Privacy Policy

1. Information we collect

Email registration: we process your email address, password, display name and selected language. We use Supabase Auth for email and password authentication; in the App we also process the verification code you receive by email.

Google or Kakao sign-in: we process the user identifiers, email address and profile information (name and profile photo) supplied within the provider's sharing scope.

Apple sign-in: we process the user identifier Apple provides for the service. If an email address is shared with us, we use it for account identification and communication. If you choose Hide My Email, we receive an Apple-generated relay address instead of your actual email address.

Using the Service: we process profiles, project records, work photos and files, palettes, wishlists, comments, schedules and other information you enter or upload, as well as usage records, access logs and cookies (Website).

Consent records: we store whether and when you accepted the Terms of Service and this Privacy Policy and whether you chose to receive notifications, together with your member information.

Store links (Website): when you click a link on the Website that takes you to a store, we record which product you clicked, which project you came from, and the date. Members are distinguished by their member identifier and non-members by a random identifier stored in the browser. Multiple clicks on the same product in one day are counted once.

Contact and reports: we receive your name, email address, message or report and selected language. If you email us directly, we receive your sender address and the content you send.

Under 14: only people aged 14 or older may register for the Service, and we do not collect personal information from children under 14. If we learn that a child under 14 has registered, we delete the account and its information without delay.

2. Purposes and grounds for processing

Information needed to identify members, handle sign-in, authentication and account recovery, and save or post requested projects, works and files is processed to enter into and perform the service agreement (Article 15(1)(4) of Korea's Personal Information Protection Act).

Information received through inquiries is used to understand and answer them. Authentication and recovery emails and necessary service notices are distinguished from advertising and marketing communications.

Notifications: for members who agreed to receive notifications, we provide activity notifications such as comments and likes, and schedule reminders the member sets. You can change this at any time in the App settings. We do not send advertising (marketing) messages before obtaining separate consent.

Store-link click records are used to measure actual referral traffic and to support listing or partnership proposals to stores and brands. This processing rests on our legitimate interest in operating and sustaining the service (Article 15(1)(6) of Korea's Personal Information Protection Act). We do not combine these records with advertising identifiers or share them externally in a form that identifies an individual.

For processing based on consent, we separately explain the purpose, information, retention period, right to refuse and consequences of refusal. Reading this policy is not consent to all processing. Refusing optional purposes does not prevent use of essential member services.

3. Retention

Member information and saved content are retained to provide your account and requested services. When you delete your account, we immediately delete your profile, projects, works and comments, uploaded files and consent records; backups expire within 30 days at most. We also delete personal information without delay when it is no longer needed after a retention period expires or its purpose is fulfilled.

Information that must be retained by law is kept only for the items and periods that law requires. Using a link to an external seller does not, by itself, cause e-commerce record retention periods to apply to all member information.

Store-link click records are kept for three years from the date of collection and deleted thereafter.

Contact and report materials are kept for three years after handling and any appeal are complete, then deleted.

Deleting your Ssuessueknits account is separate from deleting your Google, Kakao or Apple account itself. Disconnecting sign-in at the provider alone does not delete information stored in the Service. We cannot directly delete content others have already downloaded or copied.

4. Processing entrusted to others and cross-border transfers

The Service entrusts the processing of personal data to the providers below. Each processes the data only within the scope of the work entrusted to it.

Supabase, Inc. (United States) — member authentication (including sending authentication emails such as sign-up confirmation and password reset), database and file storage. Data transferred: email address, encrypted password, nickname and profile, content you upload, and access records. Member data and files are stored in the Republic of Korea (Seoul region); because the operating company is a United States entity, it may access the data from outside Korea for operations and technical support.

Cloudflare, Inc. (United States) — web hosting, Service API processing and content delivery (CDN). Data transferred: access IP, request information and access logs. Requests are handled through servers distributed worldwide.

Formspree, Inc. (United States) — receiving and forwarding contact and report forms. Data transferred: the name, email address, message and language you enter in the form.

Google LLC (United States) — email exchanged with our published contact address is handled through Gmail. Data transferred: the sender's email address and the contents of the exchange. Authentication and recovery emails are sent as part of member authentication.

Google LLC (United States) — Firebase Cloud Messaging sends mobile push notifications and widget and lock screen counter updates. Data transferred: a delivery address used to find your device (token), IDs for the recipient account, notification and target, the sender’s public username and a generic notification message. Counters receive project and part IDs and names, saved total rows, goals, count or repeat mode, repeat units and reference values. iPhone delivery passes through Apple Push Notification service (APNs). Social notification pushes, such as comments, replies, likes and follows, exclude sender names, post or project titles and comment text. Counter cards display project and part names.

Timing and method of transfer: data is transmitted over the network at the moment you use the relevant feature. Retention by the recipient: for the period needed to perform the entrusted work; deleting your data on the Site ends the purpose of the entrustment. Each provider's contact details and processing practices are set out in its own privacy policy.

You may refuse the cross-border transfer. However, these providers perform the sign-up, sign-in, content storage and contact intake functions themselves, so if you refuse we cannot provide those functions and your use of member services will be limited. Please tell us at the contact below if you wish to refuse.

Google, Kakao and Apple provide the social sign-in authentication you select. Their own processing for their services is also subject to their respective privacy policies. This policy applies to the member information the Site receives and processes.

Apple App Store and Google Play distribute, install and update the App independently under their own terms and privacy policies. We do not receive information from the stores that identifies individual users.

5. Cookies (Website)

The Website uses essential cookies to keep you signed in. The App does not use cookies (Section 9).

To count store-link clicks without duplicates, we store a cookie (ssk_cid) containing a random identifier in the browsers of non-member visitors, kept for up to 400 days. This cookie contains no directly identifying information such as your name or email address.

If we use tools for optional purposes, such as Google Analytics (usage analysis), Microsoft Clarity (screen interaction records) or Google AdSense (advertising), we explain them separately from essential sign-in cookies. Processing that requires consent is limited to the consent given. Refusing or withdrawing optional consent does not require account deletion.

You can delete or refuse cookies in your browser settings. Blocking essential sign-in cookies may prevent features such as staying signed in from working. Deleting browser cookies is separate from deleting information already sent to providers.

6. Your rights

You may request access, correction, deletion or restriction of processing of your personal information. You may also withdraw consent for processing based on consent by contacting us below. Identity verification may be required depending on the request.

You can edit your profile and delete your account yourself in the Website's member information screen or in the App under Profile → Delete account. If you cannot sign in, email the contact below from the address you registered with; we process the request after verifying your identity. Detailed steps are at ssuessueknits.com/en/account-deletion. Withdrawal of optional consent and deletion of your entire account can be requested separately.

If law requires us to limit a request, we explain the reason. Making a rights request alone does not restrict essential services unrelated to that request.

7. Privacy officer and access requests

Privacy officer: Yewon Kim / Email: [email protected]. Requests for access, correction, deletion or restriction of processing and withdrawals of consent are received at the same address; we respond with the outcome or the reason for any delay within 10 days of receipt.

Contact us about privacy questions, complaints or remedies. You can also contact Korea's Personal Information Dispute Mediation Committee (kopico.go.kr) or Personal Information Infringement Report Center (privacy.kisa.or.kr).

8. Security measures

Encryption in transit: the Website and the App communicate with our servers only over HTTPS (TLS).

Passwords: stored in an irreversibly transformed form; we cannot see the original password.

Access control: the database applies row-level access control so that members can read and write only their own data, and file storage is limited to each member's own path. Administrative work is performed only through authenticated administrator accounts.

Data minimization: we do not collect information that is unnecessary for the Service, such as location, contacts or advertising identifiers.

If a data breach occurs, we notify affected users and the relevant authorities without delay as required by law.

9. Processing in the mobile app

Account and data: the App uses the same member account and data as the Website. Projects, works and comments created in the App appear on the Website under the same conditions.

Device permissions: camera and photo access is requested only when you upload a photo, and other features remain available if you decline. Selected photos are not sent to the server until you tap upload. Notification permission is requested when you choose to receive notifications. We do not access location, contacts or advertising identifiers.

Information stored on the device: your sign-in session is kept in the device's secure storage; drafts in progress and display settings are kept in the App's storage. Uninstalling the App removes this device data, but your account and data on the server remain; account deletion must be done separately.

Notifications: Calendar reminders are scheduled and displayed on your device. Social notifications, such as comments, replies, likes and follows, are saved in the app notification list. We also send them as mobile push notifications when you consent and allow device notifications. For this, we store a delivery address used to find your device (token), device type, notification categories muted on the device, an ID for the app installation and its registration order with your account. Withdrawing social notification consent stops social delivery. If you are not using counter synchronization either, we deactivate the device registration and delete its token.

Feature news (advertising): We send feature news only with separate, explicit advertising consent, independently of device permission and ordinary push consent. We process your push token, device advertising support, consent time and latest confirmation time for this purpose until withdrawal. Tokens also allowed for another purpose follow that purpose’s retention rules. Consent is optional; declining does not restrict service use. Withdraw in the app under Settings > Notifications > Receive feature news. Messages are sent only between 08:00 and 20:59 Korea time. We retain the latest withdrawal time and campaign delivery and deduplication records until account deletion to document withdrawal and prevent duplicate delivery. Within the 30 days before each two-year anniversary of your original consent, we send a non-advertising notice in the app notification list with the sender, consent fact and date, and how to retain or withdraw consent; supported devices also receive a push. No response means consent remains in effect. The time our push provider accepts the notice for a supported device becomes the latest confirmation time; if the push cannot be sent, it is not updated. Feature news stops two years after consent or the latest confirmation, and turning the setting back on counts as new consent. Confirmation, failure and deduplication records are retained until account deletion. We show the sender, processing time and result in the app when you consent or withdraw.

Notification registration removal and retention: To block late registration requests, we keep the installation ID, a transformed value used to check the installation secret (a hash), and the registration order until account deletion. On sign-out, the app asks the server to remove the registration. Sign-out proceeds even if a connection error or delay prevents completion. The device push token is deleted on the next app launch. In that case, the server registration may remain until you sign in again with the same account or a later delivery detects that the token has expired. Notification delivery records are kept for seven days after completion. Unsent notifications older than 24 hours are not sent as push. Notifications already handed to the operating system may still appear after removal.

Widgets and lock screen counters: You choose and withdraw counter synchronization and a day of use that you start, lasting up to 24 hours, separately from social notification consent. From app version 1.1.5 (28), withdrawing notification consent does not turn off the counter. If you keep counter synchronization, it continues to use the same delivery token. Choosing counter synchronization alone does not allow social notifications. Regular state updates and Android data delivery have no notification. When an iPhone lock screen card is replaced remotely to maintain your day of use, a required system start notice may appear. It specifies no sound and uses fixed start text instead of project or part names. We cannot guarantee how the operating system handles display, vibration or Focus, or the exact delivery time.

Information stored on the server for counters: We store account and app installation IDs, a hash of the secret key used to verify the installation, and separate permissions for social notifications and counter synchronization. We also store registration order and limits that block late requests, Firebase Cloud Messaging delivery tokens, and tokens for starting and updating iPhone lock screen cards. A dedicated authorization value used only to report card start and end status is stored as a hash. We store the operating system version and supported features, card IDs and replacement order, and the start time, expiry time and reason for ending each day of use. We also store card replacement schedules, delivery status and confirmation from the device that delivery arrived, and the last counter state and update order. A hash is a transformed value used for comparison in place of the original. We do not store the original installation secret key or card status authorization value on the server.

Information sent to counters: We send project and part IDs and names, saved total rows, goals, count or repeat mode, repeat units and reference values to your own devices. We use Firebase Cloud Messaging (Google) and, on iPhone, Apple Push Notification service (APNs). Supabase stores account, app installation, day-of-use and counter state information for this feature. Section 4 covers processing entrusted to providers and cross-border processing. Counter delivery excludes notes, photos, other users’ information, original PDFs and audio. Records used to monitor operation do not contain tokens, installation secrets or project or part names. We monitor successes and failures as totals.

Counter retention and deletion: Active delivery tokens and copies of the last counter state are kept only while the relevant widget, card or counter synchronization remains valid. Withdrawing use of that widget or card, or the day of use, deletes the related tokens, replacement schedules and state copies. Features you allowed for other purposes remain independent. Tokens for replaced iPhone cards are deleted immediately after their end is confirmed or their status is checked and brought into line. If a deletion request has not reached the server, we attempt deletion within the day of use of up to 24 hours and each card’s allowed lifetime. We cannot guarantee removal from the screen at an exact time. When a delivery task ends, its delivery content and token copies are deleted.

Processing result retention: Completion and error information for new counter delivery tasks, and records confirming request handling, are kept for up to seven days. Delivery content and tokens are excluded from records retained to investigate problems. Records used to match requests also use token hashes instead of original tokens. This prevents those records from keeping an original copy after the token is removed.

Minimum records to block late requests: For each app installation, we keep one record of an ID and times to prevent a delayed row change from being processed again after its card has ended. This record is not deleted solely because time has passed. It is cleared when all feature registrations for that installation are withdrawn, when you sign out or when you delete your account. We also retain the last registration order for a removed installation. The order and ended status of the last day of use remain as minimum records for each installation. These records prevent late requests from restoring a registration or card. Keeping social notifications alone does not retain counter names or card content. Installation verification records left after social notification removal follow the notification removal and retention rules above.

Row changes, target selection and waiting records: For seven days, processing records prevent the same row change or counter target selection request from being processed twice if resent. Ending a card does not delete your original projects or saved row counts. After the last counter widget or card is removed, automatic server processing clears waiting delivery state and records indicating that processing is needed. No new counter deliveries are added to the waiting list after that. Records of scheduled server runs are cleared only for related tasks completed more than one day earlier.

How to turn counters off: Turning the card OFF in the app ends that day of use and blocks automatic card replacement. Choosing to end an ongoing card does the same. In either case, synchronization for a home widget that remains may continue. Removing the last widget when no day of use remains active removes only the counter synchronization registration. Withdrawing counter synchronization also removes only the counter registration and keeps your social notification choice. Signing out or changing accounts removes registrations for both purposes. Account deletion also deletes the related server management records.

Removal timing and older versions: If you turn an operating system permission for a feature OFF, the resulting request to remove its registration and data may reach the server when the app next detects the change, such as on its next launch. After the app or server has detected card dismissal, ending or OFF, the card does not restart automatically. You must start it yourself again, such as by choosing to continue. A card may briefly reappear if its dismissal has not yet been reported or a start request is already being sent. Version 1.1.5 (27) and earlier may delete the entire registration or device token when social notification consent is withdrawn. Counter synchronization may end as a result.

Advertising and analytics: the App contains no advertising SDK or behavioral analytics SDK.

Account deletion: in the App, go to Profile → Delete account, enter your account email to confirm, and the account is deleted immediately.

10. Processing in the Chrome extension

The Chrome extension “Ssuessueknits Row Counter” (the “Extension”) uses the same member account and data as the Website. It uses the ssuessueknits.com sign-in cookie in your browser (including its access token) to read and save the names, row counts and repeat settings of your projects in progress. It does not store or refresh the token separately and never asks for your password.

The Extension keeps your project list, the counter’s position and size, and rows not yet sent to the server only in your browser’s extension storage. This information is not sent to us separately and is deleted when you remove the Extension.

The Extension runs on all sites so it can show the counter over the page you are viewing, but it does not read or collect that page’s content, address or browsing history. It handles only its own keyboard shortcuts and ignores key presses in input fields.

11. Changes

We announce changes to this policy and their effective date. Where a change requires new consent, we provide a separate explanation and obtain the necessary consent before starting that processing.

Revision history: October 24, 2026 — Added feature news based on separate advertising consent, delivery hours, withdrawal methods, biennial confirmation notices and retention of operational records (Section 9). October 18, 2026 — clarified choices and withdrawal for social notifications and counter synchronization, day-long use and card replacement, and the information processed and its retention and deletion (Sections 4 and 9). October 16, 2026 — added widgets and lock screen counters (Sections 4 and 9). October 8, 2026 — added processing in the Chrome extension “Ssuessueknits Row Counter” (Section 10). October 1, 2026 — introduced mobile push notifications (Section 9) and added the push notification delivery processor (Google Firebase Cloud Messaging) (Section 4). September 25, 2026 — added the mobile app to the scope (Section 9), specified security measures (Section 8), retention periods and the account deletion procedure, and stated the minimum age of 14. September 10, 2026 — first version.