Security
Last updated: October 16, 2026
This page gives plain answers to the questions people ask before trusting
NodeStitch with designs they haven't published yet. NodeStitch is run by one
person, as a sole proprietorship in California. Where something hasn't been
done yet, this page says so.
The Privacy Policy is the full legal document. This page explains
how the safeguards in it actually work.
Can other NodeStitch users see my patterns?
No. Every table that holds your content has database rules, known as row level
security, that only return rows belonging to the account that is signed in.
That covers projects, saved versions, stitch charts, templates, your yarns,
your settings and your subscription. The rules run inside the database itself,
so they apply however a request reaches it, not just through the app's screens.
Photos you upload are kept in private file storage. Each account's photos live
in a folder only that account can read. Nothing is publicly readable, and a
photo can't be opened by guessing its address.
There is no way to share a project in NodeStitch. No project, page or pattern
you create can be seen by, sent to or opened by another user.
The one exception is a stitch chart you choose to share. Sharing a chart makes
a view-only link that shows that chart, its legend and a row tracker, and
nothing else: not the pattern it sits in, its notes or its written
instructions. "Stop sharing" makes the link stop working at once.
Is my work used to train AI?
No. We don't use your patterns to train AI models, and we only use AI
providers whose terms prohibit storing or training on your content.
AI features are optional and only run when you choose to use one. The
Privacy Policy lists each feature, exactly what it sends and who
receives it. The canvas, tables, stitch charts, manual pattern writing and PDF
export never send your content anywhere.
Who can access my patterns?
The app only ever shows your content to your own account.
Like anyone who runs a web service, the person who runs NodeStitch has
administrator access to the production database. We have never opened a
customer's project, and we don't plan to. If fixing a problem you report ever
needed a look at one of your projects, we'd ask you first.
Two-factor authentication is on for every account that controls NodeStitch's
database, hosting, payments and domain.
How is my account protected?
- Every connection to NodeStitch is encrypted (HTTPS), and browsers are told
never to connect without it.
- Passwords are handled by our sign-in provider, Supabase Auth, and stored only
as one-way hashes. Nobody at NodeStitch can see your password. You can also
sign in with Google instead of a password.
- Stored data is encrypted at rest by Supabase.
- Payments are handled by Stripe. Your card number never reaches NodeStitch.
Where is my data stored?
Your account, patterns and photos are stored with Supabase, in the United
States (AWS, N. Virginia). Supabase is independently audited every year for SOC 2
Type 2. The website itself is served by Vercel.
What happens when I delete something?
Deleting your account from Account Settings cancels any subscription, then
deletes your projects, saved versions, stitch charts, templates, yarns,
settings, photos and account record.
The database is backed up daily, and each backup is kept for 7 days. So
deleted data can remain in a backup for up to 7 days before it ages out.
Bug report screenshots are deleted after 90 days. Records we're legally
required to keep for tax and accounting, such as invoices, are kept by Stripe.
Should I keep my own copy?
Yes, and we'd say that about any online service. You can export any pattern as
a PDF at any time. Keep a copy of designs you can't afford to lose somewhere
you control.
Has NodeStitch been independently audited?
Not yet. No outside firm has run a penetration test on NodeStitch.
What we do instead: the database access rules described above are checked
against the live database, along with Supabase's own security checks, and the
app's behavior is covered by automated tests. We'll update this page if an
independent review happens.
Reporting a security problem
If you find a security problem, or think your account has been accessed by
someone else, email support@nodestitch.app. If we become aware of a breach
affecting your personal information, we'll notify you as required by law.