Privacy

Updated 8 October 2026. YarnNest is a free crochet pattern library and project tracker. Browsing patterns and keeping progress do not require an account.

Progress stays on your device

Project names, colours, notes, stitch counters and progress are saved in this browser's local storage. They are not uploaded by the tracker and are not synced through Google. Other people using the same browser can see them. Clearing browser data removes them; use Account → Download backup before doing so. A backup contains device projects, not Google credentials or server submissions.

Google sign-in

Sign-in is needed to submit photos or use admin tools. Google supplies an account identifier, display name and verified email address. The server stores these to identify your submissions and determine administrator access from an explicit email allowlist. YarnNest does not receive your Google password.

A secure, HTTP-only session cookie keeps you signed in for up to 14 days. A short-lived OAuth state cookie protects sign-in. Signing out invalidates the current server session; it does not erase your device progress or stored submissions. Google handles its own sign-in data under its privacy policy.

Submitted photos and dimensions

We store your title, free-text dimensions, optional notes, ordered photo-angle labels and photos, along with ownership, sharing and rights confirmations and their timestamps. Photos are re-encoded as WebP to remove embedded metadata such as EXIF location information. This does not remove faces, addresses or other information visible within an image; check your photos before uploading.

Pending, rejected and under-review submissions are accessible only to their owner and administrators. Once an administrator publishes a submission, its title, display name, dimensions, photos and reviewed pattern are public and may be indexed or copied. Submission notes, AI analysis, draft patterns and review notes are not included in the public view. See sharing rules.

AI review

When an administrator runs analysis, the server sends submitted images, dimensions, notes and the administrator's instructions to the configured vision provider. The current deployment uses OpenRouter with Google's Gemini model. Those providers process the request under their own terms and privacy policies: OpenRouter privacy and Google privacy. Do not submit sensitive personal information. AI results are stored as private review material and never published automatically.

Storage and removal limits

Account and submission records, sessions, photos and reviews are stored on the server's persistent volume. The application does not currently offer self-service account or submission deletion or a fixed automatic submission-retention period. Administrators can unpublish a project by changing its review status; this removes it and its reviewed pattern from the public listing, but does not delete the stored submission. Previously downloaded copies, search caches and cached public photos may remain outside YarnNest's control. Clearing device data affects only the local tracker.

Advertising and choices

Advertising is currently disabled. The site does not load AdSense unless an actual ad unit is configured, ads are enabled, and a consent manager supplies the required consent signals. No consent manager or no consent means no ad request. A custom checkbox is not used as a substitute for a certified consent manager.

If advertising is enabled later, Google and its partners may use cookies and similar identifiers to select and measure ads under Google's advertising policy. Use the in-app Ad choices control to open the installed consent manager's settings. When no manager is installed, the control reports that choices are unavailable and ads remain off. Ads are excluded from sign-in, submission, review, admin and stitch-counter screens.

Network requests

Your browser and the hosting service exchange ordinary request information such as IP address and user agent to serve the site. The application does not implement a separate analytics tracker. Hosting, Google sign-in and any explicitly enabled AI or advertising provider can process request data independently.