Privacy policy

Last updated October 7, 2026.

Floss Field (flossfield.com) is run by Click Clack Labs LLC (“we”, “us”). This page says what the site stores, why, who helps us run it, and how to see or delete what is yours. There are no accounts and nothing to sign up for to use the patterns or the tools.

The short version

• You can browse, download and use every tool without giving your name or email.
• One cookie is essential, and it is set only when you first save a chart or a thread list, so this browser can find them again, and it is renewed only when you use them. Google Analytics sets two more (_ga and _ga_B1QH9C3LRS), only while measurement is on for you.
• We measure how the site is used with our own visit counter and with Google Analytics. In the European Union, the United Kingdom, Switzerland and the other places named below we ask first, and nothing about your visit is measured until you accept. Elsewhere measurement is on until you turn it off. Global Privacy Control and Do Not Track are honored for measurement everywhere.
• You can change your choice at any time with “Privacy choices” at the foot of every page.
• Whatever you choose, we keep the words of the searches our server answers, with nothing that says who searched, so we know which patterns to make. What people search for says exactly what is kept.
• It does not use advertising cookies. We do not sell personal information.
• To see, correct or delete anything connected to you, use the private request form, or write to Click Clack Labs LLC, 418 Broadway, Ste R, Albany, NY 12207.

Measurement and your choice

We measure how the site is used so we know which patterns and tools to make next. There are two parts: our own visit counter and Google Analytics. Both follow one choice, which you can change at any time with the button below or the “Privacy choices” link at the foot of every page.

If you are in the European Union, Iceland, Liechtenstein, Norway, the United Kingdom, Switzerland, Andorra, Monaco, San Marino or Vatican City, or in a territory or dependency of one of those countries, or if we cannot tell which country you are in, we ask before measuring your visit. Until you accept, nothing about your visit is measured, no visit ID or analytics cookie is stored, and nothing is requested from Google. Declining takes one click, and the site works the same either way. Everywhere else measurement is on by default and you can turn it off. One thing is kept whatever you choose, because it holds nothing about you or your visit: the record of searches described under What people search for.

If your browser sends a Global Privacy Control or Do Not Track signal, measurement stays off wherever you are, and we do not ask. A few tools add that signal to requests in a way a page’s script cannot see. Our server sees it when you open the site, and then you are asked first wherever you are: nothing about your visit is measured unless you accept.

Your answer is kept in this browser’s local storage, on this device only, for up to twelve months; after that we ask again. If the browser does not let the site keep anything, measurement stays off. To find that out, each page writes one word there and removes it at once. To know whether to ask, the page requests one word from our server (“ask” or “allowed”), worked out from the country our hosting provider reads from your connection. The request carries no cookie, and the country is not stored or logged; where the word is “allowed”, it is kept in the browser tab until you close it. If you turn measurement off, the visit ID and the Google Analytics cookies are deleted from this browser at once.

Our own visit counter

This site uses Supabase to store saved patterns, voluntarily submitted emails, pattern requests, and basic usage events. If storage is unavailable, forms report an error instead of claiming to save your data.

While measurement is on, a random visit ID connects page views, searches, collection and tool use, preview choices, saves and downloads. The ID, and the kind of place the visit came from (a search engine, a social site, another site or none), are kept in the browser tab’s own storage and are gone when the tab is closed. We record that broad referral category, not the full referring URL. Searches are recorded with the visit ID, cleaned as “What people search for” describes, so please avoid entering personal information. Personalization text is not included in analytics. Usage events older than 90 days and expired abuse-prevention hashes are removed as new activity arrives. No raw IP address is stored by the application.

Google Analytics

Google Analytics is a measurement service provided by Google LLC. We use it for measurement only: to count visits and to learn which pages are used and how people find the site. It loads only on flossfield.com, and only while measurement is on for you. It does not load at all on the page of a pattern you put a name on, described under Patterns you put a name on.

When it is on, your browser loads Google’s script and sends Google the address and title of each page you open here, the page you came from, the time, your browser, device type, screen size and language, and what you do on the page, such as scrolling, following a link to another site or downloading a file. Google works out an approximate location from your internet address, which Google Analytics does not keep. Google explains what it does with this in How Google uses information from sites or apps that use its services.

Before anything is sent, the site removes what you may have typed. A page address is cut back to the page itself: everything after the question mark is taken off, except three labels that say where a link to the site was placed (utm_source, utm_medium and utm_campaign). On the page of a tool, where what you type is kept in the page’s own address, nothing after the question mark is sent, not even those labels, and neither is any wording Google’s script finds on the page, such as the text of a link, the name of a file or the label of a button. So the words you search for, what you type into a tool, the names, dates and text you put on a chart, and the address of a saved chart are not sent, and a page whose title contains such words is sent under its address instead. We do not send Google your name or your email address.

Google Analytics sets two first-party cookies on flossfield.com, _ga and _ga_B1QH9C3LRS. Each holds a random ID that tells one browser’s visits from another’s. Neither is kept for more than 390 days (under 13 months) after your most recent visit. They are set only while measurement is on for you.

Advertising features are switched off. Google signals and advertising personalization are disabled, Google is told through its Consent Mode that advertising storage, advertising user data and advertising personalization are denied, and the site’s security settings do not allow a page to contact Google’s advertising services.

Google processes this information on its servers in the United States and in other countries where it operates. Google Analytics keeps data that is tied to a cookie ID for no more than 14 months after your most recent visit, the longest its settings allow; the totals in its reports are kept longer and carry no cookie ID.

What people search for

When you search the site and our server answers the search, we keep a record of the search itself, so we can decide which patterns to make next. That is the search page reached from the top of every page, and a list of cross stitch patterns opened with a search in its address. The record holds the words searched for, the craft they were searched in, how many designs and pages those words find, and the day. That is all it holds. It has no visit ID, no cookie, no internet address, no browser details and no time of day. The record itself does not say who searched, and we do not try to work it out.

Because our server has to read the words to answer, and the record holds nothing about who asked, it is kept whatever you chose about measurement: when measurement is off for you, when you have declined analytics, when you have not answered yet, and when your browser sends a Do Not Track or Global Privacy Control signal. There is no switch for it. If you searched for something you would like taken out, tell us the words and the day through the private request form and we will delete it.

The search box above a list of cross stitch patterns works differently. Results appear as you type because your own browser does the matching, and nothing is sent to us for that. Only while measurement is on for you does the page tell our server what you searched for there, once you stop typing, open a result or leave the page: it is sent with your visit ID, as “Our own visit counter” describes, and the same words are then added to the record above. While measurement is off, what you type there is not sent. The address of the page holds your words, though, so if the page is loaded again from that address (a reload, the Back button, a link you kept), or if the page cannot do the matching itself (scripts are off, or its list of designs did not load), our server answers the search and records it like any other.

The words are cleaned before they are kept, in this record and in our own visit counter alike. A search that contains an at-sign, a web or email address, or a long number (five figures in a row, or six with no letter between them), or that is longer than 80 characters, is not kept at all, so an email address, a phone number or a long pasted message is not stored. Cleaning cannot recognize a name, a street or a short message, so please do not put personal information in a search box. Names, dates and other text you put on a chart, and what you type into a tool, are never part of this record.

Three counts stand beside the record for up to two days, none of them stored with a search. Two are kept under a one-way hash of the kind described under “Keeping the site working”: how many searches came from one connection that day, to stop a flood, and, under a hash made from the search as well, whether that connection has already made that same search that day, so that going back to a page or loading it again is not counted twice. The third is how many searches the whole site recorded that day. Our hosting provider’s short-lived logs, described in the same section, include the address of each page requested, and the address of a search holds its words.

A record older than 90 days is deleted as new activity arrives, in the same sweep as other usage events. Before then we count the records: for each search, the words, the craft, how many times and on which days it was made, and what it finds. Those counts are kept in our private planning notes, away from the website, for up to twelve months, and a search made only once is taken out of them 90 days after it was made.

Patterns you put a name on

Some patterns are made for a name: you type it and the chart is drawn with it. Once the page’s own script is running, your own browser draws that chart and makes its PDF, so what you type is not sent to us, and the page says “Your words stay on this device.” Once you have changed something, what you typed is kept in the browser tab’s own storage, so that loading the page again does not lose it. It stays there until you close the tab or press “Start again”; a browser that reopens a closed tab may bring it back. It is never put in the page’s address.

If scripts are off in your browser, or the page’s own script does not load, the page cannot do that itself, and it says so before anything is sent. Then what you type is sent to our server each time you press a button of the form, to make the page or the PDF you asked for. It is not stored, it is not written to a log of ours, and it is not sent to analytics. While the script is still loading, a press sends nothing.

The text generator, which such a page links to, works another way: what you type there is kept in that page’s address, which is sent to our server when the page is loaded or its PDF is made.

While measurement is on for you, our own visit counter records that such a pattern was opened, changed or downloaded, and which lettering, colors, end pictures and size were chosen. It never records anything you typed. Google Analytics does not load on these pages, and no other company’s script runs on them.

The hand embroidery keepsake maker, where you put names and a date on a hoop pattern, keeps them on your device in the same way. Your own browser draws the pattern and makes its file, so what you type there is not sent to us. It is kept in the browser tab’s own storage, so that loading the page again does not lose it, until you close the tab or press “Start again”; a browser that reopens a closed tab may bring it back. It is never put in the page’s address or in the name of the file. The maker needs scripts: with scripts off its page shows finished examples and sends nothing. Nothing you type or place there is recorded by our own visit counter, and Google Analytics does not load on its pages.

Keeping the site working

To stop abuse, the application counts requests against a one-way hash made from your network address, a secret and the date. The hash changes every day, cannot be turned back into an address, and is deleted after it expires. Separately, our hosting provider handles your IP address and browser details in its own short-lived logs in order to deliver pages to you, as every web host does.

Feeds for Pinterest

The site publishes lists of its designs (RSS feeds) that Pinterest’s own reader collects to make pins. When that reader asks for a feed, we keep one line for that feed in that hour: which feed it was, how many designs it held, and the time. The line is kept with the usage events, for up to 90 days, and nothing in it is about a visitor. The feeds and the pictures made for pins set no cookie and are not measured.

Favorites on this browser

Hearts save pattern IDs in this browser’s local storage. They stay on this device, work without an account, and are separate from saved chart projects. Removing a heart removes that favorite.

Saved patterns & shared colorways

When you first save a chart or check off a thread, we set one essential, private cookie (ff_session) so this browser can find its saved charts and thread list again. It is kept for 180 days from the last time you used them here, and each use renews it: saving, changing or deleting a chart, checking a thread off or taking it off, opening your saved charts, the thread checklist or the thread shopping list, and asking the pattern list to show patterns that use your threads. Opening or reading any other page neither sets it nor renews it. This site does not offer accounts or cross-device recovery. Clearing that cookie loses access to its saved collection. Saves start private and preserve the exact stitch grid and your stitch progress. Photo conversion happens on your device. If you choose to save a converted chart, its colored stitch grid is uploaded and may still resemble your original image, but the source photo is not uploaded. A chart you are drawing in the pattern maker is kept as a draft in this browser’s own storage until you save or discard it, and the picture converter keeps your last chart for as long as its tab is open; neither is uploaded unless you save. You can explicitly publish a colorway from your saved patterns; personalized text is removed from public versions. No email or account identifier is shown in the public gallery. You can unpublish or delete a save.

Your thread checklist

Your checked-off DMC color codes are stored privately in Supabase and linked to the same browser cookie as your projects. They are not public or included in usage events. Download a backup from the checklist to keep your codes or import them on another browser. Unchecking a color removes it from your checklist. Ownership tracks color codes, not thread quantities.

Settings kept on this device

The color theme, inches or centimeters, paper size, preview fabric and picture-converter settings you choose are remembered in this browser’s local storage. On a pattern that is written out row by row, the row you tap to keep your place, and how far you are through a run of rows that are all alike, are remembered the same way. They are never sent to us.

Emails and requests

Email signup is optional. We store your address, selected topic and consent time. We do not send automatic emails. Messages sent through the request form are stored so the site owner can read and answer them. To request access, deletion or removal from the email list, use the private request form with your email address. Requests are handled by the site owner.

Advertising

There is no advertising on this site today, and no advertising script loads on any page. The only script from another company is Google Analytics, described above, which is used for measurement and never for advertising. We plan to show ads in the future so the patterns can stay free. Before the first ad appears, this page will be updated to name the advertising providers, explain the cookies they use and give you the choices the law requires, including asking for consent where it is needed.

Links to Amazon

Thread lists link each DMC number to a search on Amazon, in a new tab. Floss Field sets no cookie for this; once you follow a link you are on Amazon, under Amazon’s own privacy policy and cookies. These are plain search links: Floss Field earns nothing from them. Floss Field is not affiliated with DMC or Amazon.

Who helps us run the site

Two companies process data on our behalf, only to provide their service to us: Vercel hosts the website and delivers its pages, and Supabase hosts the database described above. Google provides Google Analytics while measurement is on for you, under Google’s own terms; the page of Google’s linked above says what Google does with what it receives. All three may process data in the United States and in other countries where they operate. We do not sell personal information, we do not share it for other companies’ advertising, and we do not give it to anyone else unless the law requires it or it is needed to protect the site and its visitors.

How long things are kept

• Usage events: up to 90 days.
• Records of what was searched for, which hold nothing about who searched: up to 90 days. The counts made from them (the words, the craft, how often and on which days): up to twelve months, and 90 days for a search made only once.
• The visit ID of our own counter: until you close the tab, or until you turn measurement off.
• Your measurement choice: up to twelve months in this browser, then we ask again.
• The Google Analytics cookies (_ga and _ga_B1QH9C3LRS): no more than 390 days after your most recent visit, or until you turn measurement off.
• Data held by Google Analytics that is tied to a cookie ID: no more than 14 months after your most recent visit.
• The ff_session cookie: up to 180 days from the last time you used your saved charts, your thread list or a thread tool.
• Saved charts, published colorways and your thread checklist: until you delete them. We may also remove saves that no browser has opened for a long time.
• Email signups and request messages: until you ask us to delete them or they are no longer needed.

Your rights

Wherever you live, you can ask us what we hold that is connected to you, ask for a copy, ask us to correct or delete it, withdraw a consent you gave, or object to measurement (“Privacy choices” at the foot of every page does that at once). You can also ask us to take a search out of the record of what is searched for, by telling us the words and the day. Privacy laws such as the GDPR in Europe and the United Kingdom and the CCPA in California give residents these rights and others, including the right to complain to a data protection authority. We will not treat you differently for using them. Because there are no accounts, we may need the email address you signed up with, or a request sent from the browser that holds your saved charts, to find what is yours. To make a request, use the private request form, or write to Click Clack Labs LLC, 418 Broadway, Ste R, Albany, NY 12207.

Where the law asks for a legal basis: the essential cookie and saved charts are needed to provide what you asked for; measurement rests on your consent where we ask for it first (the places named under “Measurement and your choice” above), which you can withdraw at any time through “Privacy choices”, and elsewhere on our legitimate interest in running and improving the site, with the same opt-out; the record of what is searched for rests on our legitimate interest in knowing which patterns to make, and is built to hold nothing that identifies you; abuse prevention rests on our legitimate interest in keeping the site working; email signup rests on your consent.

Children

This site is meant for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us an email address or a message, tell us and we will delete it.

Security

Data is sent over encrypted connections and stored with access limited to the site owner. No website can promise perfect security; please do not put sensitive personal information into searches, chart text or request messages.

Changes to this policy

When what the site stores changes, this page changes with it and the date at the top is updated.

Contact

For anything about privacy, use the private request form, or write to Click Clack Labs LLC, 418 Broadway, Ste R, Albany, NY 12207. See also the terms of use.