Privacy Policy

Effective Date: May 3, 2026 · Last Updated: September 21, 2026

Introduction

Welcome to Threadologie by Lu (the "App"), a mobile application designed for beadwork enthusiasts to create, track, and manage their beadwork patterns. This Privacy Policy explains how we collect, use, and protect your information when you use our App.

This Privacy Policy is provided for your information. For analytics, crash reporting and measuring our own ad campaigns, we rely on our legitimate interests (see the Legal Basis for Processing section below), not on your consent. You can object at any time (see "Right to Object" below), and you can disable analytics and crash reporting in Settings → Terms & Privacy → Analytics & Crash Reporting.

Data We Store Locally

Your patterns, progress and notes are stored only on your device. The limited data that leaves your device is described in the sections below.

Local Data Storage (On Your Device Only):

• Beadwork Patterns: Pattern images, designs, grid data, and color palettes you create or import
• Progress Tracking: Which beads you've marked as complete in your patterns
• Pattern Notes: Custom notes you add to patterns
• Favorites: Patterns you've marked as favorites
• Recently Viewed: Patterns you've recently opened
• Preferences: App settings and customizations

Camera and Photo Library Access

• Camera: Used only to scan QR codes for importing patterns, to scan bead labels to add colors to your palette, and to take photos for creating patterns from images
• Photo Library: Used only to import photos for creating custom bead patterns
• We do NOT store, upload, or share any photos or camera data

Auto-Renewable Subscriptions (In-App Purchases)

We offer optional subscription tiers processed by Apple (iOS) or Google (Android). RevenueCat manages subscription status.

Subscription Tiers:

* Prices shown in USD. Local currency equivalent applies. Includes applicable taxes (VAT/GST).

Subscription Terms:

• Free Trial: 7-day free trial available for first-time subscribers (may not be available in all regions)
• Auto-Renewal: Subscriptions automatically renew unless cancelled at least 24 hours before the end of the current period
• Payment Timing: Your account will be charged for renewal within 24 hours prior to the end of the current period
• Payments: Processed by Apple (App Store) or Google (Google Play). RevenueCat only manages subscription status. Your payment information never reaches us

What We Store Locally:

• Subscription Status: Your current tier is cached on your device, and the RevenueCat software keeps its own cached copy (including the expiry date), so paid features keep working offline for a short time
• Pattern Creation Count: Number of patterns you've created (for free tier enforcement: 3 pattern limit)

Managing Your Subscription:

You can manage, cancel, or view your subscription status through your device settings:

• iOS (iPhone/iPad): Settings → [Your Name] → Subscriptions → Threadologie by Lu → Cancel Subscription
• Android: Google Play Store → Profile → Payments & subscriptions → Subscriptions → Threadologie by Lu → Cancel subscription
• Learn more: iOS | Android

Cancellation and Refunds:

• Cancel Anytime: You can cancel your subscription at any time through your App Store/Play Store account
• No Partial Refunds: Cancelling does not provide refunds for partial months
• Access Continues: After cancellation, you retain access until the end of your current billing period
• Auto-Renewal Stops: Your subscription will not renew after the current period expires
• Resubscribe: You can resubscribe at any time to regain access

Data After Cancellation:

• Your Patterns Are Safe: Patterns you created while subscribed remain accessible even after cancellation
• Viewing Only: After cancellation, you can view all your patterns but cannot create new ones beyond the 3 patterns of the free tier
• No Data Loss: We never delete your patterns when a subscription expires

What We Do NOT Collect

We do not collect or store directly identifying information about you. Specifically, we do not collect:

• Your name, email address, phone number, or postal address (unless you choose to email us; see "Contact Us")
• Precise location data
• Advertising identifiers
• Third-party tracking cookies (in the app)
• Account credentials (no signup required)

We do collect a limited amount of pseudonymous data via Firebase (analytics and crash reports) and RevenueCat (subscription status and purchase history), and a small amount of operational data on our servers (coupon redemption records keyed to an anonymous user ID). Under EU law, pseudonymous identifiers are treated as personal data even though they are not linked to your name or contact details. See "Analytics and Crash Reporting", "Cloud Functions & Coupon Redemption" and "Subscription Management (RevenueCat)" below for details.

Data Processing

Local Processing Only:

• Pattern Creation: Process images locally on your device to convert them to bead patterns
• Progress Tracking: Store your bead completion states locally to track your progress
• Pattern Management: Organize, search, filter, and sort your patterns locally
• Export/Share: Generate QR codes and JSON files locally for sharing patterns

Server Communication:

• Patterns stay local: Your patterns, progress, and notes are never uploaded to our servers
• Offline-first: Core pattern creation, editing, tracking, and viewing work offline. Optional features such as coupon redemption, subscription verification, checking for updates, opening shared pattern links, and analytics require a network connection.
• No cloud sync or backup service run by us. Your device's own backup (iCloud or Google) may include the app's data, under Apple's or Google's terms
• Limited server calls: The app contacts our Firebase Cloud Functions only when you redeem a coupon code, and our website to download the Examples content and the list of bead shops, and when opening a shared pattern link. These downloads are ordinary file requests that contain no identifier. See "Cloud Functions & Coupon Redemption" and "Links to Bead Shops (Affiliate Links)" below for details.
• Update check: At launch the app asks the App Store or Google Play whether a newer version exists. The request contains the app's ID and your device's country (on Android also its language), and no user identifier.

Cloud Functions & Coupon Redemption

We operate a small set of Firebase Cloud Functions (hosted by Google Cloud) to support promotional coupon codes. These are the only server-side components we run.

When This Runs:

• Only when you enter a coupon code in the app and tap "Redeem"
• Never in the background, never during normal app use

What Is Sent:

• The coupon code you entered
• Your anonymous RevenueCat app user ID (a random identifier created for this installation of the app, not linked to your name or email)
• A Firebase App Check token (proves the request comes from the genuine app)
• To unlock your subscription, our function then passes your anonymous app user ID to RevenueCat

What Is Stored (Firestore):

• A record of the coupon code, its expiration, and the anonymous app user IDs that have redeemed it, and when
• A counter of recent redemption attempts, stored under a scrambled (hashed) form of your anonymous app user ID, to limit repeated attempts
• Technical logs of the function, which include the anonymous app user ID, are kept by Google Cloud for a limited time
• Purpose: Prevent the same coupon from being redeemed twice by the same user, and enforce campaign limits
• Retention: Coupon redemption records are kept so that a code cannot be used twice. Your anonymous app user ID is removed from them on request (see Data Deletion)
• No directly identifying data: No name, email, IP address, or payment information is stored

Links to Bead Shops (Affiliate Links)

Some examples in the app show a "Shop beads" button, and color sheets show a "Buy" button. Both list online bead shops. These shops are independent third parties. Some of the links are affiliate links: if you buy something after following one, we may earn a commission from the shop, at no extra cost to you. The app says so next to the links whenever this applies.

What Happens in the App:

• The app sends nothing about you to the shop: Tapping a shop opens its page in your device's web browser, outside the app. The app passes no identifier, no pattern, no color list and no other information about you to the shop or to its affiliate network. The link only identifies Threadologie as the partner that referred the visit.
• Your store country stays on your device: To show only shops that serve your country, the app reads the country of your App Store or Google Play account (or, if that is not available, your device's region setting). This country code is used on your device only, to filter the list of shops. It is not sent to us, to the shops or to anyone else, and it is not included in analytics.
• The list of shops is a file download: The app downloads the list of shops and their links from our website (threadologie-app.com), in the same way as the Examples content. The request contains no country code and no identifier.
• Analytics: If analytics is enabled, we record that the list of shops was opened, from which kind of screen (an example or a color), and which shop was tapped, so we know whether this feature is useful. For a color, we also record which bead catalog it belongs to. We do not record which example, color or product it was about.

What Happens After You Leave the App:

Once the shop's page opens in your browser, you are on a third-party website. The shop and its affiliate network (the service that tells the shop a visit came from us) may set cookies or use similar technologies to attribute a purchase to our link. This tracking happens on their websites, not in the app, and they process your data under their own privacy policies and cookie settings, not under this Privacy Policy. We do not receive your name, contact details or payment details from them.

Analytics and Crash Reporting

We use Firebase Analytics and Firebase Crashlytics to improve the app and fix bugs and, for subscription events only, to measure the effectiveness of our own advertising (see "Subscription Events and Ad Measurement" below). These services collect pseudonymous, non-identifying data only, never linked to your name, email, or contact details. They are not used to show you ads in the app, to build advertising profiles, or for third-party marketing, and you can disable them at any time in Settings → Terms & Privacy → Analytics & Crash Reporting. Analytics and crash reporting are on by default.

What Firebase Analytics Collects:

• App Usage Events: Which features you use, for example patterns created/imported/completed, editor tools used (paint, fill, eyedropper, stamp), color interactions, navigation changes, paywall views, and purchase funnel steps. Events can include technical details such as an internal pattern ID, stitch type, grid size, number of colors, the position of a bead you mark as complete, and the subscription product you choose, but never pattern names, images or the colors you use
• Anonymous User Properties: Whether you have an active subscription. It is linked only to the installation identifier described below, never to your name or email.
• Installation Identifier: A random identifier created for this installation of the app (the Firebase app instance ID). It is not an advertising ID and not a hardware ID. On iOS, Google's software also collects the identifier for vendors (IDFV), which Apple assigns to the apps of one developer on your device. It is not an advertising identifier.
• Device Information: Device model, OS version, screen size
• Session Data: How long you use the app, screen views
• App Version: Which version of the app you're using

What Firebase Crashlytics Collects:

• Crash Reports: When the app crashes, technical details about the error
• Device State: Memory usage, battery level at time of crash
• Stack Traces: Technical information to help us fix bugs
• Context: The internal ID, stitch type and grid size of the pattern that was open

What Firebase Does NOT Collect:

• ❌ No directly identifying information (name, email, phone number)
• ❌ No GPS or precise location. Google Analytics derives an approximate location (country, region, city) from your IP address and then discards the IP.
• ❌ No pattern content or images
• ❌ No bead colors or designs you create
• We do not store IP addresses ourselves. Firebase may process IP addresses transiently for security and analytics; IPs are not retained in identifiable form by the app.
• ❌ No advertising identifiers

Why We Use Firebase:

• Improve App Quality: Understand which features are used most to prioritize improvements
• Fix Crashes: Identify and fix bugs before they affect more users
• Optimize Performance: See which devices struggle and optimize accordingly
• Better User Experience: Make data-driven decisions about new features

Subscription Events and Ad Measurement:

When a free trial or subscription starts, renews, or is cancelled, RevenueCat sends that event (for example "trial started") to our Firebase Analytics property, linked to the same pseudonymous Firebase app instance ID described above. If you installed the app after tapping one of our Google ads, Google may use these events to measure whether that ad campaign led to a trial or subscription, and to improve how our ads are delivered. We do not show ads inside the app, we do not collect advertising identifiers, and these events never contain your name, email, payment details, or pattern content. Turning off Settings → Terms & Privacy → Analytics & Crash Reporting removes the link between RevenueCat and Firebase, so these events are no longer sent. Where these events are used in Google Ads, Google acts as an independent controller under its own privacy policy.

Website Analytics (threadologie-app.com)

This website uses Google Analytics 4 (provided by Google Ireland Limited) to understand how visitors interact with our site so we can improve content and usability. This applies only to the website. The mobile app is covered by the Firebase section above.

Legal Basis:

We only load Google Analytics after you give consent via the cookie banner shown on your first visit (consent, Art. 6(1)(a) GDPR). If you decline, no analytics scripts are loaded and no data is sent to Google. You can change your choice at any time by clearing your browser's site data for this domain.

What Google Analytics Collects (with consent):

• Pages viewed and time spent on each page
• Referring website (how you arrived here)
• Approximate location (country/region only; your IP address is used briefly for this and is not stored)
• Device type, browser, and operating system
• A pseudonymous identifier stored in a cookie to recognize returning visitors

What Google Analytics Does NOT Collect:

• ❌ Your IP address (Google Analytics 4 does not log or store it)
• ❌ Name, email, or any personal identifier
• ❌ Any data from inside the mobile app

Data Processor:

Google acts as a data processor on our behalf. Data may be transferred to and processed in the United States under the EU-U.S. Data Privacy Framework. See Google's Privacy Policy and Google Analytics data practices.

Opting Out:

• Click "Decline" on the cookie banner (no data is collected)
• Install the Google Analytics Opt-out Browser Add-on
• Clear this site's data in your browser to see the banner again, then choose "Decline"

Legal Basis for Processing (Mobile App, GDPR)

For users in the European Union, we rely on the following legal bases under Art. 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): Processing strictly necessary to deliver subscription features and entitlements (Apple/Google billing, RevenueCat, coupon redemption).
• Legitimate interests (Art. 6(1)(f)): Product analytics (Firebase Analytics) to improve app quality and prioritize features, crash reporting (Firebase Crashlytics) to identify and fix bugs, and app integrity verification (Firebase App Check) to prevent abuse and protect server resources. Subscription events (trial started, purchase, renewal, cancellation) are additionally shared with Google Analytics and Google Ads to measure the effectiveness of our own ad campaigns. On iOS, an Apple Search Ads attribution token is shared with RevenueCat for the same purpose (see "Subscription Management (RevenueCat)" below). These services are not used for in-app advertising or to build marketing profiles. You have the right to object at any time via Settings → Terms & Privacy → Analytics & Crash Reporting, which disables both analytics and crash reporting, or by email for Apple Search Ads attribution (see "Right to Object" below).

For purposes of GDPR, Lucie Levices (Austria) is the data controller for personal data processed under this Privacy Policy. Contact: hello@threadologie-app.com.

International Data Transfers

Some of our service providers process data outside the European Union, mainly in the United States:

• Google (Firebase Analytics, Crashlytics, App Check, Cloud Functions and Firestore): Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google's data processing terms also include the EU Standard Contractual Clauses.
• RevenueCat, Inc. (United States): Processes subscription data on our behalf under a data processing agreement that includes the EU Standard Contractual Clauses.
• Apple and Google (store purchases): Process your payments as independent controllers under their own privacy policies.

You can ask us for a copy of these safeguards at hello@threadologie-app.com.

Your Rights (GDPR Compliance)

If you are in the European Union, you have the following rights:

• Right to Access: You can view all the data stored on your device in the app. For a copy of the pseudonymous data held by Firebase or RevenueCat, email hello@threadologie-app.com (see Data Deletion for how we locate your records)
• Right to Rectification: You can edit or correct your patterns and notes
• Right to Erasure ("Right to be Forgotten"): You can delete your local data via "Clear All Data" in Settings (patterns stay in the in-app trash for up to 30 days) or immediately by uninstalling the app. To have the pseudonymous data held outside your device deleted (Firebase analytics data, RevenueCat purchase records, coupon redemption records), email hello@threadologie-app.com. See Data Deletion below for what we delete, what must be kept, and how long it takes.
• Right to Data Portability: You can export patterns as JSON files
• Right to Object: We rely on our legitimate interests for app analytics, crash reporting, and for measuring our own ad campaigns using pseudonymous device identifiers and subscription events (see "Legal Basis for Processing" above). You can object at any time by turning off Settings → Terms & Privacy → Analytics & Crash Reporting. This stops analytics and crash reporting and removes the link between RevenueCat and Firebase, so subscription events are no longer sent to Google. You can also object by email to hello@threadologie-app.com. This includes objecting to Apple Search Ads attribution on iOS, which this setting does not control.
• Right to Withdraw Consent: Our website's analytics relies on your consent. You can withdraw it at any time by clearing this site's data in your browser, which brings the cookie banner back. In the app, you can revoke camera and photo permissions in your device settings
• Right to Lodge a Complaint: You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Datenschutzbehörde (www.dsb.gv.at). You may also contact the supervisory authority in your EU member state of residence or where the alleged infringement occurred.

Children's Privacy

The app is not directed at children under 13. Our Terms of Service set a minimum age of 13, or higher where your country requires it; younger users may only use the app with a parent's or guardian's consent. The app collects the same limited pseudonymous data from every user and has no way of knowing a user's age:

• No name, email, or contact information collected
• No account creation
• No social features or chat
• No advertisements in the app
• No location tracking
• No sale of data, and no data sharing for third-party marketing

The shop links described under "Links to Bead Shops (Affiliate Links)" lead to external shop websites that open in the browser. No advertising network is involved, the app sends no data to those shops, and nothing can be bought inside the app through them: a purchase only happens in the shop's own checkout, under the shop's own age and payment requirements.

Data Security

We take security seriously:

• Local Storage: Pattern data is stored in a database inside the app's private storage, protected by your device's own encryption and lock screen
• Pattern Data Protection: Your pattern data never leaves your device. Only pseudonymous analytics, crash reports and subscription events are sent to Firebase (can be disabled in Settings)

Data Retention

• Data on your device: Kept until you delete it or uninstall the app. We run no backup service. Your device's own backup (iCloud or Google) may include the app's data, under Apple's or Google's terms
• Firebase Analytics: Google deletes user-level and event-level data at the end of the retention period set in Google Analytics (at most 14 months). Aggregated statistics that no longer relate to an installation are kept longer
• Firebase Crashlytics: Crash reports are kept for 90 days, after which Google removes them
• RevenueCat: Your anonymous customer record and purchase history are kept until you ask us to delete them (see Data Deletion)
• Coupon Redemption Records: See "Cloud Functions & Coupon Redemption" above

Your Control Over Data

Data Deletion:

• Delete Patterns: Delete individual patterns and all associated data (progress, notes)
• Clear All Data: "Clear All Data" in Settings moves all your patterns to the in-app trash, where they are permanently removed after 30 days or when you empty the trash, and resets your settings. To remove everything immediately, uninstall the app
• Uninstall App: Deleting the app removes all local data from your device

Requesting deletion of data that has left your device: Threadologie by Lu has no user accounts, so the steps above delete almost everything. A small amount of pseudonymous data is held by our service providers. To have it deleted, email hello@threadologie-app.com with the subject "Data deletion request". Because we do not know who you are, we will reply and tell you which detail we need to find your records, for example the order number on your Google Play receipt (it starts with "GPA"), the date and time of your App Store purchase, or the coupon code you redeemed. We ask for nothing more than we need, and we will tell you if we cannot match your records with certainty.

• What we delete: Your RevenueCat customer record (anonymous app user ID, purchase history, the linked Firebase app instance ID and any Apple Search Ads attribution data), your anonymous app user ID in our coupon redemption records and the related attempt counter, and, where your installation can be identified, the Firebase Analytics data linked to it. We cannot match crash reports to a person or an installation. Google keeps them for 90 days and then removes them.
• What is deleted automatically: See "Data Retention" above for how long Google keeps analytics data and crash reports. Turning off Analytics & Crash Reporting in the app stops new data from being sent.
• What must be kept: Apple and Google process your payment and keep their own purchase records under their own privacy policies; we cannot delete those. We keep the sales and payout reports they send us for as long as tax and accounting law requires (in Austria, generally seven years); these reports do not contain your name or contact details. Deleting your RevenueCat record does not cancel a subscription. Cancel it in your App Store or Google Play settings first. If the app stays installed, it creates a new anonymous record the next time it opens, so uninstall it if you want nothing to remain.
• Response time: We usually confirm your request within 7 business days, and at the latest within one month. Within 30 days we delete the records we hold ourselves and submit the deletion to our service providers. Google states that it then permanently removes Analytics data within about two months.

Data Export:

• Export Patterns: Export patterns as JSON files to your device
• Manual Backup: Save exported files to iCloud, Google Drive, or your preferred cloud storage

Data Portability:

• JSON Format: All patterns are exportable in standard JSON format
• QR Codes: Patterns can be shared via QR codes
• Cross-Platform: Pattern files work on any device running Threadologie by Lu

Third-Party Services

We use the following third-party services:

App Distribution & Payments:

• Apple App Store / Google Play Store: For app distribution and in-app purchases
• Apple StoreKit / Google Play Billing: For payment processing (privacy policies apply from Apple/Google)

Analytics & Crash Reporting (Firebase):

• Firebase Analytics: Pseudonymous app usage analytics (see "Analytics and Crash Reporting" section above)
• Firebase Crashlytics: Crash reports to fix bugs (see "Analytics and Crash Reporting" section above)
• Firebase Authentication: We do not require login, and current versions of the app do not sign you in. Some earlier Android versions (December 2025 to February 2026) created an anonymous Firebase user ID, with no name, email, or password; it is no longer used. Cloud Functions are secured via Firebase App Check, not user credentials.
• Data Collection: Pseudonymous only: no name, email, phone, or contact information
• Privacy Policies:
  • Firebase Privacy Policy
  • Google Privacy Policy

App Integrity Verification (Firebase App Check):

• Firebase App Check: Verifies that requests to our cloud services come from the genuine app
• Data Collected: Device integrity signals via Play Integrity (Android) and DeviceCheck (iOS)
• Purpose: Protects against unauthorized API access and abuse
• No directly identifying data: No name, email, or contact information is collected

Subscription Management (RevenueCat):

• RevenueCat: Manages subscription status and entitlements
• Data Collected: Pseudonymous app user ID (auto-generated UUID, not linked to your name or email), subscription status, purchase history, device metadata
• Apple Search Ads Attribution (iOS only): On iOS, the app requests an attribution token from Apple and passes it to RevenueCat, which asks Apple whether the install came from one of our Apple Search Ads and, if so, which campaign. This lets us measure which ad campaigns lead to subscriptions. The token is not an advertising identifier (IDFA), does not identify you personally, and is not used to track you across other apps or websites, so no "Allow Tracking" permission is requested.
• Google Ads Measurement: RevenueCat forwards subscription events to Firebase Analytics, linked to your pseudonymous Firebase app instance ID, so we can measure which Google ad campaigns lead to trials and subscriptions. No advertising identifier is used. Disabled by the Analytics & Crash Reporting toggle.
• Purpose: Verify subscription status, process purchases, manage entitlements
• No directly identifying data: No name, email, or payment details (handled by Apple/Google)
• Privacy Policy: RevenueCat Privacy Policy

Bead Shops and Affiliate Networks (External Links):

• What they are: Independent online bead shops linked from the "Shop beads" and "Buy" buttons, and the affiliate networks those shops use to attribute sales
• No SDK, no data sent by the app: These services are not built into the app. They are reached only when you tap a link, in your browser
• Privacy Policies: The privacy policy and cookie settings of the shop you visit apply (see "Links to Bead Shops (Affiliate Links)" above)

Website Hosting (OVHcloud):

• What it hosts: Our website, the Examples content, the list of bead shops, and shared pattern links are served by OVHcloud, a hosting provider based in France (EU)
• Server logs: As with any web server, each request is logged with the IP address, time, requested file and browser type, for security and operation. We do not combine these logs with data from the app
• Privacy Policy: OVHcloud Privacy Policy

QR Code and Bead Label Scanning (Google ML Kit):

• Google ML Kit Barcode Scanning: Detects QR codes from camera and images
• Google ML Kit Text Recognition: Reads bead codes from labels you scan with the camera. The images and the recognized text stay on your device
• Processing: Entirely on-device. Images and scan results are never sent to Google or to us
• Technical data sent by the SDK: Google's ML Kit software may contact Google servers to receive bug fixes and updated models, and it sends Google metrics about the performance and use of its scanning functions, together with a per-installation identifier that is not intended to identify you. These metrics do not include your images or scan results (see the ML Kit Terms)

We do NOT use:

• ❌ In-app advertising (no ads, banners, or interstitials are shown in the app)
• ❌ Social media SDKs (no social login or sharing SDKs)
• ❌ Marketing or tracking pixels (in the app)
• ❌ Third-party data brokers

The app does contain links to external bead shops, some of which are affiliate links; see "Links to Bead Shops (Affiliate Links)" above. They are plain links opened in your browser; no advertising or tracking SDK is involved.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Updating the "Last Updated" date at the top of this policy
• For material changes, informing you in the app or in the app's release notes

Legal Information

• Developer: Lucie Levices
• Location: Austria (EU)
• Jurisdiction: Austrian law applies

Thank you for using Threadologie by Lu!