Privacy Policy

Last updated: September 5, 2026

This Privacy Policy explains how Backwards Dog LLC (“we”, “us”, or “our”) collects, uses, and protects information when you use xstitch.me (the “Service”).

1. Information We Collect

Account information: your username and email address, provided when you create an account.
Content you provide: the images and patterns you upload to the Service.
Sign-in and security information: when you sign in, confirm your email address, or reset your password, we generate and process the session tokens, verification codes, and reset links used by those flows. Passwords, tokens, and codes are stored only in hashed form.
Payment information: if you purchase a paid pass, your payment is processed by our payment processor, Stripe. We do not receive or store your payment card number. We receive from Stripe only the information needed to manage your pass, such as a customer identifier, transaction records, and pass status.
Usage and technical information: pages visited and features used, your IP address, and information about your browser or device, collected automatically when you use the Service (including by our infrastructure providers, as described in Section 4) to operate, secure, and improve the Service.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, secure, and maintain the Service, including storing your patterns and thread inventory;
Process your purchases of paid passes through our payment processor;
Respond to your requests and support questions;
Improve the Service and fix issues;
Communicate with you about the Service when necessary, including notices of material changes to this Policy or our Terms of Service;
Comply with the law, and protect our rights, safety, or property or the safety of others.

3. Cookies

We use cookies and similar technologies to keep you signed in: when you sign in, we set a session cookie that lets the Service recognize you as you use it. We also use cookies and similar technologies to remember preferences such as your language. You can control these through your browser settings; disabling them may sign you out or affect some features.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only with service providers that help us operate the Service — such as our hosting provider (Fly.io), frontend hosting and content delivery provider (Cloudflare), payment processor (Stripe; see Stripe’s Privacy Policy at https://stripe.com/privacy), and email delivery providers — and only as needed to provide the Service. We may also disclose personal information when required or permitted by law, such as to comply with a subpoena or other legal process; to enforce our Terms of Service; to protect our rights, privacy, safety, or property, or the safety of others; to detect, prevent, or address fraud, security, or technical issues; or in connection with a merger, acquisition, or sale of assets.

5. Data Retention, Deletion, and Security

We retain your information for as long as your account is active or as needed to provide the Service, or as required or permitted by law.

You may request deletion of your account, your content, and your personal information at any time by emailing support@xstitch.me, as described in Section 6 of our Terms of Service. We will process deletion requests within 30 days of receiving them, and we will delete the information you asked us to delete except where we are required or permitted to keep records to comply with the law, resolve disputes, or enforce our Terms of Service.

Your information is processed and stored in the United States, on servers provided by our hosting provider (Fly.io). We take reasonable measures to protect your information, but no method of transmission or storage is completely secure.

6. Your Rights

Depending on where you live, you may have rights to access, correct, or delete your personal information. You can contact us using the details below to exercise these rights. We may ask you to verify your identity before acting on a request.

California residents. If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know the categories and specific pieces of personal information we collect, use, and disclose; to correct inaccurate personal information; to delete personal information; to opt out of the sale or sharing of your personal information for cross-context behavioral advertising; and not to be discriminated against for exercising these rights. We do not sell your personal information and we do not share it for cross-context behavioral advertising. To exercise these rights, email support@xstitch.me; we will respond to verifiable requests within 45 days.

7. Children

The Service is not directed to children under 13, and our Terms of Service require users to be at least 13 years old (and to have the consent of a parent or legal guardian if they are under the age of majority in their jurisdiction). We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us personal information, contact us at support@xstitch.me.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will provide at least fourteen (14) days’ notice before the change takes effect by posting the revised Policy on this page and by email to the address associated with your account, consistent with how we notify material changes to our Terms of Service. Non-material changes take effect when posted.

9. Contact

Questions about this Privacy Policy may be directed to support@xstitch.me.