Privacy policy

Controller and contact

The data controller is Paula Quintana Gonzalez, publishing under the Molly Digital Apps brand. Contact mollydigitalapps@gmail.com for privacy questions and requests.

Website, device and private projects

You can read the website and use app features that do not require an account without registering. Vercel hosting and network services process connection information such as IP address, URL, time and browser to deliver and secure the service. Public developer interfaces are read-only and do not create accounts.

Private projects are stored on your device. Submitting a pattern to Creators uploads its content and images. Photos, camera and microphone permissions are used when you activate the relevant features and can be revoked in system settings. Speech recognition may use Apple or Google services depending on your device.

Cookies and tracking technologies

The website uses its own NEXT_LOCALE cookie to remember your language when accessing routes without a language. It is a functional session cookie; whether it is deleted when the browser closes depends on browser settings. It is not used for advertising. You can block or remove it in browser settings; your preference may then no longer be remembered, but you can still read localised pages.

Advertising services in the app and external shops may use device identifiers, cookies or other storage and tracking technologies under their own policies. Non-essential technologies requiring consent must be rejectable or disabled through the relevant service options. Refusing personalised advertising does not delete your account. Google and shop policies are linked at the end of this page.

Account and Google sign-in

Creators uses Supabase for accounts, email, authentication and profile data. If you choose Google on Android, we receive your Google account identifier, email and basic profile data supplied by Google, such as name or picture, to identify you and sign you in. We do not request access to Gmail, contacts or Drive and do not receive your Google password.

Google account data is used for authentication and account management, not sold or used for personalised advertising or affiliate marketing. You can remove the connection in your Google account. Disconnecting Google does not itself delete your Creators account; follow the deletion procedure below.

Resend delivers email confirmation and password recovery messages through Supabase. These support account access; registration does not subscribe you to marketing messages.

Enquiries and communications

When you contact us, we process your email address, any name you provide, your message and attachments to respond and handle your enquiry. Provide only necessary information; routine enquiries do not require a phone number or postal address. Do not send passwords, banking details or unnecessary personal information.

Account access, security and enquiry response emails are service communications. If we offer marketing communications in the future, they will be optional, we will request any required consent and each message will include a way to unsubscribe. Unsubscribing does not prevent necessary account or security notices.

Public profile, publications and moderation

Your chosen display name, @username, biography and avatar form your public profile. Submitted patterns and images are available to moderators and, after approval, to app users. Your email is not displayed on your public profile. Published patterns reflect your current name and @username.

We process submissions, moderation decisions, reports and blocks to review content, handle complaints and prevent abuse. Pattern view, start and completion statistics use an account identifier or a pseudonymised installation identifier to avoid duplicates; the latter is not an advertising identifier. Pseudonymisation is not anonymisation.

Advertising and error diagnostics

The app integrates Google AdMob and Google Play services, which may process IP addresses, device or advertising identifiers and interaction data to serve and measure ads and prevent fraud. Personalisation and tracking requiring consent depend on your choices and system permissions. You can review available advertising privacy options in the app and device settings.

Sentry receives technical error, version, device and diagnostic event information to identify and fix problems. The website currently has no behavioural advertising pixels. We do not use Google sign-in data to enrich advertising data.

Affiliate links and external shops

The app and service content may include affiliate links to Amazon or other shops, identified alongside the recommendation. We may earn a commission from qualifying purchases without an extra charge for using the link. As an Amazon Associate I earn from qualifying purchases.

Opening a link may disclose your IP address, browser information and affiliate identifier to the shop or affiliate network, which may use cookies or similar technology to attribute a purchase under its own policy and consent choices. We do not send your Creators email or Google sign-in data to the shop. Purchases, payments, delivery and returns are handled by the shop; we do not receive your card details through these links.

Purposes and legal bases

We process requested accounts, authentication and publication to perform the service you ask for. We handle enquiries to respond to your request or service relationship. Necessary security, moderation, fraud prevention and diagnostics rely on our legitimate interest in a safe service, balanced against your rights. We also comply with applicable legal obligations.

Where advertising technology, tracking or permissions require consent, you can refuse or withdraw it without affecting earlier lawful processing. We do not make solely automated decisions with legal or similarly significant effects on your account; people review patterns.

Data needed to authenticate you and manage submissions is required for account and publication features; without it, we cannot provide those features. Optional profile information is voluntary. You do not need an account to read the website or use app features that do not require registration.

Providers, recipients and transfers

Depending on the feature, providers include Vercel (website), Supabase (accounts and storage), Resend (transactional email), WordPress catalogue hosting, Sentry (diagnostics), Google (sign-in, Google Play and AdMob) and Apple (device and store services). Approved profiles and patterns are shared publicly in the app. We may also disclose data when legally required.

Some providers may process data outside the European Economic Area. Where applicable, transfers must be covered by an adequacy decision or other GDPR safeguards, such as standard contractual clauses. Contact us for details of recipients and applicable safeguards. External shops process purchases under their own policies.

Other disclosures to third parties, including those necessary to establish, exercise or defend legal claims, require a valid legal basis and must be limited to relevant data. If the service is sold or transferred to another entity, that transaction does not itself permit any use of your data: a change of controller must comply with the GDPR, and you will be informed of its identity, contact details and changes affecting processing. Any new purpose must have the appropriate legal basis and information.

Security, confidentiality and backups

We apply technical and organisational measures appropriate to the risk to protect the confidentiality, integrity and availability of personal data under Regulation (EU) 2016/679 (GDPR). Access must be limited to people and providers who need it for the purposes described. No system provides absolute security. If a personal data breach occurs, we will notify the authority and affected people where required by law.

Backups of hosted services are subject to each provider’s terms and cycles and do not replace copies of your local projects. We cannot guarantee recovery of content you delete or lose on your device. This does not limit your rights or our data protection obligations.

Retention and account deletion

Account data is kept while your account remains open; published content while it remains published. Support messages, security and moderation records are kept as needed to resolve issues, prevent abuse or meet legal obligations and liabilities. Residual backups are removed according to provider cycles and are not used to keep withdrawn content public.

Request deletion in Profile → Creator Center → Delete account, or email mollydigitalapps@gmail.com from your account email with the subject “Delete Step By Step Crochet account”. If you cannot access that email, contact us for proportionate identity verification; never send your password.

Account deletion starts automatic withdrawal and permanent deletion of the profile, submissions, published patterns and images from Creators services. Technical retries may be needed; deletion is not promised to be instantaneous. Minimum information may remain for legal obligations or claims. Private local projects remain on your device and must be deleted there. We cannot erase copies already downloaded by other users. Withdrawing one pattern without deleting the account hides it from the public catalogue and may retain it as a private draft.

Your rights

Where applicable, you can request access, correction, deletion, objection, restriction or portability and withdraw consent by emailing mollydigitalapps@gmail.com. We may request the minimum information necessary to verify identity. You may complain to the Spanish Data Protection Agency (aepd.es) or your competent supervisory authority.

We respond to GDPR rights requests without undue delay and generally within one month of receipt. Where complexity or the number of requests requires it, the period may be extended by up to two additional months, with reasons communicated within the first month. Requests are free of charge, subject to legal exceptions for manifestly unfounded or excessive requests.

If you are a minor, use account and publication features with a legal representative’s authorisation or assistance where required by law. Contact us if you identify improperly processed information about a minor.

Changes and related policies

Updates will appear here with their date; material changes will be communicated through appropriate channels. Also read the terms of service and provider policies linked at the end of this page.

Terms of service