Privacy policy

The short version

Photos you turn into bead patterns are processed inside your browser. The image itself is never uploaded to our servers and is never stored.

We only collect what is needed to run an account: your email address, a record of your sign-in, and how many AI generations you have used today. We do not sell data, and we do not run advertising trackers.

What we collect

Account data: your email address, and for Google sign-in the account identifier Google returns plus whether that address is verified. For email sign-in we store a one-way hash of the single-use login token, never the token itself.

Session data: a hashed form of your IP address and browser user agent, used to detect stolen sessions and to apply rate limits. We do not store raw IP addresses.

Usage data: an anonymous key stored in your browser plus a hashed IP, used to apply the daily AI generation limit for visitors who are not signed in.

Prompt data: if you use AI generation, the text prompt you type is sent to our image provider so it can produce an image. Prompts are not published and are not used to train anything on our side.

Subscription data: our payment processor handles card details. We store only the resulting subscription status, plan and renewal date.

Cookies and local storage

We set a session cookie to keep you signed in. It is HTTP-only and marked secure on the live site. A short-lived cookie is also used during Google sign-in to protect against request forgery, and it is deleted as soon as the sign-in finishes.

A small local key is kept in browser storage so that visitors who are not signed in still get a fair daily AI allowance. Clearing site data resets it.

Who processes data on our behalf

Database and hosting: our Postgres database provider stores accounts, sessions and subscription records; the site itself runs on our hosting platform.

Email delivery: one-time sign-in links are delivered by our transactional email provider.

Image generation: AI prompts are sent to our image model provider.

Payments: subscriptions are processed by our payment provider, which is the only party that handles card data.

Shopping links: some bead shopping links are affiliate links. Following one may set a cookie on the retailer’s own site, which we do not control.

How long we keep it

Account and subscription records are kept while your account exists. Sign-in sessions expire and are cleaned up automatically. Expired login tokens and rate-limit counters are short-lived and removed on a rolling basis.

Your choices

You can ask for a copy of the data tied to your account, or ask us to delete your account and its records. Email us and we will action it. Deleting your account removes your entitlement, subscription record and session history from our database.

You can stop AI generation, clear your browser storage, or simply not sign in — the pattern tool itself works without an account.

Children

beadai is a general-audience craft tool. It is not directed at children under 13, and we do not knowingly collect accounts from them.

Changes to this policy

If this policy changes in a way that affects how your data is handled, we will update the date below and, where it is material, say so on the site.