Privacy Policy

Draft for review. This policy describes the app as planned for its first release and has not yet been reviewed by counsel. It will be checked and updated before the app launches.

1. Who is responsible

BeeBee Tones AB, org. no. 559589-2323, Sweden, is the data controller for Knit with Gordon and its pages on beebeetones.com. For privacy questions and requests, contact us at [email protected].

2. Who can use the app

Knit with Gordon is for people aged 16 and over, in every country. You confirm your age when you start. We do not knowingly collect data from anyone younger. If you believe a younger person has made an account, email us and we will delete it.

3. What we collect

• Account details. You sign in with Apple, Google or an email link. We receive an account ID and, depending on the method you choose, your email address and name. If you use “Hide My Email” with Apple, we only see the relay address.
• Your content. The patterns you import (PDF files and scans of paper patterns), and what you do with them: your chosen size, row markers, notes, counters, projects, stash and needles, and your achievements. Your imported patterns are private. Only you can see them.
• Settings. Your language, display choices and your consent choices.
• Diagnostics. If the app crashes, a crash report is sent to us with technical details such as the device model and the iOS and app versions. Crash reports never contain the contents of your patterns.
• Usage statistics. If you agree (or where the law does not require agreement), we count how the app is used, for example that a pattern was opened or a counter was used, so we can see what works. These events never contain file names, pattern text, email addresses or free text.
• Web pages. Our pages on beebeetones.com set no cookies and use no analytics. Our host, Cloudflare, processes your IP address and technical request data to deliver the pages and protect the site, and keeps these logs for a short period, up to 30 days.

We do not sell your data, and we do not show advertising in the app.

4. Where your data is kept

• Your own data (projects, stash, notes and settings) is stored in Google Cloud Firestore, in the EU (eur3).
• Sign-in is handled by Google Firebase Authentication. Your sign-in details (for example your email address and account identifiers) are processed by Google in the United States (see section 11).
• Your imported pattern files are stored in Cloudflare R2, in the EU jurisdiction. They are private to your account and are reached only through our own service. They pass through Cloudflare’s network on their way to and from your device.
• Our service runs on Google Cloud in Belgium (europe-west1).
• Crash reports are handled by Firebase Crashlytics, and usage statistics by Firebase Analytics, both run by Google.

5. How we use AI

When you import a pattern, automated tools read it to find the information the app needs, for example the sizes, the sections and tags such as style or difficulty. This includes text recognition for scanned pages and AI models (Google Vertex AI, Gemini) run by our processor in the EU. The AI is used to detect and extract information. It never writes, completes or changes your patterns, and your content is never used to train AI models, by us or by our processors.

6. Who helps us process data

We use these providers as processors, under data processing agreements:

• Google (Firebase, Google Cloud, Vertex AI, Cloud Vision) for sign-in, storage, hosting, text recognition, AI extraction, crash reports and usage statistics.
• Cloudflare for file storage (R2), content delivery and our website.
• An email delivery provider to send you the sign-in link when you choose email sign-in.
• Apple and Google when you choose to sign in with them. They act under their own privacy policies.

We do not share your data with anyone else, except where the law requires it.

7. Consent for usage statistics

In the EU/EEA, the UK and Switzerland, we ask for your consent before we count any usage statistics, and the statistics stay off until you agree. You can change your choice at any time in Settings. We do not use advertising features, ad personalisation or Google Signals.

8. Legal bases (GDPR Article 6)

• Providing your account, your library and the app’s features: performance of a contract (Art. 6(1)(b)).
• Reading your patterns to find sizes and tags: performance of a contract (Art. 6(1)(b)). This is the feature you ask for when you import a pattern.
• Crash reports and keeping the service secure: legitimate interests (Art. 6(1)(f)). Our interest is a stable, safe app.
• Usage statistics: consent (Art. 6(1)(a)) where the law requires it, and otherwise legitimate interests (Art. 6(1)(f)) with an opt-out in Settings.
• Delivering these web pages: legitimate interests (Art. 6(1)(f)).
• Answering your email: legitimate interests (Art. 6(1)(f)).

We do not use automated decision-making or profiling that produces legal or similarly significant effects (Art. 22).

9. How long we keep data

• Your account and content are kept until you delete your account.
• When you delete your account, we delete your data, including your imported files, within 30 days. Backup copies are removed as the backups expire.
• Crash reports and usage statistics are kept for the period set in our Google settings and are not linked to the contents of your patterns.
• Web delivery logs are kept by Cloudflare for up to 30 days.
• Emails to us are kept while we need them to answer you, and then deleted.

10. Export and delete in the app

In Settings you can export your data and delete your account. An export gives you a file with the data we hold about you, including your imported files. Deleting your account removes your data as described in section 9.

11. International transfers

Google and Cloudflare are based in the United States. Firebase Authentication, Crashlytics and Analytics process data in the United States, and other processing, such as support access or traffic passing through Cloudflare’s network, can also happen outside the EU/EEA. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses (SCCs), with supplementary measures where needed.

12. Your rights and complaints

Under the GDPR (and the UK GDPR and the Swiss data protection act, where they apply) you have the right to access, rectification, erasure, restriction, objection and data portability, and, where we rely on consent, to withdraw it at any time. Residents of other countries may have similar rights under local law, and we will honour them in the same way. Use the controls in the app or email [email protected]. We respond within one month, free of charge in ordinary cases.

You can also lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se, or with the supervisory authority where you live.

13. Changes

If we change how Knit with Gordon handles data, for example by adding a feature that shares your content with other people, we update this page and its date before the change takes effect, and we ask you first where the law requires it.