Privacy Policy

Effective date: 15 October 2026

This Privacy Policy describes how Bobble Designs ("Bobble", "we", "us", or "our") collects, uses, and protects information when you access or use the Bobble web application and related services (collectively, the "Service") available at bobbledesigns.com.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of the Service.

Data controller. The data controller for personal data processed via the Service is Bobble Designs, based in Jersey, Channel Islands. The controller can be contacted at hello@bobbledesigns.com for any data-protection enquiry, including the rights set out in section 7.

1. Information We Collect

1.1 Account Information

When you choose to sign in via Google OAuth, we receive the following from your Google account:

• Email address
• Display name
• Profile photograph URL (where available)

We do not receive or store your Google password.

Bobble uses the email address, name and profile photo it receives from Google only to create your account, sign you in, show your name and photo in the app, and send the emails described in section 1.6. We do not use Google user data for advertising, we do not sell it, and we share it with no one except the providers listed in section 4 that run the Service. Bobble's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Bobble's access at any time at myaccount.google.com/permissions, and deleting your Bobble account deletes this data.

1.2 Project Data

When you use the Service, we may store:

• Crochet chart data, colour palettes, and project settings created within the application
• Photographs you upload for chart conversion are processed entirely in your web browser; the original full-resolution image is never sent to our servers. For signed-in users (free or Pro), a small compressed thumbnail and the cropped pixel data used to render your chart are stored with the project so you can re-open and continue editing it from any device. Images are used solely to power the chart-rendering and cloud-sync features and are never analysed, sold, or shared with any third party. The exception is where you choose to publish a chart to the community gallery: that chart and its preview image then become public, as described in section 12. Likewise, when you create a share link for a finished project and tick the picture the chart was made from, that picture is published with the link; anyone with the link can then see it, and deleting the link from your account deletes the published copy.
• Make Mode progress for each project: the row you have reached, when you started and finished it, and how many making sessions it took.
• If you add a photo of a finished project, it is reduced to at most 1600 pixels on its longest side and saved with the project. For signed-in users it is kept in private cloud storage that only your account can read. It is published only if you choose to, by ticking it or by pressing Add it to your design. When you create a share link and tick it, anyone with that link can see it, and deleting the link from your account deletes the published copy. When you publish to the community gallery and tick it (Include my finished photo, when you publish a chart of your own; or I took this photo of my finished piece, and it shows no recognisable person without their consent, when you add your photo to a design), or press Add it to your design once a chart of your own is in the gallery, it becomes public once it is approved, as described in section 12, and removing it under Published works in your account deletes the published copy.
• If you continue without an account, projects (including images) are stored only in your own browser and are never sent to our servers.

1.3 Subscription and Billing Data

If you subscribe to Bobble Pro, payment processing is handled entirely by Stripe, Inc. We store only your subscription status (active, cancelled, etc.) and plan type. We do not receive, process, or store credit card numbers, bank account details, or other payment instrument data.

1.4 Usage Analytics

These analytics run on an opt-out basis. They are first-party and used only to measure and improve Bobble, which under the UK PECR rules as amended by the Data (Use and Access) Act 2025 (in force from 5 February 2026) may run without prior opt-in consent. We show a short notice on your first visit: Accept keeps analytics on, and Choose settings lets you turn it off. You can change your choice at any time through the Cookie settings link in the footer. If you opt out, the analytics identifier is removed and no further events are sent. We never share this data with any third party for their own purposes.

To understand how the Service is used and to improve it over time, we record a small set of product analytics events. These are collected first-party (directly by our own Supabase backend. No third-party analytics service, no Google Analytics, no Facebook Pixel, no advertising trackers) and are limited to:

• Feature use events, such as which view you are on, which template you clicked, when you create a project, when you export a chart, and when an upgrade prompt is shown. These let us see whether features are being used and where people drop off.
• Session metadata, the referring URL (if any), the path segment within bobbledesigns.com, and your browser viewport size. Recorded once per session to provide context to the feature events above.
• Authentication lifecycle events, sign-in, sign-out, session restoration, and token refresh. Used for diagnosing login issues and basic fraud monitoring.

If you arrive from a link carrying a campaign tag, we count that visit and what happens in the session in aggregate, to see which links bring people to Bobble. We do not use advertising cookies or pixels, and opting out of analytics stops this count.

We sometimes show two versions of a page, such as the home page, to see which helps more people make a chart. The version you see is worked out from your analytics session identifier and recorded with your session's events, and we compare the two versions only as totals. If you opt out, you always see the standard version. When a test ends we keep only its totals and delete the record of which version each session saw.

Each event is stored with a random session identifier (see section 8) and, if you are signed in, your account user ID, so we can distinguish repeat visitors from new ones and measure retention. Events are kept for no longer than 180 days before being deleted or aggregated. We also use these events, together with the dates you save or finish projects, to see whether each paying subscriber is still using Bobble. This shows the site operator, on the email-gated admin view described in section 5, whether a subscriber's use has stopped or fallen away, so that we can understand why people cancel and improve the Service. We make no automated decision about you from it: nothing about your account, your price or your access changes because of it. If you have opted out of analytics, only the dates you save or finish projects are used.

When a browser that has not opted out opens a design's page in the Gallery, we count one view of that design a day, keeping only a one-way code made from the session identifier, the design and the date, which we delete after two days; the page shows the total, which never names you.

We do not use advertising pixels, third-party analytics services, cross-site trackers, or any form of device fingerprinting. Analytics data is never shared with any third party.

Supabase (our backend host) automatically logs the IP address of incoming API requests as part of its platform infrastructure. We do not query, export, or analyse these logs ourselves, and they are retained according to Supabase's own retention policies.

If you would rather not have your activity included in our analytics, email us at hello@bobbledesigns.com and we will exclude your account from future event recording and delete any existing events linked to your account.

1.5 Share Referrals and Upgrade Prompts

These records are part of the analytics in section 1.4 and are not made if you opt out.

• Share referrals. If you arrive through someone's Bobble share link, gallery page or Pinterest pin and then create a project within 30 days, we record the share when that project is saved to your account, the channel (link, gallery or Pinterest) and your analytics session identifier against the new project. This links the visits you made to that share before signing in to your account, so we can tell whether shares bring in new makers. The session identifier is removed from the record after 180 days. The person who shared the link does not see this record.
• Upgrade prompts. When you reach a Pro limit, we note which feature it was (for example PDF export), the project you were working on and the time. If you are signed in, the most recent prompt is also saved against your account so we can tell whether a subscription followed within 30 days, and so the Pro follow-up email in section 1.6 can refer to it. It is deleted 180 days after the prompt was shown. If you subscribe within 30 days of a prompt, the feature is kept with your subscription record.

1.6 Project Emails

If you are signed in with a confirmed email address, we may send you a few emails about projects you are making in Make Mode: a reminder when a project has had no progress for about a week, a note the day after you finish one inviting you to add a photo of it, a suggestion to start another about two weeks after you finish, and, where you reached a Pro limit on a project and did not subscribe, one follow-up about that feature. These emails use your email address, the project's name and, for a reminder, the row you reached. We send no more than one of these project emails a week.

These emails are optional. Every one contains an unsubscribe link, and unsubscribing stops them. You can also ask us to stop them by emailing hello@bobbledesigns.com. We keep a record of each email sent (the address, the type of email and when it was sent) so that none is sent twice.

When a design you published or a photo you added is approved for the Gallery, we send you one email to say it is live, with the design's title and a link to it. If it is your own design and you have not added a photo of the finished piece, it also invites you to. These emails are optional in the same way: each has an unsubscribe link.

When a maker’s photo of a design you published is approved, we may email you to say so, at most once a week, with the design’s title and a link to it. Each of these emails has a link that stops them alone, and the usual unsubscribe link.

When an account is created we send one account notice to the address you signed in with, saying that the account was created, what it holds, how to delete it and how to tell us if it was not you, with links to the Terms and this policy.

If your free account has not been used for 60 days, we send one email to the address it signs in with, saying the date we will delete it (section 6). It is a service message about your account, so we send it even if you have unsubscribed from the emails above.

1.7 Gallery Activity

If you are signed in, we keep the following with your account:

• Make later. The designs you add to your Make later list and when you added each one. A design leaves the list when you remove it or start a project from it. If a design is taken out of the Gallery, your entry for it is kept but not listed, and does not count toward the 100 designs the list holds. We use the list to show it to you on Home, and we count how many makers want each design (its own designer is not counted). That count is not shown publicly.
• Design starts. When you save a project started from a design in the Gallery, we record once that your account started that design, with the project and the date, and, once you first make progress on such a project, that date, so that a design's starts count each maker once however many projects they make from it. The Gallery uses the count of starts to order designs by Most made, and a design's page shows how many makers have begun making it (Recrocheted). Both are totals and never name you.
• Chart answers. When you add your photo to a design someone else made, you can answer Did the chart work? with Yes, Mostly or No. The answer is kept with your photo. Answers are counted per design from approved photos only, are not shown publicly, and are never shown with your photo.
• Milestones. When the finish panel can tell you that your first design or photo is in the Gallery, or that another maker has started one of your designs, we record it once, with the date, against the project you were finishing.

None of this is published with your name. It is included in the data export in Account settings.

2. How We Use Your Information

We use the information collected for the following purposes:

• To provide, operate, and maintain the Service
• To authenticate your identity and manage your account
• To synchronise your projects across devices
• To process and manage your subscription via Stripe
• To review whether paying subscribers are still using the Service, so we can improve it and understand cancellations (section 1.4)
• To keep your Make later list, count how often each Gallery design is started and how well its chart worked, and show you milestones when you finish a project (section 1.7)
• To send optional emails about projects you are making, one when a design or photo of yours is approved for the Gallery, and at most one a week when another maker’s photo of your design is approved, unless you unsubscribe (section 1.6)
• To respond to support enquiries and service-related communications
• To delete free accounts that have not been used for 60 days, after warning you by email, so that we keep personal data no longer than we need it (section 6)
• To comply with applicable legal obligations

3. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation applies, we process your personal data on the following bases:

• Performance of a contract, to provide the Service you have requested
• Legitimate interests, to maintain and improve the Service, to understand whether paying subscribers continue to use it, and to ensure its security
• Legitimate interests, to send the optional project emails, Gallery approval emails and emails about your designs in section 1.6; every one carries an unsubscribe link, and you can object at any time
• Legitimate interests, to keep the Gallery activity in section 1.7 and use it to order and improve the Gallery
• Legitimate interests, and our duty to keep personal data no longer than necessary, to find free accounts that have not been used for 60 days, email them and delete them (section 6)
• Consent, where you have given explicit consent (e.g. signing in with Google)
• Legal obligation, where required to comply with applicable law

4. Third-Party Services

The Service integrates with the following third-party providers, each of which operates under its own privacy policy:

• Supabase, Inc., database hosting and authentication infrastructure (Privacy Policy)
• Stripe, Inc., payment processing and subscription management (Privacy Policy)
• Google LLC, OAuth sign-in (Privacy Policy)
• Cloudflare, Inc., hosting, content delivery, and DNS (Privacy Policy)
• Resend, email delivery (Privacy Policy)

We do not sell, rent, or share your personal data with any parties other than those listed above, and only to the extent necessary to operate the Service. There are two exceptions. If you send us a copyright notice, we send a copy of it, with your contact details, to the person who published the material, unless you ask us not to (Terms 9.2). And where the law requires it, we pass information about illegal content to the police or the relevant authority (Terms 8.2).

5. Data Storage and Security

Project, account, and analytics data is stored on Supabase-managed infrastructure. The specific hosting region is configured within our Supabase project settings; if you would like to know the current region, please contact us at hello@bobbledesigns.com. All data in transit is encrypted using TLS/HTTPS. Access to user project data is restricted by row-level security policies at the database level, ensuring that only you can access your own projects and account information, except for any chart you have chosen to publish to the community gallery, which is public (see section 12). Analytics events are not readable by end users: they are only visible to the site operator via a dedicated, email-gated admin view.

While we implement commercially reasonable security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data.

6. Data Retention

We retain your personal data only for as long as necessary to provide the Service and fulfil the purposes described in this policy. Specifically:

• Account data, kept until you delete your account, or until we delete an inactive free account. A free account is inactive when no one has signed in to it, opened Bobble on a device still signed in to it or saved a project to it for 60 days. We never delete for inactivity an account that has a Bobble Pro subscription, had one that ended in the last 60 days, or has work published in or sent to the Community Gallery. We email the account's address at least 14 days before the date we delete it, and signing in before then keeps the account (Terms 15.3).
• Project data, kept until you delete individual projects or your account, or until an inactive account is deleted as above. Projects created by signed-in users (free or Pro) are synchronised to the cloud and stored on our servers.
• Subscription and billing records. Stripe keeps the payment and invoice records. If an account that has paid for Bobble Pro is deleted, we keep its Stripe customer and subscription references, plan, status and dates, without its email address or projects, for 7 years after the year of its last payment, because tax law requires business records to be kept that long.
• Analytics events, retained for a maximum of 180 days, after which they are deleted or aggregated into anonymous totals
• Design view codes, deleted after two days; the view totals they add to are anonymous
• Share referral records, the analytics session identifier is removed after 180 days; the rest of the record is deleted with the project
• Upgrade prompt records, deleted 180 days after the prompt was shown, or sooner when a later prompt replaces them
• Project email records, the message is deleted with the project or your account; a short record of the address, the type of email and the send time is kept to prevent repeat sends
• Gallery email records, the message is deleted when the design or photo is removed or your account is deleted; a short record of the address, the type of email and the send time is kept so none is sent twice
• Gallery entries we take down, their images are moved out of public view and kept privately for 30 days so that an appeal can put them back (Terms 8.7), then deleted at a check we aim to run monthly. We keep them longer if you appeal, or the police or a court ask us to, and we have been told in time. If you delete your account, they are deleted at the next check without waiting for the 30 days, unless we are keeping them for one of those reasons. Images that no longer belong to any project or Gallery entry are moved out of view the same way and deleted 30 days later. Once the images are deleted or your account is gone, the record that the entry was taken down loses your email address. Material we report to the National Crime Agency is kept for one year from the report, and the report's reference for five years, as the law requires.
• Design email opt-outs, if you stop the emails about your designs, we keep your email address on a list so that none is sent to it again, including after you delete your account; email us to be taken off it
• Gallery activity (section 1.7), Make later entries until you remove them, start a project from the design, the design is deleted or you delete your account (an entry for a design taken out of the Gallery is kept but not listed); design starts until you delete your account, and they are kept when you delete the project, since a start is not taken back; chart answers until you remove the photo they belong to or delete your account; milestone records until you delete your account
• Deleted accounts. When an account is deleted, by you or because it was inactive, we delete its analytics events and those of its browser sessions. The counts those events had already added to our usage totals stay, under random codes that are not linked to you, to your browser or to any account, so the totals do not change.
• Inactive account warnings. For each warning email we keep the date sent and what happened next. Once the account is deleted, the record keeps only those dates and no longer identifies the account.
• Records the law requires. Payment and tax records, records of Gallery entries we took down, and material reported to the National Crime Agency are kept for the periods set out above, even after an account is deleted.

Users who continue without an account have their project data stored only in their browser's local storage, subject to their own device's retention policies. Analytics events from anonymous visitors are stored on our servers under a random session identifier (see section 8), which is not linked to any account or personal identifier, except where a share referral links it to a new project as described in section 1.5.

7. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access, request a copy of the personal data we hold about you
• Portability, download your data in a machine-readable format (JSON) via Account settings
• Rectification, request correction of inaccurate data
• Erasure, delete your account and its data via the "Delete my account" function in Account settings. We keep only the records section 6 lists that the law requires us to keep, or that no longer identify you
• Restriction, request that we restrict the processing of your data in certain circumstances
• Objection, object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@bobbledesigns.com. We will respond to all requests within 30 days.

8. Cookies and Local Storage

The Service does not set traditional HTTP cookies for tracking. It does, however, use your browser's localStorage for the following purposes:

• Authentication (strictly necessary), Supabase stores your session tokens so you remain signed in between visits and so short-lived access tokens can be refreshed in the background.
• Project storage (strictly necessary for local-only users). If you choose "Continue without account", your projects are saved in an IndexedDB database local to your browser.
• Photo hand-off (strictly necessary). If you choose a photo on the home page, it is kept in an IndexedDB database in your browser until the app opens it or your next visit to Bobble clears it, and the app ignores it after ten minutes. Choosing it sends nothing to us. If you then save a project while signed in, its picture is stored as section 1.2 describes.
• Analytics session identifier (opt-out), a random value (bobble_sid) stored to group your activity into sessions unless you have opted out, used to group your activity into sessions for the analytics described in section 1.4. A first-visit timestamp (bobble_first_seen) is also recorded so we can tell whether a session is a returning or new visitor. Neither value identifies you personally; neither is shared with any third party. It is also used to choose which version of a page you see during a test; no further value is stored.
• Share referral (opt-out), if you arrive through a Bobble share link, bobble_referral holds that share's identifier, the channel and the time, for section 1.5. It is removed when you create a project or after 30 days.
• Upgrade prompt (opt-out), bobble_pro_gate holds a random identifier, the feature, the project and the time of the last Pro limit you reached, for section 1.5. It is discarded after 30 days.

Opting out of analytics removes both of these values.

Clearing your browser's site data for bobbledesigns.com will remove all of the above and sign you out.

Your choice is remembered in a small bobble_consent value, which is strictly necessary and always stored. Change it any time through Cookie settings.

We do not deploy advertising cookies, cross-site trackers, or any form of third-party tracking technology.

9. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data, we will take steps to delete it promptly. If you believe a child under 16 has provided us with personal data, please contact us at hello@bobbledesigns.com.

10. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence, including within the European Union. Where applicable, we rely on adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms to ensure appropriate safeguards are in place.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The revised policy will be posted on this page with an updated effective date. For material changes, we will make reasonable efforts to notify you via the email address associated with your account.

Your continued use of the Service following the posting of changes constitutes your acceptance of such changes.

12. Community Gallery (Optional)

Publishing a chart to the community gallery is your choice. If you publish one, the chart, its preview image, and the title, description, subject, and publication date you provide become publicly visible, and may be indexed and cached by search engines and social platforms. The preview image is served from a public web address. Your photo of the finished piece is never included unless you choose it: tick Include my finished photo when you publish a chart of your own, press Add it to your design when you have already published one, or tick I took this photo of my finished piece, and it shows no recognisable person without their consent, when you add your photo to a design someone else made. Once approved, anyone can see the photo on that design's page in the gallery, and it may show on the design's card in the gallery and in the preview image when the page is shared. Removing it under Published works in your account deletes the published copy.

We do not publish your name or email address. Image addresses on the page contain a random number tied to your account. You can remove a published chart at any time from your account, or by emailing us at hello@bobbledesigns.com.

Only publish an image of an identifiable person with their agreement. To ask us to take down a chart that shows you, email us at hello@bobbledesigns.com. If it is an intimate image of you, use bobbledesigns.com/report-image (Terms 8.4).

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: hello@bobbledesigns.com