Privacy Policy

Effective Date: May 27, 2026 · Last updated: May 27, 2026

Bobbin Operating LLC ("Bobbin", "we", "us", or "our") operates the Bobbin mobile application and website. This Privacy Policy describes how we collect, use, and protect your personal information.

1. Information We Collect

We collect the following types of information:

• Account Information: Name, email address, and authentication credentials when you create an account via Apple Sign-In, Google Sign-In, or email registration.
• Design Data: Embroidery designs, projects, and related files you create or import within the app. These are stored in Bobbin Cloud as part of the service, with offline copies on your device.
• Device Information: Device model, operating system version, and app version for support and compatibility purposes.
• Usage Data: Anonymous analytics about feature usage to improve the app experience (only when you opt in).
• Thread Inventory: Thread colors and brands you add to your collection, stored on your device and synced through Bobbin Cloud with your account.
• Machines, Hoops, Motifs and Preferences: The embroidery machines, saved hoops and motifs you add, your preferences (including the print shop name and contact line you set for printed worksheets) and your print logo, stored on your device and synced through Bobbin Cloud with your account.
• Bobbin Cloud Usage Totals: Per-account storage and transfer totals and how many of your devices synced recently. See Section 3.
• Profile Photo (Optional): If you choose to upload a profile picture, it is stored in our Amazon S3 bucket under a path scoped to your account and is visible only to other users you've connected with as a friend or invited to collaborate. You can change or remove your profile photo at any time from the Account settings; removal deletes the underlying file from S3.
• Friend Connections: Once you accept a friend request, we store a record of the connection — your account ID, your friend's account ID, the timestamp, and how you discovered each other (username search, friend code, QR code, contacts sync, etc.). This lets you share designs with friends and receive notifications about their activity. Removing a friend deletes both sides of the connection record.
• Push Notification Tokens: If you enable push notifications, Apple provides us with a device-specific token that we use to deliver notifications about collaboration activity, friend requests, and support ticket updates. We store this token alongside your account and rotate it when iOS issues a new one. You can disable push notifications at any time in your iOS Settings, and the token is deleted when you remove the app or delete your account.
• Purchase Data: When you subscribe to a paid plan, Apple's StoreKit sends us a verified transaction containing your subscription's identifier, product, and expiration date. We store this on your account to grant access to paid features and to restore your subscription on a new device. We do not receive your payment-method details, name, or billing address — Apple handles all of that.
• Support Tickets: When you submit a support request from inside the app, we receive the message text, the device and app metadata you opt to include (model, iOS version, Bobbin build), and any image attachments you upload. Attachments are stored in our Amazon S3 bucket scoped to the ticket and are accessed only by Bobbin support staff to resolve your issue. We retain support tickets for 24 months for service-quality and continuity purposes, after which they are deleted.
• Waitlist Signups: If you join our pre-launch waitlist on bobbinapp.com, we collect your email address, the timestamp of your signup, the section of the page you signed up from, and a salted hash of your IP address used solely for abuse prevention. See Section 11 for details.

2. How We Use Your Information

• To provide and maintain the Bobbin app and services
• To authenticate your identity and manage your account
• To sync your designs and preferences across devices
• To keep Bobbin Cloud reliable and to enforce our fair-use terms (see Section 3)
• To enable real-time collaboration features
• To process support tickets and respond to inquiries
• To improve the app based on aggregated, anonymized usage patterns
• To send a single launch notification to waitlist subscribers when Bobbin becomes available on the App Store

3. Data Storage and Security

Your designs and projects are stored in Bobbin Cloud as part of the service, hosted on Amazon Web Services (AWS) in the United States (region us-east-1) with encryption at rest and in transit, and kept as offline copies on your device.

What syncs through Bobbin Cloud with your account: designs, fonts, machines, hoops, motifs, threads, preferences including your print shop name and contact line, your print logo, and support tickets.

How long sync records are kept: the feed of recent changes that lets your other devices catch up is kept for 90 days; the markers that record an item you deleted are kept for 365 days, so a deleted item does not come back from a device that was offline; fair-use audit records are kept for accountability. Support tickets are kept as described in Section 1.

To keep Bobbin Cloud reliable and to enforce our fair-use terms, we record per-account storage and transfer totals and how many of your devices synced recently (kept 90 days), and may review an account, including the sizes and formats of its designs, and email you about it. We do not sell this data or use it for advertising.

Authentication tokens are stored securely in the iOS Keychain. We never store passwords in plaintext.

4. Contact Hashing for Friend Discovery

When you use friend discovery via your device Contacts, Bobbin reads the email addresses and phone numbers stored in your iOS Contacts and hashes each entry locally on your device using SHA-256 with a fixed salt before sending the hashes to our servers. We use the hashes only to identify which of your contacts already have Bobbin accounts. We never receive, store, or process your contacts' plaintext email addresses or phone numbers, and we discard the uploaded hashes after the matching query completes.

The same hashing approach applies when you search for a specific friend by email or phone number from inside the app: the value is hashed on-device before any network request is made.

5. Third-Party Services

Bobbin integrates with the following third-party services:

• Apple Sign-In: Authentication via Apple's identity service
• Google Sign-In: Authentication via Google's identity service
• Amazon Web Services (AWS): Backend infrastructure including API hosting, database, and file storage

Our marketing website (bobbinapp.com) does not use third-party analytics, advertising trackers, or social-media pixels. All fonts and assets are served from our own origin — no requests are made to Google Fonts or any other third party from this site.

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data only:

• With your explicit consent (e.g., sharing a design with a collaborator)
• To comply with legal obligations or law enforcement requests
• To protect the rights, property, or safety of Bobbin and its users

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your designs in standard embroidery formats
• Opt out of analytics tracking
• Unsubscribe from the waitlist at any time by emailing us at the address below

8. Children's Privacy

Bobbin is not intended for children under the age of 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the app and on our website.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:

privacy@bobbinapp.com

11. Pre-Launch Waitlist

If you join our pre-launch waitlist on bobbinapp.com, we collect:

• Your email address
• The timestamp of your signup
• An identifier for which section of the page you signed up from (used to understand which CTAs are most effective)
• Your browser's User-Agent string (truncated)
• A SHA-256 salted hash of your IP address — we do not store the IP itself; the hash is used solely to detect and prevent abusive signup behavior

We use this information for one purpose only: to send you a single email when Bobbin launches on the App Store. You will not receive marketing emails, newsletters, or any other communications. You may unsubscribe at any time by emailing privacy@bobbinapp.com and we will delete your record from our systems.