Privacy Policy

Last updated: October 19, 2026

This policy explains what information CROSSTIA collects and why. It covers the web app at app.crosstia.com and the website at crosstia.com. CROSSTIA is run by the CROSSTIA team ("we", "us").

The short version: without an account, your patterns stay in your browser and never reach us. An account is optional and free: it holds your name, email address and plan, and the projects you work on while signed in, privately, so you can open them on any device. Payments are handled by Paddle; we never see your card. The app counts a few anonymous usage events, only in the way you choose; if you're signed in, your account also keeps a short activity summary (time in the app and how often you save, import and export), unless you say No thanks. This website counts visits anonymously with Cloudflare Web Analytics, without cookies.

Your patterns and files

CROSSTIA runs in your browser. Your patterns, images, palettes, branding and settings are stored on your device (in browser storage and IndexedDB autosave). Without an account, they are never uploaded: we can't see them, and we can't recover them if they're deleted from your browser.

If you sign in, the projects you work on are also saved to your account (the same project file, compressed), so your dashboard can show them and you can open them on any device. Only you can access them: they're stored privately with Supabase in the EU, and we don't look at them except to fix a problem you ask us about. You can delete any of them from your dashboard, and deleting your account deletes them all.

Accounts (optional)

You can use CROSSTIA without an account. If you choose to create one (it's free), you sign in with Google or with a one-time code sent to your email address. Your account holds:

• your email address and name (with Google sign-in, also the profile picture link Google provides);
• your projects: the projects you work on while signed in, with their title, size, colour count and a small preview picture (see "Your patterns and files" above);
• your plan: Free or the paid plan you chose, monthly or yearly, its status and renewal or end date;
• the Paddle customer and subscription IDs that link your account to your purchase, so we can show your plan and open Paddle's billing page for you;
• technical sign-in records (such as sign-in times and the security tokens that keep you signed in);
• a short activity summary, unless you chose No thanks for usage statistics (see below): the country you last used the app from (worked out from your connection; your IP address isn't stored), the app language you use, and for each day you use the app, how many minutes you were active in it, how long you used each tool (for example the pencil or fill), and how many times you saved a project, imported a photo or exported a file. When you export, it also notes a few facts about the design as numbers: its size in stitches, fabric count, thread brand, how many colours and stitches it has, whether it uses half or quarter stitches, backstitch, French knots, layers or an onion skin, whether it started from a photo, and how many minutes you worked on it. It also notes which branding fields your PDF patterns use (for example "shop name" or "logo"), never what they say. Never your patterns, pictures, colours, titles or file names. We use it to see how CROSSTIA is used and to improve it.

Your sign-in session is kept in your browser's storage. Account data and saved projects are stored by Supabase on servers in the EU (Frankfurt, Germany). We keep it until you ask us to delete your account; billing records Paddle must keep by law stay with Paddle.

To delete your account, email support@crosstia.com from the address you signed in with. Cancel any paid plan first (see the Refund Policy).

Anonymous usage statistics (app only)

To learn which features help and where things break, the app uses PostHog, hosted on EU servers, to record a small set of anonymous events: the app being opened, the first stitch you place, time-in-app milestones (5, 15, 30 and 60 minutes), the language you use the app in, Import Pattern being completed or cancelled (with the preset, a size range, a color-count range and the thread brand), exports (file type, PDF page count, and which branding fields a PDF uses, such as "shop name" or "logo", never their text), and app errors (the error type and a shortened message with any quoted text removed).

We never collect your patterns, images, colors, file names, pattern titles, or branding text and logos, and there is no session recording or click tracking.

The app asks for your choice the first time you open it:

• If you allow statistics, a random anonymous ID is kept in your browser so repeat visits can be counted.
• If you choose No thanks, nothing is stored in your browser, visits are only counted with an anonymous code that PostHog computes on its servers and changes daily, and no activity summary is added to your account.

PostHog receives your IP address with each request, as any web service does; it is not stored. You can change your choice at any time in the app under File → Licensing / Terms.

Visit statistics (crosstia.com only)

Cloudflare Web Analytics records anonymous visit statistics (page views, referrers, country and page load speed) without cookies or identifying visitors.

CROSSTIA AI (optional)

The CROSSTIA AI bar at the bottom of the canvas turns a typed request into steps you review before anything happens.

• Simple commands (such as "10 colours", "colour PDF" or "16 count") are understood inside your browser. Nothing is sent anywhere.
• Other requests (signed-in members) send, through our own server: the words you typed, and a short summary of your design made of counts and settings only (its size in stitches, fabric count, number of colours with their thread codes and names, and your PDF page settings). Your design itself, its images, your branding and your account details are never sent.
• Image requests ("draw an image of...") send only the words you typed. The picture comes back to your browser as a preview; nothing is added to your design unless you choose it.

These requests are answered by Google's Gemini AI and, as a backup and for images, by Cloudflare Workers AI. Google's free Gemini service may use what it receives to improve its products, so please don't type personal information into the AI bar. We don't keep the requests or the answers; we only count how many each member makes per day, to keep the free limits fair.

Service providers

• Cloudflare hosts both sites, including their fonts, delivers our email, and provides the anonymous visit statistics for crosstia.com described above. Like any web host, it processes standard request information (such as IP address and browser type) to serve pages and protect against abuse.
• PostHog (EU) receives the anonymous app statistics described above.
• Supabase (servers in Frankfurt, Germany) stores accounts, plan information and signed-in members' saved projects, and runs sign-in.
• Google confirms who you are if you choose "Continue with Google". Google tells us your name, email address and profile picture, and nothing else.
• Resend delivers the one-time sign-in codes to your email address.
• Paddle.com is our reseller and Merchant of Record for paid plans (see Payments below).
• Google (Gemini AI) and Cloudflare Workers AI answer CROSSTIA AI requests, as described above.
• WhatsApp (Meta) carries any chat you start with us through the WhatsApp links, under its own privacy policy.

Email and WhatsApp

If you email support@crosstia.com, we receive your email address and whatever you include in your message. We use it only to reply to you and to improve CROSSTIA, and we don't add you to any mailing list.

If you use the contact form on crosstia.com, its contents (your name, email address and message) are emailed to us and used only to reply to you; the website itself stores nothing.

If you message us on WhatsApp (+92 326 1655599), we see your phone number, your WhatsApp name and your messages, and use them only to reply to you. The conversation itself is handled by WhatsApp (Meta) under its own privacy policy.

Payments

CROSSTIA is free during the beta. Paid plans are sold by our reseller, Paddle.com, as Merchant of Record: Paddle runs the checkout, takes the payment, charges any sales tax or VAT, sends your receipts and handles your billing details under its own privacy policy. We never see or store your card number.

From Paddle we receive what we need to give you your plan: your email address, country, the plan and billing period you chose, the subscription status and dates, and Paddle's customer and subscription IDs. "Manage billing" in the app opens Paddle's own page, where you can cancel, change your card or download invoices.

Your rights

Depending on where you live (for example under the GDPR in the EU/UK, or California law), you may have the right to access, correct, delete or object to the use of personal information about you. Without an account we hold none of your patterns; with one, a request covers your account details, plan and saved projects. Email support@crosstia.com and we'll respond within 30 days. You can also complain to your local data protection authority.

Children

CROSSTIA is not directed at children under 13, and we don't knowingly collect personal information from them.

Changes

We'll update this policy when CROSSTIA changes. We'll change the "Last updated" date above, and for significant changes we'll give notice on this site or in the app.

Contact

CROSSTIA · support@crosstia.com