LEGAL
Privacy policy
What The Black Thread collects, why, who else gets it, how long we keep it, and how to see, correct or delete it.
Last updated
This page says what personal data The Black Thread collects, what we do with it and what you can ask us to do about it. The rules for using the site are in the terms of use.
You don't need an account to use the builder, and you can use it without telling us who you are. Most of this page only applies if you sign in, upload a patch, write to us or buy our patch.
Who runs this site
The Black Thread is run by Bogdan Pop, a private individual in Romania. There's no company behind it. On this page, "we" and "us" mean Bogdan Pop. He decides what happens to your data, which makes him its controller under the EU's General Data Protection Regulation (GDPR).
Email mail@bogdan-pop.com about anything on this page. We answer in English or Romanian. There's no data protection officer, because a site this size isn't required to have one.
What we collect and why
| What | Why | Legal basis | How long | Who else gets it |
|---|---|---|---|---|
| Email sign-up: your email address and password. The password is only stored in scrambled (hashed) form. | To sign you in, and to send account emails such as the one that confirms your address. | Contract: it's the account you asked for. | Until you delete your account. | Supabase |
| Google or Discord sign-in: the name, email address, profile picture link and account ID they send us. | To sign you in, and to show your name and picture in the header. | Contract | Until you delete your account. | Supabase. Google or Discord know you signed in here. |
| Patches you upload: the photo, the band or patch name, size, patch type, how it attaches, a shop link if you add one, the photo's file name, and the colours and proportions we read from the image. | So you can use your own patches in the builder. | Contract | Until you delete the patch or your account. | Supabase, Cloudflare |
| Saved designs: the name and description you give a design, the garment, its colour and where each patch sits. | So your designs follow you from one device to another. | Contract | Until you delete the design or your account. | Supabase |
| Builder autosave: the layout you're working on, in your browser's local storage. | So your layout is still there when you come back. | Needed for the builder to work. It never leaves your browser. | Until you clear it. | Nobody |
| Messages you send us, by the contact form or email: the message, its topic, your email if you give it, any shop, band or link you add, the page on this site you came from, and your account ID if you're signed in. If you're signed in and leave the email empty, we use your account's email to reply. | To answer messages, add shops and patches, and fix bugs. | Legitimate interests: answering you and running the site. | 12 months, unless we need a message longer for a legal claim. | Supabase, Resend, our email provider |
| Contact form spam protection: a scrambled (hashed) form of your IP address, never the address itself, and your browser's user agent. | To allow at most 5 messages an hour from one connection. | Legitimate interests: keeping the form free of spam. | Cleared after 30 days. | Supabase |
| Your cookie choice: what you chose, when, whether opt-in or opt-out rules applied, the version of our cookie setup, and a random ID that's also in your consent cookie. No IP address and no browser details. | To remember your choice, and to show that we asked. | Legal obligation: GDPR requires us to be able to show consent. | Cookie 6 months. Our record 2 years. | Supabase |
| Google Analytics: the pages you visit, how you got here, your device and browser type, your approximate location, a random ID in a cookie, and what you do in the builder (see below). | To see which pages and builder features get used, so we know what to fix and build next. | Your consent. In the US, it runs unless you turn it off. | Up to 14 months | |
| Vercel Web Analytics: the page, the site that sent you, your country, and your device and browser type. No cookies. | To count visits. | Legitimate interests: knowing how many people use the site. | We only see totals. | Vercel |
| Server logs: your IP address, browser, the address requested and the time. Supabase also keeps a record of sign-ins. | To run the site, keep it secure and find faults. | Legitimate interests: security. | As long as each provider keeps its logs. | Vercel, Supabase, Cloudflare |
| Patch orders: your name, postal address, email address and what you bought, which Ko-fi passes to us. | To send the patch and handle returns. | Contract. Keeping sales records is a legal obligation. | As long as Romanian tax law requires us to keep sales records. | Ko-fi and its payment providers, Poșta Română, and customs for parcels leaving the EU |
In the builder, Google Analytics records: the band name on patches you add, upload or click through to buy; the garment, colour and other settings you pick; exports, and saving, loading and deleting designs; whether you sign in with Google, Discord or email, and when you log out; the topic of a contact message; and whether you see, click or close the support patch offer. It never gets your email, your name or your account ID.
We don't use your data to make automated decisions about you.
Cookies and analytics
Necessary cookies and local storage keep you signed in and remember your cookie choice and your builder layout. They're always on. Outside the US, Google Analytics only runs after you accept it. In the US, it runs until you turn it off. Vercel Web Analytics uses no cookies, and there are no advertising pixels. The cookie policy lists every cookie and how to change your choice.
Who we share data with
These providers work on our instructions, as our processors, under data processing terms:
- Supabase: our database and sign-in system. It holds accounts, upload details, designs, contact messages and consent records, and sends account emails.
- Vercel: hosts the site and runs Vercel Web Analytics.
- Cloudflare: stores and serves uploaded images, and removes their backgrounds.
- Resend: delivers contact form messages to our inbox.
- Google: runs Google Analytics.
- Our email provider: hosts the inbox at mail@bogdan-pop.com.
These act for themselves, under their own privacy policies:
- Google and Discord, if you sign in with them. They know you signed in here, and your browser loads your profile picture from their servers.
- Ko-fi and its payment providers, who run the checkout for our patch.
- Poșta Română, which gets your name and address to deliver the patch. For parcels leaving the EU, customs gets them too.
If you send a copyright complaint or a counter-notice, we pass it on to the other side, as the terms explain. We share data with authorities when the law requires it.
We don't sell personal data.
Transfers outside the EU
Most of these providers are US companies, so your data may be stored in, or reached from, the US. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on that. Otherwise, it relies on the European Commission's Standard Contractual Clauses, which are part of the provider's data processing terms. Email us for the details for any provider.
How long we keep it
The table gives the period for each kind of data. When it ends, we delete the data, or for the contact form's spam protection, clear those two details. Deleted data can stay in our providers' backups for a short time, until the backups are overwritten.
Your rights
Under GDPR, you can ask us to:
- give you a copy of your data (access);
- correct it;
- delete it;
- restrict how we use it;
- give it to you in a format you can take elsewhere (portability);
- stop using it where we rely on legitimate interests (objection).
Where we rely on your consent, you can withdraw it at any time with Cookie settings in the footer. That doesn't affect anything that happened before.
You can delete your own uploaded patches and saved designs in the builder at any time. For anything else, including deleting your account or getting a copy of your data, email mail@bogdan-pop.com from the address on your account, so we know it's you. There's no button for this on the site yet. We answer within one month, and there's no charge.
If you think we've handled your data wrongly, please tell us first. You can also complain to Romania's data protection authority, ANSPDCP (opens in a new tab), or to the authority in the country where you live.
Uploaded images
When you upload a patch, the photo goes to Cloudflare, which removes the background automatically. We keep the cut-out and delete the original photo.
The cut-out is served from Cloudflare at a long link that can't be guessed. Anyone who has that link can open the image. We don't publish links to your uploads or show them to anyone else, and in our database only you can see your uploads' details. Deleting a patch in the builder deletes its image too.
Age
The site isn't for anyone under 16. If we learn that an account belongs to someone younger, we delete it.
If you live in the US
In the categories US state privacy laws use, we collect: identifiers (your email, name and account ID, the Google Analytics cookie ID, and IP addresses in server logs); internet activity (the pages you visit here and what you do in the builder); approximate location, worked out from your IP address; user content (your patch photos and designs); and commercial information (your order, if you buy our patch). The only sensitive information is your sign-in details, which we use for nothing but signing you in. The table above says where each comes from, why we have it and who else gets it.
We don't sell personal information, and we don't share it for targeted advertising. Google Analytics runs by default in the US, and you can turn it off in Cookie settings. If we add advertising pixels later, they may count as "sharing" under some state laws, and you'll be able to opt out in Cookie settings.
We honour a Global Privacy Control (GPC) signal from your browser as a request to opt out of sale and sharing. The site doesn't respond to the older Do Not Track signal, because there's no agreed standard for what it should do.
You can ask to know what we hold about you, to correct it or to delete it, by email. Someone you authorise can ask for you, and we may ask them for proof. We won't treat you differently for asking.
Changes
When we change this policy, we change the date at the top, which is when the current version took effect. If a change matters, for example a new kind of data or a new provider, we'll tell account holders by email, or with a notice when they next sign in.