What we collect, what we don't

Who we are

“Stitched Memory,” “we,” “us,” and “our” refer to the Stitched Memory keepsake studio operating at 54 Gateway Dr, Jasper, GA 30143. Questions about this policy can be sent to katie@stitchedmemory.com.

What we collect

We collect only what we need to make and ship your keepsake, run your gallery, and answer your questions:

• Order information — name, email, shipping address, the keepsake you ordered, gallery tier, and any notes you add at checkout.
• Payment information — handled entirely by Stripe. We never see or store your card number, expiration date, or CVC. Stripe gives us back a payment confirmation and the last four digits for our records.
• Photos and gallery content — anything you (or someone you've invited via a share link) upload to your gallery: photos, captions, and metadata embedded in those photos by your camera (date taken, GPS coordinates, device model). You can edit or remove this metadata in the gallery at any time.
• NFC tag interactions — when someone taps the tag sewn inside a keepsake, our server loads the linked gallery. We log the request so the page can render; we do not build a profile of who tapped, when, or where.
• Account information — if you sign in to manage your gallery, we store an email and a session token. Authentication is handled by Supabase.
• Email subscriptions — if you sign up for the newsletter, we store the email you provided. You can unsubscribe at any time using the link in any email we send you.
• Site usage — standard web analytics: pages viewed, approximate location (city/region from IP), browser, device, referring source. We use this to understand which pages help and which don't.

How we use it

• To make and ship your keepsake — generating shipping labels, sending order updates, and matching your order to the recovery ribbon and NFC tag.
• To run your gallery — storing the photos you upload, serving them to anyone with the share link, and letting you moderate contributions from family and friends.
• To reply when you write us, and to send the transactional emails (order confirmation, label, status updates, gallery activation).
• To send marketing emails only if you've subscribed. Order confirmations and status updates aren't marketing — they go out regardless.
• To improve the site — measuring which pages help customers and which don't.
• To prevent abuse — spam filtering, fraud screening, and basic security logging.

Service providers we share with

We do not sell your personal information. We share what's necessary with the following providers, who are bound to use your information only to provide their service to us:

• Stripe — payment processing.
• EasyPost / USPS — generating prepaid inbound and outbound shipping labels.
• Supabase — database, authentication, and photo storage.
• Vercel — website hosting and basic visitor analytics.
• Resend — transactional email delivery (order confirmations, status updates, password resets).
• Klaviyo — newsletter and marketing email delivery (only if you've subscribed).
• Google Analytics & Google Ads — site analytics and ad measurement.
• Meta (Facebook/Instagram) — ad measurement via the Meta Pixel.

We may also disclose information when required by law (e.g. a valid subpoena) or when necessary to protect the safety, rights, or property of Stitched Memory or our customers.

Cookies and tracking

The site uses cookies and similar technologies for two purposes: keeping you signed in to your gallery, and measuring traffic so we can understand which pages help. Analytics cookies come from Google Analytics, Vercel Analytics, and the Meta Pixel. You can disable cookies in your browser settings at any time; signing in to your gallery will not work without session cookies.

How long we keep things

• Orders and shipping records — kept for at least 7 years to satisfy tax and accounting requirements.
• Galleries and photos — kept for as long as your gallery is active. You can delete individual photos any time, or email us to delete the entire gallery.
• Rejected contributions — soft-deleted for 30 days, then permanently removed.
• Newsletter subscribers — kept until you unsubscribe.
• Site analytics — aggregated reports kept indefinitely; individual session data follows the providers' default retention windows (typically 14–26 months).

Your rights

Wherever you live, you can email katie@stitchedmemory.com and ask us to:

• Show you what personal information we hold about you.
• Correct anything that's wrong.
• Delete your gallery and the photos in it.
• Stop sending you marketing email (or click “unsubscribe” in any email).
• Export the photos in your gallery so you can take them with you.

If you live in California, the EU/UK, or another jurisdiction with specific privacy rights, you have those rights too — the same email gets you to the same person. We do not sell your personal information, so there is nothing to opt out of on that front.

Children

The site is not directed at children under 13, and we do not knowingly collect personal information from children. Galleries often contain photos of children — those are uploaded by the parent or guardian who owns the gallery, and they decide who can see them. If you believe a child has uploaded information without a parent's involvement, email us and we'll investigate and remove it.

Security

The site is served over HTTPS. Photos and gallery data are stored in Supabase with row-level security policies that restrict access to gallery owners and people they've shared with. Payment information never reaches our servers — it's submitted directly to Stripe. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you and the appropriate authorities as required by law.

Changes to this policy

If we change this policy in a meaningful way, we'll update the effective date at the top and, for significant changes, email subscribers and gallery owners. Continued use of the site after a change means you accept the updated policy.