Privacy
heatstitch is a free hobby project without ads and without accounts. Your embroidery files and pictures stay in your browser; there is no cookies and no tracking of individual visitors.
Controller
The controller for data processing on this website is Daniel Pfeffer, email: .
Your files stay with you
heatstitch reads, checks, edits and saves embroidery files, projects and pictures with JavaScript in your browser. They are never uploaded. So that they are still there after a reload, the app keeps them in your browser's storage (IndexedDB), together with settings like language, fabric and hoop (localStorage), and keeps the app itself so it works offline (service worker). All of this stays on your device and is never sent to me. It only serves to make the app do what you ask of it (§ 25 (2) no. 2 TDDDG). You remove a file in the file list; you delete everything at once in your browser's settings for heatstitch.app.
Hosting at Cloudflare
The website and the tutorial videos (media.heatstitch.app) are served by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). With every request your browser sends technically necessary data: IP address, time, the requested address, browser and operating system. Cloudflare needs them to deliver the site and protect it from attacks. The legal basis is my legitimate interest in a secure and reachable website (Art. 6 (1) (f) GDPR).
Cloudflare processes the data on my behalf under a data processing agreement (Art. 28 GDPR). Data may reach the USA; Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). I only see aggregated numbers such as the number of requests, no individual visitors, and keep no access logs of my own. More at Cloudflare: Cloudflare's privacy policy.
Visitor numbers outside the EU
If you open heatstitch from outside the EU, Cloudflare adds a small measuring script (Cloudflare Web Analytics, from static.cloudflareinsights.com). It counts page views and measures how fast the page loads: the page, the previous page, country, browser, operating system and device type. It sets no cookies, stores nothing on your device, does not recognize you on a later visit, not by your IP address either. I only see aggregated numbers. The legal basis is my legitimate interest in seeing which parts of heatstitch are used and how fast they load (Art. 6 (1) (f) GDPR). Visitors from the EU do not get the script. More at Cloudflare: Cloudflare Web Analytics.
What only happens when you click
- Picture from the clipboard: if you paste the address of a picture on another website, your browser loads the picture directly from there. That website then sees your IP address, as with any visit.
- Send over Wi-Fi: heatstitch hands the embroidery file to the Ember Bridge app on your own computer, which passes it on to the machine in your home network. None of it goes to me over the internet.
- Prepare the image with AI: heatstitch only suggests a prompt for an AI chat of your choice and sends nothing itself. What you upload there is subject to that provider's terms.
- Links to other sites (GitHub, manufacturers, shops) open only when you click them; their privacy policy applies then.
If you write to me
If you send me an email, I use what you send only to answer you, and delete the email once it is settled (Art. 6 (1) (f) GDPR).
Your rights
You have the right to access, rectification, erasure and restriction of processing, to data portability and to object to processing based on Art. 6 (1) (f) GDPR (Art. 15 to 21 GDPR). Just send me an email. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
Licenses
heatstitch is open source under the MIT License. The motifs come from Twemoji (© Twitter, Inc. and other contributors, license CC BY 4.0), their names from Unicode CLDR. The fonts and their licenses are listed in the guide.
heatstitch is free and comes without warranty. The check and the correction help, but they do not replace a test piece: sew a new design on a scrap of the same fabric first.
As of October 2026