Privacy Policy
Effective Date: May 27, 2026 · Last updated: May 27, 2026
Bobbin Operating LLC ("Bobbin", "we", "us", or "our") operates the Bobbin mobile application and website. This Privacy Policy describes how we collect, use, and protect your personal information.
1. Information We Collect
We collect the following types of information:
- Account Information: Name, email address, and authentication credentials when you create an account via Apple Sign-In, Google Sign-In, or email registration.
- Design Data: Embroidery designs, projects, and related files you create or import within the app. These are stored locally on your device and optionally synced via iCloud or Bobbin Cloud.
- Device Information: Device model, operating system version, and app version for support and compatibility purposes.
- Usage Data: Anonymous analytics about feature usage to improve the app experience (only when you opt in).
- Thread Inventory: Thread colors and brands you add to your collection, stored locally and optionally synced.
- Profile Photo (Optional): If you choose to upload a profile picture, it is stored in our Amazon S3 bucket under a path scoped to your account and is visible only to other users you've connected with as a friend or invited to collaborate. You can change or remove your profile photo at any time from the Account settings; removal deletes the underlying file from S3.
- Friend Connections: Once you accept a friend request, we store a record of the connection — your account ID, your friend's account ID, the timestamp, and how you discovered each other (username search, friend code, QR code, contacts sync, etc.). This lets you share designs with friends and receive notifications about their activity. Removing a friend deletes both sides of the connection record.
- Push Notification Tokens: If you enable push notifications, Apple provides us with a device-specific token that we use to deliver notifications about collaboration activity, friend requests, and support ticket updates. We store this token alongside your account and rotate it when iOS issues a new one. You can disable push notifications at any time in your iOS Settings, and the token is deleted when you remove the app or delete your account.
- Purchase Data: When you subscribe to a paid plan, Apple's StoreKit sends us a verified transaction containing your subscription's identifier, product, and expiration date. We store this on your account to grant access to paid features and to restore your subscription on a new device. We do not receive your payment-method details, name, or billing address — Apple handles all of that.
- Support Tickets: When you submit a support request from inside the app, we receive the message text, the device and app metadata you opt to include (model, iOS version, Bobbin build), and any image attachments you upload. Attachments are stored in our Amazon S3 bucket scoped to the ticket and are accessed only by Bobbin support staff to resolve your issue. We retain support tickets for 24 months for service-quality and continuity purposes, after which they are deleted.
- Waitlist Signups: If you join our pre-launch waitlist on bobbinapp.com, we collect your email address, the timestamp of your signup, the section of the page you signed up from, and a salted hash of your IP address used solely for abuse prevention. See Section 11 for details.
2. How We Use Your Information
- To provide and maintain the Bobbin app and services
- To authenticate your identity and manage your account
- To sync your designs and preferences across devices
- To enable real-time collaboration features
- To process support tickets and respond to inquiries
- To improve the app based on aggregated, anonymized usage patterns
- To send a single launch notification to waitlist subscribers when Bobbin becomes available on the App Store
3. Data Storage and Security
Your designs and projects are stored locally on your device using Apple's SwiftData framework. If you enable cloud sync, data is stored in your personal iCloud container (managed by Apple) or Bobbin Cloud (hosted on AWS with encryption at rest and in transit).
Authentication tokens are stored securely in the iOS Keychain. We never store passwords in plaintext.
4. Contact Hashing for Friend Discovery
When you use friend discovery via your device Contacts, Bobbin reads the email addresses and phone numbers stored in your iOS Contacts and hashes each entry locally on your device using SHA-256 with a fixed salt before sending the hashes to our servers. We use the hashes only to identify which of your contacts already have Bobbin accounts. We never receive, store, or process your contacts' plaintext email addresses or phone numbers, and we discard the uploaded hashes after the matching query completes.
The same hashing approach applies when you search for a specific friend by email or phone number from inside the app: the value is hashed on-device before any network request is made.
5. Third-Party Services
Bobbin integrates with the following third-party services:
- Apple Sign-In: Authentication via Apple's identity service
- Google Sign-In: Authentication via Google's identity service
- Amazon Web Services (AWS): Backend infrastructure including API hosting, database, and file storage
- Apple iCloud: Optional cloud sync for designs (controlled by your iCloud settings)
Our marketing website (bobbinapp.com) does not use third-party analytics, advertising trackers, or social-media pixels. All fonts and assets are served from our own origin — no requests are made to Google Fonts or any other third party from this site.
6. Data Sharing
We do not sell, trade, or rent your personal information to third parties. We may share data only:
- With your explicit consent (e.g., sharing a design with a collaborator)
- To comply with legal obligations or law enforcement requests
- To protect the rights, property, or safety of Bobbin and its users
7. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Export your designs in standard embroidery formats
- Opt out of analytics tracking
- Unsubscribe from the waitlist at any time by emailing us at the address below
8. Children's Privacy
Bobbin is not intended for children under the age of 13. We do not knowingly collect personal information from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the app and on our website.
10. Contact Us
If you have questions about this Privacy Policy, please contact us at:
11. Pre-Launch Waitlist
If you join our pre-launch waitlist on bobbinapp.com, we collect:
- Your email address
- The timestamp of your signup
- An identifier for which section of the page you signed up from (used to understand which CTAs are most effective)
- Your browser's User-Agent string (truncated)
- A SHA-256 salted hash of your IP address — we do not store the IP itself; the hash is used solely to detect and prevent abusive signup behavior
We use this information for one purpose only: to send you a single email when Bobbin launches on the App Store. You will not receive marketing emails, newsletters, or any other communications. You may unsubscribe at any time by emailing privacy@bobbinapp.com and we will delete your record from our systems.