keys	Abuse prevention and runtime feature flags	Firebase Privacy
Firebase Analytics (Google)	Pseudonymous usage events, Firebase Installation ID, IDFV / Android ID	Product analytics	Firebase Privacy
Firebase Crashlytics (Google)	Crash logs, device model, OS version, account user ID (when signed in)	Crash diagnosis and bug fixing	Firebase Privacy
RevenueCat	Anonymous user ID, entitlement status	Subscription and purchase management	RevenueCat Privacy
Apple App Store	Purchase transactions	In-app purchase processing (iOS)	Apple Privacy
Google Play	Purchase transactions	In-app purchase processing (Android)	Google Privacy

All third-party service providers process data under their own privacy policies and are contractually required to handle your data in accordance with applicable data protection laws.

Tracking & Advertising

Knitify does not:

• Track users across other companies' apps or websites
• Use advertising SDKs or display ads of any kind
• Collect or use Apple's IDFA or Google's Advertising ID
• Participate in data broker networks
• Sell or share personal data for targeted advertising purposes

Because we do not engage in tracking as defined by Apple's App Tracking Transparency framework, the ATT permission prompt is not required by our App.

Automated Decision-Making & Profiling

We do not engage in solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Art. 22 or comparable laws. The image-to-pattern conversion performed by the App is a deterministic image-processing operation initiated by you and is not used to evaluate, score, or make decisions about you as a person.

CCPA / CPRA — Categories of Personal Information

For California residents, the categories of personal information (as defined in Cal. Civ. Code §1798.140) we have collected, used, or disclosed in the preceding 12 months are summarized below.

Statutory category	Examples we collect	Disclosed to (service providers)
Identifiers	Email address, account user ID, Firebase Installation ID, IDFV / Android ID	Firebase, RevenueCat
Customer records (Cal. Civ. Code §1798.80(e))	Display name, optional profile photo	Firebase
Commercial information	Subscription / entitlement status, purchase confirmation	RevenueCat, Apple App Store, Google Play
Internet or other electronic network activity	Pseudonymous in-app event data, screen views, session duration, crash logs	Firebase Analytics, Firebase Crashlytics
Visual information (user-generated)	Source photos and generated pattern images you create in the App	Firebase Storage (encrypted, accessible only to you)
Geolocation data	None	—
Sensory, biometric, professional, education, or inferences data	None	—
Sensitive Personal Information (Cal. Civ. Code §1798.140(ae))	None	—

We have not "sold" or "shared" personal information for cross-context behavioral advertising in the preceding 12 months and have no plans to do so. We do not use or disclose Sensitive Personal Information for purposes that would trigger the CPRA's right to limit use.

Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

• Account data — retained until you delete your account.
• Profile data (display name, optional profile photo) — retained until you change or delete it, or delete your account.
• Project metadata — retained until you delete the project or your account.
• Project images (source photo and generated pattern in Firebase Storage) — retained until you delete the project or your account; deletion is propagated to Firebase Storage within 30 days.
• Analytics data — aggregated and pseudonymized; retained for up to 14 months (Firebase Analytics default).
• Crash reports — retained for up to 90 days (Firebase Crashlytics default).
• Purchase / entitlement records — retained for the duration of your subscription and afterwards as required by tax and consumer-protection law (typically up to 7 years).
• Support emails — retained for up to 24 months after the conversation ends, then deleted.

When data is no longer needed, it is permanently deleted or irreversibly anonymized. Where statutory retention obligations (e.g. tax, accounting, fraud-prevention) require us to keep specific records longer, we restrict processing of that data to those purposes only.

Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit — all data transmitted between the App and our servers uses TLS 1.2+ encryption.
• Encryption at rest — data stored in Firebase Firestore and Firebase Authentication is encrypted at rest using Google Cloud's built-in encryption.
• Secure authentication — we use Firebase Authentication with OAuth 2.0 for third-party sign-in (Google, Apple). We never store your plaintext password.
• Secure credential storage — access tokens and credentials on your device are stored using platform-specific secure storage (iOS Keychain / Android Keystore), not in plain-text shared preferences.
• Firebase Security Rules — server-side Firestore security rules enforce that each user can only read and write their own data.
• Minimal data collection — we follow data minimization principles and collect only what is strictly necessary for the App to function.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

All users

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request permanent deletion of your account and all associated data. You can initiate this from within the App (Profile → Delete Account) or by emailing us.
• Data portability — request your data in a structured, machine-readable format.

Additional rights for EEA/UK/Swiss residents (GDPR)

• Restrict processing — request that we limit how we process your data in certain circumstances.
• Object to processing — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint — you have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Polish UODO (uodo.gov.pl); EU residents may alternatively complain to the authority in their Member State of residence (e.g. the Irish DPC, the German BfDI, the French CNIL).

Additional rights for California residents (CCPA/CPRA)

• Right to know — request information about the categories and specific pieces of personal data we have collected.
• Right to delete — request deletion of personal data we have collected.
• Right to opt-out of sale/sharing — we do not sell or share your personal data for cross-context behavioral advertising, so there is no need to opt out.
• Non-discrimination — we will not discriminate against you for exercising any of your privacy rights.

How to exercise your rights

Send your request from the email address associated with your account to support@knitify-app.com, or submit it through the in-app deletion flow (Profile → Delete Account) where applicable. We will acknowledge your request without undue delay and respond:

• within one month of receipt under the GDPR/UK GDPR (extendable by up to two further months for complex requests, with notice to you within the first month);
• within 45 days under the CCPA/CPRA (extendable by a further 45 days with notice).

Identity verification. To prevent unauthorized access to your data, we verify identity by sending a confirmation email to the address registered to your account and matching the request against the data we already hold (e.g. account user ID). For requests that do not originate from a registered account, we may require additional matching data points or — for sensitive requests — a signed declaration.

Authorized agents (CCPA/CPRA). California residents may use an authorized agent to submit a request, provided the agent furnishes a written, signed permission from you and we are able to verify your identity directly. We may deny a request from an agent that does not submit proof of authorization.

No discrimination / no retaliation. We will not deny services, charge different prices, or provide a different level of quality because you exercised a privacy right.

Account & Data Deletion

You can delete your account and all associated data at any time. Two channels are provided to satisfy both Apple's App Store Review Guideline 5.1.1(v) (in-app) and Google Play's account-deletion policy (publicly accessible web URL):

• In-app: Go to Profile → Delete Account. This permanently removes your account, all project metadata and images, and cloud-synced data from our servers.
• By email: Send a request to support@knitify-app.com from the email address associated with your account. Detailed instructions are available at knitify-app.com/delete-account.

We process verified deletion requests within 30 days (and within statutory deadlines where shorter — e.g. 1 month under GDPR Art. 12(3)).

Upon account deletion:

• Your Firebase Authentication record is permanently deleted.
• All project metadata stored in Firestore is permanently deleted.
• All project images and any profile photo stored in Firebase Storage are permanently deleted (deletion propagates within 30 days).
• Crashlytics user identifiers associated with your account are cleared so future crash records are no longer linked to you.
• Any active subscription is not automatically cancelled — you must cancel it separately through the Apple App Store or Google Play Store settings to avoid future charges.
• Aggregated and pseudonymized analytics data that can no longer be attributed to you is retained per the retention schedule above.
• Where law requires us to retain certain data (e.g. tax records of a paid transaction), that data is preserved in restricted form and deleted at the end of the statutory retention period.

International Data Transfers

Our service providers (Firebase/Google, RevenueCat) may process data in the United States or other countries outside your country of residence. These providers use appropriate safeguards for international data transfers, including:

• European Commission Standard Contractual Clauses (SCCs)
• EU–US Data Privacy Framework certification (where applicable)
• Supplementary technical and organizational measures

By using the App, you acknowledge that your data may be transferred to and processed in countries where data protection laws may differ from those in your country of residence.

Children's Privacy

Knitify is a general-audience app and is not directed at children. We apply the strictest applicable digital age-of-consent rule in your jurisdiction:

• United States (COPPA): we do not knowingly collect personal information from children under 13.
• European Economic Area (GDPR Art. 8): the digital age of consent ranges from 13 to 16 depending on the Member State (e.g. 13 in Belgium, Denmark, Estonia, Finland, Latvia, Malta, Portugal, Sweden; 14 in Austria, Bulgaria, Cyprus, Italy, Lithuania, Spain; 15 in Czechia, France, Greece, Slovenia; 16 in Germany, Hungary, Ireland, Luxembourg, the Netherlands, Poland, Romania, Slovakia, Croatia). We do not knowingly collect personal information from a user below the applicable national threshold without verifiable parental consent.
• United Kingdom (UK GDPR / Age Appropriate Design Code): the digital age of consent is 13. The App is not designed to appeal primarily to children and is not subject to Google Play's Designed for Families programme.

If we become aware that we have inadvertently collected personal data from a child below the applicable threshold, we will take prompt steps to delete such data from our servers.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@knitify-app.com and we will delete the data within 48 hours of verification.

Platform-Specific Disclosures

Apple App Store (iOS)

In compliance with Apple's App Store Review Guidelines and App Privacy ("nutrition label") requirements, below is a summary of the data we declare. All listed data is collected for the purpose of App Functionality and/or Analytics, never for Advertising or Tracking.

• Data Used to Track You: None.
• Data Linked to You:
  • Contact info — email address.
  • User Content — photos you upload, generated pattern images, optional profile photo.
  • Identifiers — account user ID (Firebase UID).
  • Purchases — subscription / entitlement status.
  • Diagnostics — crash data and performance data, because crash reports are tagged with your account user ID while you are signed in.
  • Usage Data — product interaction events when associated with your account.
• Data Not Linked to You:
  • Diagnostics / Usage Data collected before sign-in (no user identifier attached).

We do not use the App Tracking Transparency (ATT) framework because we do not track users across other apps or websites and do not share data with data brokers.

Google Play Store (Android)

In compliance with Google Play's Data Safety section, we declare:

• Data collected:
  • Personal info — name (display name), email address, optional user ID.
  • Photos and videos — source photos and generated pattern images you create in the App.
  • App activity — in-app interactions, pages viewed, session length.
  • App info and performance — crash logs, diagnostics.
  • Device or other identifiers — pseudonymous identifiers used by Firebase (e.g. Firebase Installation ID).
  • Financial info — purchase / subscription status (no payment-method data is received by us).
• Data shared: with Firebase, RevenueCat, Apple App Store, and Google Play, only for the purposes set out in the third-party services table above. No data is shared with third parties for advertising or marketing.
• Security practices: data is encrypted in transit (TLS 1.2+) and at rest (Google Cloud encryption). You can request data deletion in-app or by email (instructions at knitify-app.com/delete-account).
• Families Policy: the App is not designed for children and is therefore not subject to Google Play's Designed for Families programme. We comply with Google Play's general Families and Children policy by not targeting users under the digital age of consent.
• Account deletion: publicly accessible at knitify-app.com/delete-account in compliance with Google Play's Account Deletion requirements (no app install or login required to submit a request).

Cookies & Website

The Knitify website (knitify-app.com) is a static informational site. We do not set first-party cookies, tracking pixels, or third-party analytics scripts on the Website. No personal data is collected through the Website beyond what you voluntarily provide (e.g. sending a support email).

Third-party hosted assets. The Website uses Firebase Hosting (Google) to serve its content. As a result, your IP address and a basic User-Agent string are visible to Google as the hosting provider, in line with standard web-server logging.

Web fonts. The Website loads typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When your browser fetches these fonts, your IP address is briefly transmitted to Google for the sole purpose of font delivery. We rely on legitimate interest (GDPR Art. 6(1)(f)) — providing a consistent, accessible reading experience — for this transmission. No cookie is set by Google Fonts for this request, and the IP address is not used to track you across sites. If you prefer to avoid this transmission, you can use a browser that blocks third-party requests; the Website will fall back to a system font automatically.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last updated" date at the top of this page.
• For significant changes, we will notify users through an in-app notification or via email.
• Continued use of the App after the effective date of the updated policy constitutes acceptance of the changes.

We encourage you to periodically review this page for the latest information on our privacy practices.

Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of the Republic of Poland and the directly applicable law of the European Union, without prejudice to mandatory consumer-protection and data-protection rights granted to you by the laws of your country of residence — including, where applicable, the GDPR/UK GDPR, the CCPA/CPRA, the LGPD (Brazil), the PIPEDA (Canada), the APPs (Australia), and the PIPL (China). Nothing in this policy deprives you of any right that you have under the mandatory law of your country of habitual residence.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: support@knitify-app.com
• Account-deletion form: knitify-app.com/delete-account
• Website / support: knitify-app.com/support

We aim to acknowledge all privacy-related inquiries promptly and respond within the deadlines set out under How to exercise your rights above (one month under GDPR/UK GDPR, 45 days under CCPA/CPRA). If you are not satisfied with our response, you have the right to lodge a complaint with your local data-protection authority — for example, the Polish UODO (uodo.gov.pl) as our lead authority, the Irish DPC (dataprotection.ie) for EU residents, the UK Information Commissioner's Office (ico.org.uk) for UK residents, or the California Privacy Protection Agency (cppa.ca.gov) for California residents.