Boldbobbin LogoBoldbobbin

Privacy Policy

This website and software (“Boldbobbin”, “we”, “our”, or “us”) is operated by Boldbobbin GmbH, a limited liability company incorporated in Switzerland (UID: CHE-368.246.596) with its registered seat in Zürich. You may contact us via our contact page or at alexandre [ at ] boldbobbin . com. We respect your privacy, and this policy explains how we collect, use, and protect your personal data when you use our website and services. This Privacy Policy complies with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. What We Collect

  • Account information: your email address, name, and country
  • Authentication and login data
  • Embroidery designs and files you create or upload
  • Website usage and analytics data (only with your consent)
  • Events the Boldbobbin app reports about how the software is used and about freezes it runs into, described in section 8. These are collected without consent, on the legitimate-interest basis set out in section 2
  • Advertising measurement data, such as which advertisement brought you to the site and whether you subsequently signed up or subscribed (only with your consent)
  • IP address, browser type, and device information
  • Your answers to the optional survey in the app, if you choose to answer it: how you found Boldbobbin, what describes you, your digitizing experience, the software you have used, what you value, and any message you add. We store them with your account and use them only to improve Boldbobbin. We never sell them, and they are deleted when you delete your account.

2. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance: to provide the service you signed up for (account management, cloud sync, file storage), and to send you service notices about your account, such as sign-up confirmation, password resets, and changes to these policies
  • Consent: for analytics and marketing cookies on our website, and for the advertising measurement described in section 7, all of which you may accept or decline when you first visit and change at any time. Your answers to the optional in-app survey described in section 1 are also collected on this basis. Our newsletter is sent on this basis, to people who opted in when they signed up, and it is also where our product announcements go. Every issue carries an unsubscribe link, and unsubscribing does not stop the service notices above, which are part of providing the service
  • Legitimate interest: to understand how the app is used, and to find and fix the freezes and slowdowns people report, both described in section 8; and more generally to improve our service and keep it secure. You may object to processing on this basis at any time. Section 8 explains how, and what we can and cannot act on once you have
  • Legal obligation: where required by Swiss or EU law

3. How We Use Your Data

We use your data to:

  • Provide and improve our services
  • Manage your account and authenticate your identity
  • Respond to inquiries and provide support
  • Understand usage patterns through analytics
  • Find and fix freezes, slowdowns, and other defects in the app
  • Comply with legal obligations

4. Sharing and Sub-Processors

We do not sell your personal data. We may share it with trusted third-party service providers (sub-processors) who process data on our behalf, including:

  • Hetzner (Germany, EU): hosting and storage of application data, your designs, and the app events described in section 8, on our self-hosted infrastructure
  • Cloudflare: delivery of our website and web app (Cloudflare Pages / CDN), and cookieless web analytics
  • Stripe: payment processing as merchant of record
  • Resend: delivery of transactional and account emails (e.g. sign-up confirmation and password reset). Your email address is also stored with Resend in our mailing lists, which include a list of all users, used for the service notices described in section 2, and, if you opted in, our newsletter list.
  • Google Analytics: site analytics (only if you have accepted analytics cookies)
  • Reddit: advertising measurement and audience building (only if you have accepted marketing cookies)
  • OpenAI: image generation for the Line art & Redwork and Vector stylization methods (only when you run one; see section 6)
  • RunPod: GPU and CPU compute for the Pixel art and Line art & Redwork methods, and for tracing a line drawing you already have (only when you run one; see section 6)

Separately, we may disclose personal data to legal authorities or other third parties where required by applicable law, or to establish, exercise, or defend our legal rights. Such recipients receive data as independent recipients, not as sub-processors acting on our behalf.

5. International Data Transfers

Your designs, your account data, and the app events described in section 8 are stored on our own infrastructure with Hetzner in Germany (EU), which gives them EU data residency. Other information is held by the providers named in section 4: your email address, for example, is also held by Resend so that we can send you account email.

OpenAI, RunPod, and Resend are based in the United States and may process data there. For OpenAI and RunPod this applies only to the advanced auto-digitizing methods described in section 6, and only when you choose to run one; Resend holds your email address in order to send you account email. Stripe, Cloudflare, Google Analytics, and Reddit may also process certain data outside Switzerland or the European Union.

Where data is processed outside Switzerland or the European Union, we rely on the standard contractual clauses in each provider's data processing agreement, or on equivalent safeguards approved under the nFADP and GDPR.

6. Advanced Auto-Digitizing

Boldbobbin's advanced auto-digitizing methods do their work on external services rather than on your own machine. This happens only when you choose to run one of them. No other part of Boldbobbin sends your designs or images to these services.

Which service receives what depends on the method:

  • Pixel art: sent to RunPod, which provides the compute. In prompt-only mode no image is sent at all, only the text you entered.
  • Line art & Redwork: sent to OpenAI, which generates a line drawing, and then to RunPod, which converts it to vectors.
  • Tracing a line drawing you already have: sent to RunPod, which converts it to vectors. RunPod is the only service involved: your own drawing is traced as it is, and no image is generated. This is what runs behind “Already a line drawing” in the Line art & Redwork panel, and “Import a drawing” in the line-art editor.
  • Vector stylization: sent to OpenAI, which generates the image.

Any text you enter, such as a prompt or a style note, is sent along with the image.

The metadata embedded in your image is removed twice. The app removes it on your own device before the image is uploaded to us, including GPS coordinates, and our server removes it again before anything is sent to OpenAI or RunPod. The image is also resized before it is sent.

We keep the image you uploaded for 30 days, after which it is deleted from our storage. Generated results are kept in your account until you delete your account. A design you create from one can be deleted at any time, like any other design.

Separately, and under its own policy rather than ours, OpenAI may retain data sent through its API for up to 30 days for abuse monitoring. OpenAI's API data policy also states that data sent through its API is not used to train its models by default.

7. Cookies and Advertising Measurement

We use essential cookies to operate the service. With your consent, we also use analytics cookies (Google Analytics) to understand how the site is used, and marketing cookies (the Reddit Ads pixel) to measure whether our advertising reaches people who find Boldbobbin useful. When you first visit the Site, a dialog lets you accept all of these, reject all of them, or choose category by category, and both remain disabled until you accept. We also use Cloudflare Web Analytics, which is cookieless and does not track you across sites.

If you accept marketing cookies and later subscribe, we additionally send Reddit a record of that subscription from our own server rather than from your browser, so that the advertisement can be credited correctly. That record contains the purchase amount and identifiers that let Reddit match it to your ad click, including your email address in an irreversible hashed form. Nothing is sent if you have not accepted marketing cookies. See our Cookie Policy for more detail.

8. Analytics in the App

The Boldbobbin app reports a small number of events to our own servers, so that we can see which parts of the software people actually use and where the software gets in their way. This is separate from the website analytics in section 7. It involves no cookies and no analytics provider: the events go to our own API and are stored in our own database at Hetzner in Germany (EU).

Two kinds of event are sent:

  • Milestones: that the editor was opened, that a first shape was drawn, that a design was saved, that a design was exported, that an upgrade prompt was shown, that a step of the tutorial was reached, and similar points in using the software.
  • Stalls: if the app stops responding for a second or more, one event recording how long that lasted, which view was open, what the app was doing at the time, such as resizing a panel, loading, or undoing, and how big the design was, as a count of objects and a rounded stitch count.

Each event carries a randomly generated identifier stored on your device, whether it came from the desktop app or from your browser, the version of the app, and a coarse operating system name such as “Windows” or “macOS”. If you are signed in, the event is also linked to your account. No design content is included, and neither are file names nor any text you have typed.

We collect this on the basis of our legitimate interest in knowing how Boldbobbin is used and in finding the freezes and slowdowns that people report to us. The events are first-party and stay that way: they are not shared with anyone, not used for advertising, not used to build a profile of you, and not combined with data from other sites.

The app does not ask for your consent before sending these events, and it has no setting that switches them off. If you would rather it did not send them, write to us via our contact page or at the address in section 12. Where events are linked to your account we can find them, and we will stop recording them and delete those already stored. Events sent while you were not signed in carry only the device identifier and cannot be connected to you, which is also the reason we cannot pick yours out in order to delete them.

We keep these events for 14 months, after which they are deleted. The counts and trends we derive from them are kept for longer, because once aggregated they no longer identify anyone.

9. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, all of your personal information (email, name, country, and authentication data) is permanently deleted. Your design files are disassociated from your identity and may continue to exist in our storage in an unlinked, de-identified form until they are periodically purged; once unlinked, they can no longer be associated with you.

Images supplied to the advanced auto-digitizing methods follow their own schedule, set out in section 6, and the events the app reports follow theirs, set out in section 8.

Data that we are required to retain for legal or accounting purposes may be kept for longer where required by law. Deleted data may also persist temporarily in our encrypted backups, which are rotated on a rolling basis (full-server images are retained for the last 7 days and logical database dumps for the last 30 days), after which the deleted data is removed from backups.

10. Your Rights

Depending on your location, you have the right to access, correct, delete, restrict, object to, or export your personal data. You may object to direct marketing at any time, including by using the unsubscribe link in any newsletter. Section 8 explains how to object to the events the app reports, and the limits of what we can act on. To exercise any of these rights, contact us via our contact page or at alexandre [ at ] boldbobbin . com. EU residents also have the right to lodge a complaint with their national data protection supervisory authority. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).

11. Changes

We may update this Privacy Policy from time to time. Registered users will be notified of significant changes via email. Last updated: October 17, 2026.

12. Contact

For any privacy-related questions or requests, please contact us via our contact page or at alexandre [ at ] boldbobbin . com.