Privacy Policy
This page explains what Maskerade stores about you, why, for how long, and the rights you have. We have tried to keep it short and plain.
1. Who is responsible
The data controller is Maskerade (the company name and registration number will be added here before the open launch). The contact address for questions, access requests, deletion and content complaints will be published in the same place. Until then, you can reach us through the TestFlight invitation you received.
2. Using the app without an account?
Then everything is stored on your phone and we receive nothing. The rest of this policy applies when you sign in to use sync, backup, Knit Crews or the AI features.
3. What we store
Account. You sign in with Sign in with Apple. We receive your user ID and email address from Apple. If you choose to hide your email, we receive a relay address from Apple. If you provide a name, we store it as your display name.
Your content. Patterns (including the PDFs you upload and cover images), projects, progress, counters, reminders, annotations, your yarn and needle stash, and photos you add to projects and yarn.
AI usage. When you use AI import or label scanning, we store that the job ran, its status, the result of the reading, token count and cost. We use this for quotas and cost control.
Knit Crews. The crew name, the fact that you are a member, your display name, the patterns and projects you share with the crew, and hearts you give or receive.
Shared colour chart. When you save a yarn with a brand and colour number, the colour (name and hex) can contribute to a shared lookup that helps other users get the right colour suggestion. We store the brand, colour number and colour. The app never shows who contributed.
Technical data. Our services log errors and requests (timestamp, user ID, error code) for security and troubleshooting. Your content is not in these logs.
Subscription. Payment is handled by Apple. We only learn whether your subscription is active, never card details.
We use no tracking, advertising or third-party analytics in the app.
4. Why we use the data, and on what legal basis
| Purpose | Basis in the GDPR |
|---|---|
| Creating your account, storing and syncing your content, providing Knit Crews and the AI features | Contract with you (art. 6(1)(b)) |
| Shared colour chart | Legitimate interest (art. 6(1)(f)): better colour suggestions for everyone, with minimal data |
| Quotas, cost control, abuse prevention, security and troubleshooting | Legitimate interest (art. 6(1)(f)) |
| Answering your enquiries | Legitimate interest (art. 6(1)(f)) |
| Accounting | Legal obligation (art. 6(1)(c)) |
We do not rely on consent, so there is nothing you need to withdraw. If you do not want something processed, you can leave the feature unused or delete your account.
5. AI features and Anthropic
When you import a pattern with AI, the PDF (or its pages) is sent to Anthropic, the provider of the Claude language model. The same applies to the photos you take of yarn labels when you use label scanning. Anthropic only receives what you send in that specific job.
- Anthropic is our data processor and processes the data on our instructions.
- Anthropic does not use content from our API usage to train its models (Anthropic's commercial terms).
- Anthropic deletes content from API usage within 30 days. Exceptions: content flagged for violating Anthropic's usage policies can be kept longer (up to two years), and data can be retained where the law requires it.
- Processing happens mainly in the USA. The transfer is covered by the EU standard contractual clauses (SCC) in Anthropic's data processing agreement.
- Label photos are never stored with us. They go from your phone to Anthropic and are gone from our side once the answer is delivered.
- The PDF from an AI import sits in private storage with us until the import completes, and is then deleted — after 30 days at the latest. You keep a copy in your own library for as long as your account exists.
- You decide every time. Nothing is sent to the AI unless you start an import or a scan.
The AI can make mistakes. Always check the result against your pattern.
6. Who receives the data
| Recipient | Role | What | Where |
|---|---|---|---|
| Supabase | Data processor | Database, sign-in, file storage, server functions | Stockholm, Sweden (AWS eu-north-1) |
| Anthropic | Data processor | PDFs/photos when you use AI | USA (SCC) |
| Vercel | Data processor | Access logs for this website | Global content network |
| Apple | Independent controller | Sign in with Apple, purchases, TestFlight/App Store | Apple's own terms |
| Other members of your Knit Crew | What you choose to share (see below) |
We do not sell data and we do not share it with anyone else, unless the law requires it.
Knit Crews. Members of the same crew can see your display name, your projects (unless you hide them) and patterns you have explicitly shared with the crew. Sharing is off by default. When a member taps "Knit this" on a shared pattern, they get their own copy. If your account is deleted, what you shared disappears, but copies others have already started are their own and stay with them. The copies contain no information about you.
7. How long we store it
- Your content and account are stored for as long as you have an account.
- If you delete a pattern, project or photo in the app, it is removed from the server within 30 days.
- If you cancel your subscription, we keep the server copy for 90 days (you are notified in the app) and then delete it. Your data remains on your phone the whole time.
- You can delete your account at any time (see section 8). All content and all data are removed from our systems.
- Supabase backups rotate. Deleted data can therefore remain in backups for up to 7 more days, without us using it.
- AI jobs (status, cost, result) are deleted together with the account.
- Accounting records are kept as long as bookkeeping law requires, and contain none of your content.
8. Your rights
- Access and a copy. You can export your yarn stash, needle stash and project list from Profile. If you want everything (patterns, notes, photos), contact us and you will receive it in a common file format within 30 days.
- Correction. You can change all your content and your display name in the app.
- Deletion. In the app: Profile → Delete account. This deletes the account and all content, including files and AI history, and revokes your Apple connection. On an older version of the app without this button, contact us and we delete manually within 30 days. If you have an active subscription, you must cancel it with Apple yourself — Apple keeps billing until you do. If you created a Knit Crew, it is transferred to the longest-standing member; if you are alone in the crew, it is deleted.
- Restriction and objection. You can ask us to restrict processing, and you can object to processing based on legitimate interest.
- Data portability. See "access and a copy".
- Complaints. You can complain to the Norwegian Data Protection Authority (www.datatilsynet.no) if you believe we process your data unlawfully. We would appreciate you contacting us first.
We answer requests within 30 days.
9. Security
Your data is encrypted in transit. Each user can only read their own rows (row-level security in the database). Files sit in private storage and are only shared through time-limited links. Keys to our services are never in the app. If a security breach occurs that may affect you, we notify the Norwegian Data Protection Authority within 72 hours and you without undue delay if the risk is high.
10. Children
Maskerade is for people aged 13 or older. We do not knowingly collect data from children under 13. If we discover it, we delete the account.
11. Copyright and the content you upload
The PDFs you upload are your own purchased or lawfully obtained material. We only read them to deliver the features you ask for. See the terms of use for what you can share in a Knit Crew. If you believe something in Maskerade infringes your copyright, contact us and we remove the content within 48 hours if the claim is justified.
12. Changes
We may update this policy. For material changes we notify you in the app before they take effect. The latest version is always on this page.