Boldbobbin LogoBoldbobbin

Privacy Policy

This website and software (“Boldbobbin”, “we”, “our”, or “us”) is operated by Boldbobbin GmbH, a limited liability company incorporated in Switzerland (UID: CHE-368.246.596) with its registered seat in Zürich. You may contact us via our contact page or at alexandre [ at ] boldbobbin . com. We respect your privacy, and this policy explains how we collect, use, and protect your personal data when you use our website and services. This Privacy Policy complies with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. What We Collect

  • Account information: your email address, name, and country
  • Authentication and login data
  • Embroidery designs and files you create or upload
  • Your conversations with Bobby, the assistant in the app, if you use him: your messages and his replies, the pictures you attach, previews the app renders of your design, details of the design, and any feedback you give him, described in section 7
  • Website usage and analytics data (only with your consent)
  • Events the Boldbobbin app reports about how the software is used and about freezes it runs into, described in section 9. These are collected without consent, on the legitimate-interest basis set out in section 2
  • Advertising measurement data, such as which advertisement brought you to the site and whether you subsequently signed up or subscribed (only with your consent)
  • IP address, browser type, and device information
  • Your answers to the optional survey in the app, if you choose to answer it: how you found Boldbobbin, what describes you, your digitizing experience, the software you have used, what you value, and any message you add. We store them with your account and use them only to improve Boldbobbin. We never sell them, and they are deleted when you delete your account.

2. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance: to provide the service you signed up for (account management, cloud sync, file storage, and Bobby and the advanced auto-digitizing methods when you choose to use them), and to send you service notices about your account, such as sign-up confirmation, password resets, and changes to these policies
  • Consent: for analytics and marketing cookies on our website, and for the advertising measurement described in section 8, all of which you may accept or decline when you first visit and change at any time. Your answers to the optional in-app survey described in section 1 are also collected on this basis. Our newsletter is sent on this basis, to people who opted in when they signed up, and it is also where our product announcements go. Every issue carries an unsubscribe link, and unsubscribing does not stop the service notices above, which are part of providing the service
  • Legitimate interest: to understand how the app is used, and to find and fix the freezes and slowdowns people report, both described in section 9; and more generally to improve our service and keep it secure. You may object to processing on this basis at any time. Section 8 explains how, and what we can and cannot act on once you have
  • Legal obligation: where required by Swiss or EU law

3. How We Use Your Data

We use your data to:

  • Provide and improve our services
  • Manage your account and authenticate your identity
  • Respond to inquiries and provide support
  • Answer what you ask Bobby, and use the feedback you give him to improve him
  • Understand usage patterns through analytics
  • Find and fix freezes, slowdowns, and other defects in the app
  • Comply with legal obligations

4. Sharing and Sub-Processors

We do not sell your personal data. We may share it with trusted third-party service providers (sub-processors) who process data on our behalf, including:

  • Hetzner (Germany, EU): hosting and storage of application data, your designs, and the app events described in section 9, on our self-hosted infrastructure
  • Cloudflare: delivery of our website and web app (Cloudflare Pages / CDN), and cookieless web analytics
  • Stripe: payment processing as merchant of record
  • Resend: delivery of transactional and account emails (e.g. sign-up confirmation and password reset). Your email address is also stored with Resend in our mailing lists, which include a list of all users, used for the service notices described in section 2, and, if you opted in, our newsletter list.
  • Google Analytics: site analytics (only if you have accepted analytics cookies)
  • Reddit: advertising measurement and audience building (only if you have accepted marketing cookies)
  • Anthropic: the AI model that answers you in Bobby's chat (only when you use Bobby; see section 7)
  • OpenAI: image generation for concept pictures, for Vector stylization, and for the drawing step of Line art & Redwork, and the content checks run on the text you enter for a concept picture or a Vector stylization (only when one is run; see section 6)
  • RunPod: rented servers that run Pixel art, the tracing of a line drawing you already have, and the vectorising step of Line art & Redwork (only when one is run; see section 6)

Separately, we may disclose personal data to legal authorities or other third parties where required by applicable law, or to establish, exercise, or defend our legal rights. Such recipients receive data as independent recipients, not as sub-processors acting on our behalf.

5. International Data Transfers

Your designs, your account data, and the app events described in section 9 are stored on our own infrastructure with Hetzner in Germany (EU), which gives them EU data residency. Other information is held by the providers named in section 4: your email address, for example, is also held by Resend so that we can send you account email.

Anthropic, OpenAI, RunPod, and Resend are based in the United States and may process data there. For Anthropic this applies only when you use Bobby, described in section 7. For OpenAI and RunPod it applies only to the advanced auto-digitizing methods described in section 6, and only when one is run, by you or by Bobby at your confirmation. Resend holds your email address in order to send you account email. Stripe, Cloudflare, Google Analytics, and Reddit may also process certain data outside Switzerland or the European Union.

Where data is processed outside Switzerland or the European Union, we rely on the standard contractual clauses in each provider's data processing agreement, or on equivalent safeguards approved under the nFADP and GDPR.

6. Advanced Auto-Digitizing

Boldbobbin's advanced auto-digitizing methods do their work on external services rather than on your own machine. This happens only when one of them is run: by you, or by Bobby after you confirm it. Apart from Bobby's own chat, described in section 7, no other part of Boldbobbin sends your designs or images to external services.

Which service receives what depends on the method:

  • Pixel art: sent to RunPod, which provides the compute. In prompt-only mode no image is sent at all, only the text you entered.
  • Line art & Redwork: sent to OpenAI, which generates a line drawing, and then to RunPod, which converts it to vectors.
  • Tracing a line drawing you already have: sent to RunPod, which converts it to vectors. RunPod is the only service involved: your own drawing is traced as it is, and no image is generated. This is what runs behind “Already a line drawing” in the Line art & Redwork panel, and “Import a drawing” in the line-art editor.
  • Vector stylization: sent to OpenAI, which generates the image in the new style. The style and note you enter are first checked by OpenAI's content checks, which read the text only.
  • Concept picture: made only through Bobby, from words rather than from an image of yours. The prompt you approve is checked by OpenAI's content checks, then sent to OpenAI, which generates the picture.

Any text you enter, such as a prompt or a style note, is sent along with the image.

The metadata embedded in your image is removed twice. The app removes it on your own device before the image is uploaded to us, including GPS coordinates, and our server removes it again before anything is sent to OpenAI or RunPod. The image is also resized before it is sent.

We keep the image you uploaded for 30 days, after which it is deleted from our storage. Generated results are kept in your account until you delete your account. A design you create from one can be deleted at any time, like any other design.

Separately, and under its own policy rather than ours, OpenAI may retain data sent through its API for up to 30 days for abuse monitoring. OpenAI's API data policy also states that data sent through its API is not used to train its models by default. RunPod's part is processing on servers we rent from it.

7. Bobby, the Assistant

Bobby is an assistant in the Boldbobbin app. He answers questions and can build or change the design you have open. He is an experimental feature, and he works only when you are signed in and write to him.

When you send Bobby a message, the following is sent to Anthropic, which provides the AI model that answers you:

  • your message and the conversation so far, including his replies
  • the pictures you attach
  • previews the app renders of your design, so that he can see it
  • details of your design: a summary of it (such as its size, hoop, fabric, and the names of its objects), what you have selected, its threads, and the geometry of its shapes

The design file itself is never sent.

If Bobby runs an advanced auto-digitizing method for you, such as a concept picture, it goes to the services named in section 6, exactly as if you had run it yourself, and only after you confirm it.

We keep a conversation with Bobby for 90 days after its last activity, then delete it together with its pictures. The pictures you attach are deleted after 30 days, even while the conversation goes on. A thumbs up or down you give one of his answers, and any comment you add to it, are deleted with the conversation. You may ask us to delete a conversation sooner, as with any of your data (see section 11).

Separately, and under its own policy rather than ours, Anthropic deletes the inputs and outputs of its API within 30 days. It keeps them longer only if they are flagged for a violation of its Usage Policy, or where the law requires it.

8. Cookies and Advertising Measurement

We use essential cookies to operate the service. With your consent, we also use analytics cookies (Google Analytics) to understand how the site is used, and marketing cookies (the Reddit Ads pixel) to measure whether our advertising reaches people who find Boldbobbin useful. When you first visit the Site, a dialog lets you accept all of these, reject all of them, or choose category by category, and both remain disabled until you accept. We also use Cloudflare Web Analytics, which is cookieless and does not track you across sites.

If you accept marketing cookies and later subscribe, we additionally send Reddit a record of that subscription from our own server rather than from your browser, so that the advertisement can be credited correctly. That record contains the purchase amount and identifiers that let Reddit match it to your ad click, including your email address in an irreversible hashed form. Nothing is sent if you have not accepted marketing cookies. See our Cookie Policy for more detail.

9. Analytics in the App

The Boldbobbin app reports a small number of events to our own servers, so that we can see which parts of the software people actually use and where the software gets in their way. This is separate from the website analytics in section 8. It involves no cookies and no analytics provider: the events go to our own API and are stored in our own database at Hetzner in Germany (EU).

Three kinds of event are sent:

  • Milestones: that the editor was opened, that a first shape was drawn, that a design was saved, that a design was exported, that an upgrade prompt was shown, that a step of the tutorial was reached, and similar points in using the software.
  • Assistant use: that a message was sent to Bobby and how many pictures it carried, how his reply ended and whether it changed the design, whether you confirmed or declined a generation he offered and at what price, that you undid one of his replies, and the thumbs up or down you gave. These events never contain your messages, his replies, the comment you add to your feedback, or any design content.
  • Stalls: if the app stops responding for a second or more, one event recording how long that lasted, which view was open, what the app was doing at the time, such as resizing a panel, loading, or undoing, and how big the design was, as a count of objects and a rounded stitch count.

Each event carries a randomly generated identifier stored on your device, whether it came from the desktop app or from your browser, the version of the app, and a coarse operating system name such as “Windows” or “macOS”. If you are signed in, the event is also linked to your account. No design content is included, and neither are file names nor any text you have typed.

We collect this on the basis of our legitimate interest in knowing how Boldbobbin is used and in finding the freezes and slowdowns that people report to us. The events are first-party and stay that way: they are not shared with anyone, not used for advertising, not used to build a profile of you, and not combined with data from other sites.

The app does not ask for your consent before sending these events, and it has no setting that switches them off. If you would rather it did not send them, write to us via our contact page or at the address in section 13. Where events are linked to your account we can find them, and we will stop recording them and delete those already stored. Events sent while you were not signed in carry only the device identifier and cannot be connected to you, which is also the reason we cannot pick yours out in order to delete them.

We keep these events for 14 months, after which they are deleted. The counts and trends we derive from them are kept for longer, because once aggregated they no longer identify anyone.

10. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, all of your personal information (email, name, country, and authentication data) is permanently deleted. Your design files are disassociated from your identity and may continue to exist in our storage in an unlinked, de-identified form until they are periodically purged; once unlinked, they can no longer be associated with you.

Images supplied to the advanced auto-digitizing methods follow their own schedule, set out in section 6; your conversations with Bobby follow theirs, set out in section 7; and the events the app reports follow theirs, set out in section 9.

Data that we are required to retain for legal or accounting purposes may be kept for longer where required by law. Deleted data may also persist temporarily in our encrypted backups, which are rotated on a rolling basis (full-server images are retained for the last 7 days and logical database dumps for the last 30 days), after which the deleted data is removed from backups.

11. Your Rights

Depending on your location, you have the right to access, correct, delete, restrict, object to, or export your personal data. You may object to direct marketing at any time, including by using the unsubscribe link in any newsletter. Section 8 explains how to object to the events the app reports, and the limits of what we can act on. To exercise any of these rights, contact us via our contact page or at alexandre [ at ] boldbobbin . com. EU residents also have the right to lodge a complaint with their national data protection supervisory authority. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).

12. Changes

We may update this Privacy Policy from time to time. Registered users will be notified of significant changes via email. Last updated: November 1, 2026.

13. Contact

For any privacy-related questions or requests, please contact us via our contact page or at alexandre [ at ] boldbobbin . com.