Knitto Privacy Policy

This Privacy Policy explains how Needbase (“we”, “us” or “our”) handles information in connection with the Knitto app (the “Service”). It applies to the Knitto app. The initial release is offered in the Republic of Korea, Japan and the United States. Your rights depend on applicable law, not solely on the language of this policy or your App Store country.

1. Information Stored Only on Your Device

The Service does not require an account, and we do not operate servers for it. The pattern files you add and the records you create in the app (such as counters, notes and photos) are stored on your device and are not automatically sent to us during ordinary use of the app. Information you choose to send as feedback or attachments is covered by Section 2. Text recognition for photos of patterns and yarn labels, and automatic finding of pattern details, are also performed on the device.

Deleting the app deletes this information from your device, except for the start date of a Knitto Plus free trial (Section 7), which remains so that the trial does not restart after reinstallation, and the random usage-statistics identifier and your “Share Usage Statistics” setting (Section 10), which remain so that your choice is kept if you reinstall. This information may be included in your device’s iCloud Backup or computer backup, which is stored by Apple or on your computer; we do not collect it. If we offer iCloud sync in the future and you turn it on, this information will be stored in your own iCloud account and processed by Apple. We cannot access it.

2. Information We Process, Purposes and Legal Bases

1. Before opening a feedback form, the app explains the information, purposes, retention and consequences of declining. It opens the form only after you tap “Agree and Write Feedback”. Automatic information and the consent record are sent to Tally in the URL at that point; answers are sent on submission. Files may be transmitted during upload. Tally and its service providers may process connection information such as your IP address. Closing without agreeing makes no form request from the app.
2. The app does not automatically collect your name, email address, phone number, postal address or advertising identifier (IDFA). We receive an email address when you contact us directly, such as by email, and use it to respond to inquiries and handle rights requests. Feedback forms have no separate email field.
3. The app does not automatically attach pattern titles, pattern content, note text, photos or designer names to feedback forms or send them as usage statistics or crash reports. Information you choose to include in feedback or attachments is received by us. Please avoid including unnecessary personal information.
4. We do not link usage statistics or crash reports to your name or contact details. We disable collection of IP addresses and city-level location in the usage-statistics SDK (Amplitude). This does not eliminate IP address processing needed to communicate with external services. Records with random identifiers are not treated as fully anonymous.
5. In the Republic of Korea, Japan and the United States, usage statistics are on by default. You can turn them off in the notice on the initial pattern list or in Settings › About › “Share Usage Statistics”. In all other countries, the app asks for your choice from first launch and sends no usage statistics until you agree. The app uses your App Store country and device region settings to decide which applies. If any available information points to another country, or the country cannot be identified, prior consent applies. Existing explicit on/off choices are kept. Crash reports follow the same setting: turning off usage statistics also stops crash reports.

3. Retention and Deletion

1. Feedback responses, attachments, consent records submitted with them and inquiry emails are deleted within 2 years of receipt. We delete them sooner without undue delay when no longer needed or a deletion request is verified.
2. We set a retention period of 24 months from the date Amplitude receives usage-statistics event records, for year-over-year comparisons and service improvement. Records beyond that period are removed through automatic deletion jobs that run daily. When automatic deletion is first enabled, deletion of existing records may take up to 30 days. The same retention period applies to event records we download separately. We delete records sooner without undue delay if they are no longer needed, including when the Service ends.
3. Crash reports and associated identifiers (Crashlytics installation UUIDs and Firebase installation IDs) are kept by Google for 90 days, after which removal from live and backup systems begins.
4. We delete electronic files under our control so that they cannot be recovered. For data held by service providers, we use their deletion tools or request deletion, including removal from trash. Residual copies such as backups may take time to disappear under the provider’s deletion cycle. Information that must be retained by law is kept for the required period, is not used for other purposes, and is then deleted.

4. Disclosure to Third Parties

We do not sell your personal information or share it for cross-context behavioral advertising. Apart from processing by the service providers described in Section 5, any disclosure to third parties must follow the legal basis and procedures required by applicable law.

5. Service Providers and International Transfers

We use the following service providers, which involves transferring personal information outside your country.

We handle inquiry emails through Google Workspace Gmail and apply its Europe storage policy to covered email data. This policy does not restrict all support or ancillary processing to Europe. See Google’s data regions information for coverage and exceptions and the Google Workspace subprocessor list for support and subprocessing entities and countries. Google’s applicable service terms and Cloud Data Processing Addendum (CDPA) govern this processing.

We handle crash reports through Firebase Crashlytics. Crashlytics runs on Google’s global infrastructure, so its storage location cannot be selected, and the Firebase Data Processing and Security Terms apply. See Firebase privacy information for processing locations.

We access and handle feedback, inquiries, usage statistics and crash reports in the Republic of Korea. The storage locations above do not mean that all subprocessing or support takes place only in those countries. Tally uses EU subprocessors for attachment storage and may use US subprocessors for supporting functions such as web-form error monitoring. Amplitude also uses subprocessors and remote support. Provider names, purposes and countries are available in the Tally subprocessor list and Amplitude subprocessor list and Firebase subprocessor list. Contact us under Section 11 for information about applicable transfer safeguards.

1. You can prevent future automatic transmissions from the app by closing the pre-form notice without agreeing and by turning off usage statistics, which also stops crash reports. All features of the Service remain available. To request deletion, restriction or withdrawal of consent for information already received, see Section 8.
2. Amplitude, Inc. participates in the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. Data Privacy Framework) and uses the European Commission’s Standard Contractual Clauses where required.
3. When you play a YouTube link that you added to a technique, your device communicates directly with Google, and that processing is governed by Google’s Privacy Policy. We do not receive this information.

We may use Claude to help analyze feedback while preserving its wording. We first remove names, contact details, addresses, random identifiers, individual device statistics, attachments and contextual details that could identify a person, and use only content that does not identify individuals. If we cannot remove the possibility of identification, we do not send that feedback to an external AI service. We do not provide original response records, attachments or identifier-level statistics to Claude.

Transfer bases and safeguards

Where Korean law applies, entrustment and storage with GDPR-covered recipients in the EU/EEA follow the scope of the equivalence recognition under Article 28-8(1)(5) of Korea’s Personal Information Protection Act. Email inquiry and rights-request handling is limited to what is needed to respond to your request and meet legal obligations. We do not treat optional usage statistics as necessary for handling inquiries.

Where Japanese law applies, we provide information to Amplitude, Inc. and Google LLC (US companies) and Google Asia Pacific Pte. Ltd. (a Singapore company) as recipients that have established, through our data processing agreement, a system meeting the standards under Article 28(1) of Japan’s Act on the Protection of Personal Information. As required by Article 28(3), we take the measures necessary to ensure that system continues to be implemented and provide related information on request.

Our providers’ data processing agreements require purpose limitation, confidentiality, security, subprocessor safeguards and assistance with individual rights. See the Amplitude TOS DPA, Tally DPA information and Google CDPA and Firebase Data Processing and Security Terms. Support and subprocessing outside the EU remain subject to applicable transfer requirements and contractual safeguards. EU storage settings do not restrict all access to the EU.

6. App Permissions

When you choose photos, the app receives only the photos you select and does not access your entire photo library. You can change permissions at any time in your device’s Settings.

7. Knitto Plus Subscription

Once Knitto Plus is offered:

1. Payments, renewals, cancellations and refunds are handled by the Apple App Store. We do not collect your payment details (such as card numbers).
2. The app checks the subscription status provided by the App Store (whether you are subscribed and your renewal date) on your device.
3. The start date of your free trial is stored only in your device’s Keychain and remains after the app is deleted.
4. If usage statistics are on, the plan status described in Section 2 is included in them.

8. Your Rights

1. You may at any time request access to, correction or deletion of, or restriction of the processing of the personal information we hold about you, and you may withdraw your consent. You may also exercise other rights available under applicable law, including an appeal of a decision on your request or a complaint to the competent regulator. We do not treat you unfairly for exercising your privacy rights.
2. To exercise these rights, please contact us at the email address in Section 11. We will respond without undue delay. You may also exercise them through a legal representative or an authorized agent.
3. To request deletion of feedback, tell us which form, the approximate submission date and a short excerpt. We use these to locate and verify the record; we do not routinely require an identity document or a new account. If the connection between you and the record is unclear, we ask only for the minimum additional information needed. We check responses, attachments and copies under our control for deletion and explain the outcome or why we cannot act.
4. Usage statistics and crash reports use random identifiers, so your name or email address alone may not let us locate your records. If the information you provide lets us locate the relevant records, we will handle your request under applicable law; otherwise, we will explain why we cannot locate them. Turning off usage statistics stops further transmission but does not automatically delete records already sent.

9. Security

1. Feedback, usage statistics and crash reports are transmitted over encrypted connections (HTTPS).
2. Access to responses, statistics and crash reports is limited to us and people we designate, and the relevant accounts are protected with two-factor authentication.

10. Cookies, Identifiers and Do Not Track

1. The app itself does not use cookies.
2. If usage statistics are on, the analytics tool (Amplitude) stores a random identifier on your device to aggregate usage from the same device, and the crash reporting tool (Firebase Crashlytics) stores random identifiers (a Crashlytics installation UUID and a Firebase installation ID) to count how many devices a crash affects. Turning off usage statistics stops any further transmission.
3. The feedback forms (Tally) and YouTube videos you add, which open within the app, may use cookies under their own policies.
4. Because the Service does not track you across other companies’ apps or websites, it does not respond differently to “Do Not Track” signals.

11. Privacy Officer and Contact

We have designated the following person to oversee the handling of personal information and to handle inquiries, complaints and requests for remedies.

12. Children

The Service is not directed to children under 14, and we do not ask for or verify users’ ages. If we learn that information we received, such as through a feedback form, belongs to a child under that age (for example, because the content states their age or a parent or guardian tells us), we will delete it promptly.

13. Changes to This Policy

We will show changes and their effective date on this page. We will give advance notice in the app or on this page of material changes, such as changes to collection purposes or recipients, and obtain separate consent where required. Any legally required notice methods and periods will apply.

• Effective date: October 22, 2026