Privacy policy

This is a translation; the German version is binding.

1. Controller

2. In short

• Your designs (blocks, quilts, stash, settings) are saved only in your browser, on your device. We never receive them.
• There is no user account, no tracking, no analytics, no ads and no cookies.
• Fonts and everything else come from our own server; nothing is loaded from third parties such as Google Fonts.
• Personal data is only processed when you visit the website, use a license key, pair devices or write to us, as described below.

3. Hosting of the website and the app

The website ompelut.com, the app at app.ompelut.com and our server at api.ompelut.com run on Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit them, Cloudflare processes technically necessary data: your IP address, date and time, the address requested, browser type and operating system. This is needed to deliver the pages and to protect against attacks. We do not analyze access logs ourselves.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure, working service). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are covered by the European Commission's adequacy decision, and in addition by standard contractual clauses.

4. Storage in your browser

The app stores your designs, settings and backups in your browser (IndexedDB) and keeps its program files for offline use. This data does not leave your device unless you export it yourself, pair devices (section 6) or send us a file (section 7). This storage is strictly necessary for using the app as you request (§ 25(2) no. 2 TDDDG). You can delete it at any time by clearing the site data of app.ompelut.com in your browser.

5. License keys

You need a license key to use the app (currently in a closed beta). When you unlock the app, and about once a day after that, the app sends the key and a random device ID to api.ompelut.com and receives a signed confirmation. For each key we store: the name we entered when creating the key, its validity, the device IDs, and the time of first and last use per device. Your designs are not transmitted.

The purpose is to check whether a key is valid and on how many devices it is used. The legal basis is Art. 6(1)(b) GDPR (performance of the terms of use). The data is deleted no later than three months after the key expires. It is stored at Cloudflare (section 3).

6. Sync between your devices (optional)

When you pair devices in the settings, they sync your designs directly with each other (WebRTC, end-to-end encrypted). To find each other, they connect to our relay server at api.ompelut.com. It sees the devices' IP addresses, a room ID derived from the pairing code and encrypted connection data. It only passes this on and stores nothing. To learn their public address, the devices also ask Cloudflare's STUN server (stun.cloudflare.com), which processes the IP address.

The legal basis is Art. 6(1)(b) GDPR (the feature you request). Without pairing, none of this takes place.

7. Email and feedback

When you write to support@ompelut.com, we process your email address, the content of your message and any attached files (such as a design you saved with “Feedback” in the app) to answer you and to improve the app. “Feedback” only opens your email program with a draft containing the app version, browser and screen details and the first four characters of your key; nothing is sent without you.

Emails to ompelut.com are received by Cloudflare Email Routing and forwarded to a mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process data in the USA and is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(b) GDPR where your message concerns your use of the app, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering messages). We delete messages when they are no longer needed, at the latest when legal retention periods end.

8. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Just write to support@ompelut.com.

Last updated: October 2026