Privacy Policy

1. Data controller

李靖, an individual based in China, operates BeadPattern and is responsible for the personal information handled by the application. Contact support@beadpattern.app for privacy questions or rights requests.

2. Information and processing locations

• Google account: verified email, Google account identifier, name, avatar URL and account creation information. We receive profile information through Google sign-in, not your Google password. We do not request access to your Gmail inbox.
• Local editing: original photos used for normal photo conversion are processed in your browser. Grid drafts and prompt drafts may be saved in browser local storage; blank-grid settings can be kept in session storage. Choosing a local photo does not by itself send it to APIMart.
• Saving and exports: when you save, we store the grid, palette, groups, title, account association and update time on our server. Export requests send grid data to generate the requested file; the original photo is not included. Export generation does not create a saved project unless you separately save it.
• Account activity: we record successful Google sign-in times and authenticated access times to operate accounts and understand usage. Repeated authenticated requests are grouped into at most one access timestamp update per minute. These timestamps do not track anonymous page visits and are not proof that a person actively used a page throughout that period.
• AI generation: your submitted prompt and generation settings go to APIMart. Our database stores the prompt, task identifiers, status, timestamps, error information and returned image URL, together with credit reservations or returns. Your browser can fetch the generated image from the provider’s image host.
• Billing: we send your verified account email, product selection and order reference to Waffo Pancake. We keep order amount, currency, status, checkout/reference identifiers and verified webhook payloads used to administer credits and membership. Full card details are handled by Waffo Pancake, not stored by the application.
• Support: your sender address, message, attachments and information supplied in support requests.
• Website activity: hosting and analytics providers process technical request information such as IP address, browser/device details, visited URLs, referrers, approximate location, timestamps and usage events.

Private saved projects are not automatically added to the public gallery. Avoid entering sensitive personal information in prompts, project titles or URL parameters.

3. Purposes and applicable legal bases

We use account and project information to provide the services you request; AI and billing information to fulfill generation requests and purchases; support messages to answer you; and technical records to secure, diagnose and improve the service. Where a legal basis is required, service delivery relies on performance of our agreement, security and ordinary support on legitimate interests where permitted, legally required records on legal obligations, and processing that requires consent on that consent. Visiting the site is not represented as consent to every use. Analytics consent obligations depend on your jurisdiction; the current implementation and controls are described below.

4. Cookies, browser storage and Google Analytics

First-party visit measurement uses a signed, random browser identifier in the HttpOnly bp_visitor cookie for up to 90 days and a tab-session identifier in session storage. We store page paths without query strings, external referrer hostnames, Cloudflare network country, coarse browser/OS/device categories, visit timestamps and approximate visible and active time in Cloudflare D1. We do not store raw IP addresses or collect Canvas, audio or hardware fingerprints in these visit tables. Active time requires a visible, focused page and recent activity; it is not proof of a human visitor. Obvious automation, test visits, signed-in traffic and recognized owner browsers are separated from anonymous reports. Owner sign-in can mark earlier visits from the same browser as internal. These records are available only through restricted operational database access; there is no website reporting page.

The login cookie has a browser lifetime of 30 days. An account-association cookie can remain for up to one year. Signing out clears these cookies; cookie expiration does not delete server records. Browser-local drafts have no automatic expiry and can be removed by clearing site data. Session-storage drafts normally end with the browser tab session.

Google Analytics 4 loads on this website without an in-product consent prompt. It can use cookies or similar identifiers for visits, devices, approximate location and interactions. We do not intentionally send photo contents, prompts or saved grids as analytics events, but page URLs and referrers can be measured. The site does not currently offer a cookie preference manager. You can block or clear analytics cookies using your browser, or use Google’s Analytics opt-out tool. Blocking essential cookies may prevent sign-in. No claim is made that this notice itself supplies any consent required by local law.

5. Providers and sharing

• Cloudflare: hosting, HTTPS delivery, operational/security logs and support-email routing. See Cloudflare’s Privacy Policy.
• Google: Google sign-in, Google Analytics 4 and the Gmail inbox receiving support messages forwarded from our support address. See Google’s Privacy Policy.
• APIMart: optional AI image processing and output delivery. See APIMart’s Privacy Policy. Its providers can process submitted prompts; do not assume that our local-photo processing statement applies to AI requests.
• Waffo Pancake: hosted payment processing, transaction administration and refunds when payments are used. See Waffo’s Privacy Policy. Card entry occurs on hosted checkout.

We do not sell personal information. Information may also be disclosed when legally required, to investigate abuse, or as necessary for an authorized business transfer with appropriate notice. Providers have their own roles and privacy terms; we do not claim that all of their processing is exclusively controlled by us. We do not operate a model-training pipeline using your private projects and cannot make an unverified no-training promise on behalf of every downstream AI provider.

6. Retention and deletion

First-party visit details older than 90 days are deleted by a daily scheduled cleanup; inactive browser identifiers are removed after their retained visits expire. Restricted recovery copies may persist for their provider recovery periods. This limit does not apply to Google Analytics or infrastructure logs, which have separate retention settings.

Browser storage follows the periods described above. Saved projects remain until deleted or an account-deletion request is handled. Deleting a saved project removes it from the active project database; it is not a promise of immediate erasure from every operational copy.

Account records, AI prompts/task history, credit entries, orders and webhook records currently have no automatic age-based purge. An AI task timeout of 15 minutes and the interface’s recent-task window do not delete those records. Contact support to request access or deletion; we review what must be retained for security, billing or applicable legal obligations. Support messages remain in the support inbox until handled or removed, with no fixed automatic purge configured. Analytics and infrastructure retention follow their respective provider/account settings; we do not claim a verified numerical retention period for those systems.

Account records, saved projects, AI task and credit records, orders and payment event records are stored in Cloudflare D1, separately from the application container. Restarting or redeploying the application does not erase these records. Provider recovery copies and restricted operational backups may retain deleted data for their configured recovery periods. This is not an archival service; download a copy of projects you need to keep.

7. Your rights and choices

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction or objection to processing, and withdrawal of consent where processing relies on consent. Send requests to our support address from the account email when possible. We may ask for proportionate information to verify the request, and respond within the period required by applicable law. You may complain to your local data-protection authority. Withdrawal does not undo previously lawful processing.

You can continue local conversion without an account, avoid optional AI, delete saved projects in Studio, clear browser drafts, sign out, or request account closure. Account deletion is separate from ending a paid subscription. We do not currently run an application marketing-email subscription.

8. Security and international processing

We use HTTPS, signed login cookies, account-scoped project access, server-side provider credentials and payment webhook signature verification. No system is completely secure. Report suspected exposure to support; legally required incident notifications will follow applicable law.

The operator is in China. Cloudflare, Google, APIMart and Waffo can process data internationally, including in the United States and other locations described in their policies. We do not guarantee single-country storage or claim that a specific cross-border contract or certification has been verified for this deployment. Where the law requires additional safeguards or consent, those requirements must be met.

9. Age and policy changes

Accounts, purchases and submission of personal information are intended for adults aged 18 or older. Adults may prepare crafts for children without submitting children’s personal information. Contact us if a child has provided personal information so we can investigate and remove it as appropriate.

We post changes on this page and update its effective date. Material changes will be announced on the website before they apply unless an urgent legal or security reason requires otherwise. Third-party sites linked here maintain separate privacy notices.

Contact

Email support@beadpattern.app for support, billing, cancellation assistance, refunds, privacy or security concerns. Include your account email and, for payment questions, the order reference. Do not send passwords or full payment card details.